Edit tour

Windows Analysis Report
Alcohol120_trial_2.1.1.1019.exe

Overview

General Information

Sample Name:	Alcohol120_trial_2.1.1.1019.exe
Analysis ID:	696690
MD5:	c07c71995fcf610966b3dc72da2338df
SHA1:	4b28aa0311d1cca7bcd7edd89c3d127017a15cf4
SHA256:	1d49d19f171c1f0136dad7b9ca6384915344185f202590606d106f27f4493443
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	18
Range:	0 - 100

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for dropped file

PE file has a writeable .text section

Changes security center settings (notifications, updates, antivirus, firewall)

Uses 32bit PE files

Creates files inside the driver directory

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Creates files inside the system directory

PE file contains sections with non-standard names

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

Entry point lies outside standard sections

EXE planting / hijacking vulnerabilities found

AV process strings found (often used to terminate AV products)

DLL planting / hijacking vulnerabilities found

Sample file is different than original file name gathered from version info

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Drops PE files to the windows directory (C:\Windows)

Creates driver files

Creates or modifies windows services

Queries disk information (often used to detect virtual machines)

Classification

Process Tree

System is start

Alcohol120_trial_2.1.1.1019.exe (PID: 2308 cmdline: "C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019.exe" MD5: C07C71995FCF610966B3DC72DA2338DF)

SPTD2inst.exe (PID: 5868 cmdline: "C:\Users\user\AppData\Local\Temp\SPTD2inst.exe" add /q MD5: 0E226BA5DFB6380C080E0718DFC00B93)

svchost.exe (PID: 676 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 9520A99E77D6196D0D09833146424113)

svchost.exe (PID: 3680 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 9520A99E77D6196D0D09833146424113)

svchost.exe (PID: 244 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc MD5: 9520A99E77D6196D0D09833146424113)

svchost.exe (PID: 1260 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p -s DoSvc MD5: 9520A99E77D6196D0D09833146424113)

svchost.exe (PID: 3792 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 9520A99E77D6196D0D09833146424113)

SgrmBroker.exe (PID: 1176 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: C51AA0BB954EA45E85572E6CC29BA6F4)

svchost.exe (PID: 4100 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc MD5: 9520A99E77D6196D0D09833146424113)

svchost.exe (PID: 5040 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: 9520A99E77D6196D0D09833146424113)

svchost.exe (PID: 1416 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: 9520A99E77D6196D0D09833146424113)

Alcohol120_trial_2.1.1.1019.exe (PID: 6312 cmdline: "C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019.exe" MD5: C07C71995FCF610966B3DC72DA2338DF)

svchost.exe (PID: 6708 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s lfsvc MD5: 9520A99E77D6196D0D09833146424113)

Alcohol120_trial_2.1.1.1019.exe (PID: 6900 cmdline: "C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019.exe" MD5: C07C71995FCF610966B3DC72DA2338DF)

Alcohol120_trial_2.1.1.1019.exe (PID: 6956 cmdline: "C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019.exe" MD5: C07C71995FCF610966B3DC72DA2338DF)

7zG.exe (PID: 7028 cmdline: "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\" -spe -an -ai#7zMap26653:116:7zEvent29920 MD5: 04FB3AE7F05C8BC333125972BA907398)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\lumsdk\net_updater32.exe	misc_pos	unknown	@patrickrolsen	0x168234:$s2: cmd /c net start %s 0x1e4326:$s3: pid: 0x49c0d0:$s5: COMSPEC

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Alcohol120_trial_2.1.1.1019.exe	ReversingLabs: Detection: 61%
Source: Alcohol120_trial_2.1.1.1019.exe	Virustotal: Detection: 57%			Perma Link

Antivirus / Scanner detection for submitted sample

Source: Alcohol120_trial_2.1.1.1019.exe

Avira: detected

Multi AV Scanner detection for dropped file

Source: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\Alcohol.exe	ReversingLabs: Detection: 45%
Source: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\lumsdk\lum_sdk32.dll	ReversingLabs: Detection: 12%
Source: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\lumsdk\net_updater32.exe	ReversingLabs: Detection: 12%

Antivirus or Machine Learning detection for unpacked file

Source: 25.2.7zG.exe.1baf1601b7e.5.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 25.2.7zG.exe.1baf15f6f7a.4.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 25.2.7zG.exe.1baf120c40e.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 25.2.7zG.exe.1baf1639326.8.unpack	Avira: Label: TR/Patched.Ren.Gen

Privilege Escalation

EXE planting / hijacking vulnerabilities found

Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\KillAxShlExHlper.exe	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\$TEMP\SPTD2inst.exe	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\Plugins\Helper\AxXMLPoster.exe	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\AxAHCIServiceEx.exe	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\lumsdk\AXLumSDKHlper.exe	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\Plugins\Helper\UACHlper.exe	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\$TEMP\SPTDinst.exe	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\Alcohol.exe	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\Plugins\Helper\UACHlperx64.exe	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\MX_RegAutoplayCanceler64.exe	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\Plugins\Helper\AxSrvUACHlper.exe	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\MX_RegShlEx64.exe	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\lumsdk\net_updater32.exe	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\AxCmd.exe	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\AxShlExHlper.exe	Jump to behavior

DLL planting / hijacking vulnerabilities found

Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\pfctoc.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\Alcoholx.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\$PLUGINSDIR\inetc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019.exe	DLL: USP10.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\$PLUGINSDIR\nsWeb.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\Plugins\Helper\AxSwindHlp.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\imgengine.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\$PLUGINSDIR\InstallOptions.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\AxShlEx64.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\$PLUGINSDIR\nsDialogs.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\SPTDIntf.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\$PLUGINSDIR\W10_17763RegHlper.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\Plugins\Helper\LiteZip.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\Plugins\DPMChart.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\$PLUGINSDIR\System.dll	Jump to behavior
Source: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019.exe	DLL: RichEd20.DLL	Jump to behavior
Source: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019.exe	DLL: SPTDIntf.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\$PLUGINSDIR\LangDLL.dll	Jump to behavior
Source: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019.exe	DLL: imageres.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\$TEMP\SPTDIntf.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\AxShlRes.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\Plugins\AxtraWd.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\AXShlEx.dll	Jump to behavior
Source: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019.exe	DLL: SHFOLDER.DLL	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\Plugins\DPM.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\DevSupp.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\Plugins\NapalmBurn.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\$PLUGINSDIR\SetupHlp.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\lumsdk\lum_sdk32.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\$PLUGINSDIR\nsExec.dll	Jump to behavior
Source: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019.exe	DLL: msls31.dll	Jump to behavior

Compliance

Uses 32bit PE files

Source: Alcohol120_trial_2.1.1.1019.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

EXE planting / hijacking vulnerabilities found

Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\KillAxShlExHlper.exe	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\$TEMP\SPTD2inst.exe	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\Plugins\Helper\AxXMLPoster.exe	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\AxAHCIServiceEx.exe	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\lumsdk\AXLumSDKHlper.exe	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\Plugins\Helper\UACHlper.exe	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\$TEMP\SPTDinst.exe	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\Alcohol.exe	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\Plugins\Helper\UACHlperx64.exe	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\MX_RegAutoplayCanceler64.exe	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\Plugins\Helper\AxSrvUACHlper.exe	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\MX_RegShlEx64.exe	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\lumsdk\net_updater32.exe	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\AxCmd.exe	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	EXE: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\AxShlExHlper.exe	Jump to behavior

DLL planting / hijacking vulnerabilities found

Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\pfctoc.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\Alcoholx.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\$PLUGINSDIR\inetc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019.exe	DLL: USP10.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\$PLUGINSDIR\nsWeb.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\Plugins\Helper\AxSwindHlp.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\imgengine.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\$PLUGINSDIR\InstallOptions.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\AxShlEx64.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\$PLUGINSDIR\nsDialogs.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\SPTDIntf.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\$PLUGINSDIR\W10_17763RegHlper.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\Plugins\Helper\LiteZip.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\Plugins\DPMChart.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\$PLUGINSDIR\System.dll	Jump to behavior
Source: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019.exe	DLL: RichEd20.DLL	Jump to behavior
Source: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019.exe	DLL: SPTDIntf.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\$PLUGINSDIR\LangDLL.dll	Jump to behavior
Source: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019.exe	DLL: imageres.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\$TEMP\SPTDIntf.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\AxShlRes.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\Plugins\AxtraWd.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\AXShlEx.dll	Jump to behavior
Source: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019.exe	DLL: SHFOLDER.DLL	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\Plugins\DPM.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\DevSupp.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\Plugins\NapalmBurn.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\$PLUGINSDIR\SetupHlp.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\lumsdk\lum_sdk32.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	DLL: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\$PLUGINSDIR\nsExec.dll	Jump to behavior
Source: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019.exe	DLL: msls31.dll	Jump to behavior

Found installer window with terms and condition text

Source: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019.exe	Window detected: < &BackI &AgreeCancelAlcohol Soft Development Team Alcohol Soft Development TeamLicense AgreementPlease review the license terms before installing Alcohol 120%.Press Page Down to see the rest of the agreement.License AgreementEULA revision December 2012IMPORTANT - READ CAREFULLY: Note: This software contains measures to check if it is a legitimate version of our software. If these checks ascertain that the version in use has been altered in anyway from the originalCertain aspects of the software will fail to function correctly; this can also lead to an instability or failure of your system.Alcohol Soft is not liable for any problems that occur from using a non legal version of the software.Alcohol Soft is under no obligation to offer help or advice on how to remedy any problems that occur through using a non legal version of the software. This End-User License Agreement is a legal agreement between you (either an individual or a single entity) and Alcohol Soft for the software product identified above which includes computer software and may include associated media printed materials and "online" or electronic documentation ("SOFTWARE PRODUCT"). By installing copying or otherwise using the SOFTWARE PRODUCT you agree to be bound by the terms of this LICENSE AGREEMENT. If you do not agree to the terms of this LICENSE AGREEMENT do not install or use the SOFTWARE PRODUCT. License conditionsNo part of the software or the manual may be multiplied disseminated or processed in any way without the written consent of Alcohol Soft. Violations of these conditions will be prosecuted in every case. The use of the software is done at your own risk. The manufacturer and developer accept no liability for any damages either as direct or indirect consequence of the use of this product or software. Only observance of these conditions allows you to use the hardware and software in your computer system. All rights reserved. Software Copyright (C) 2002-2012 Alcohol Soft Development TeamSOFTWARE PRODUCT LICENSE The SOFTWARE PRODUCT is protected by copyright laws and international copyright treaties as well as other intellectual property laws and treaties. The SOFTWARE PRODUCT is licensed not sold. This also applies to demo versions. GRANT OF LICENSE. This LICENSE AGREEMENT grants you the following rights: Applications SoftwareYou may install and use one copy of the SOFTWARE PRODUCT or any prior version for the same operating system on a single computer. The primary user of the computer on which the SOFTWARE PRODUCT is installed may make a second copy for his or her exclusive use. Storage/Network UseYou may also store or install a copy of the SOFTWARE PRODUCT on a storage device such as a network server used only to install or run the SOFTWARE PRODUCT on your other computers over an internal network; however you must acquire and dedicate a license for each separate computer on which the SOFTWARE PRODUCT is installed or run from the storage device. A license for the SOFTW
Source: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019.exe	Window detected: < &Back&Next >CancelAlcohol Soft Development Team Alcohol Soft Development TeamLicense AgreementPlease review the license terms before installing Alcohol 120%.Press Page Down to see the rest of the agreement.License AgreementEULA revision December 2012IMPORTANT - READ CAREFULLY: Note: This software contains measures to check if it is a legitimate version of our software. If these checks ascertain that the version in use has been altered in anyway from the originalCertain aspects of the software will fail to function correctly; this can also lead to an instability or failure of your system.Alcohol Soft is not liable for any problems that occur from using a non legal version of the software.Alcohol Soft is under no obligation to offer help or advice on how to remedy any problems that occur through using a non legal version of the software. This End-User License Agreement is a legal agreement between you (either an individual or a single entity) and Alcohol Soft for the software product identified above which includes computer software and may include associated media printed materials and "online" or electronic documentation ("SOFTWARE PRODUCT"). By installing copying or otherwise using the SOFTWARE PRODUCT you agree to be bound by the terms of this LICENSE AGREEMENT. If you do not agree to the terms of this LICENSE AGREEMENT do not install or use the SOFTWARE PRODUCT. License conditionsNo part of the software or the manual may be multiplied disseminated or processed in any way without the written consent of Alcohol Soft. Violations of these conditions will be prosecuted in every case. The use of the software is done at your own risk. The manufacturer and developer accept no liability for any damages either as direct or indirect consequence of the use of this product or software. Only observance of these conditions allows you to use the hardware and software in your computer system. All rights reserved. Software Copyright (C) 2002-2012 Alcohol Soft Development TeamSOFTWARE PRODUCT LICENSE The SOFTWARE PRODUCT is protected by copyright laws and international copyright treaties as well as other intellectual property laws and treaties. The SOFTWARE PRODUCT is licensed not sold. This also applies to demo versions. GRANT OF LICENSE. This LICENSE AGREEMENT grants you the following rights: Applications SoftwareYou may install and use one copy of the SOFTWARE PRODUCT or any prior version for the same operating system on a single computer. The primary user of the computer on which the SOFTWARE PRODUCT is installed may make a second copy for his or her exclusive use. Storage/Network UseYou may also store or install a copy of the SOFTWARE PRODUCT on a storage device such as a network server used only to install or run the SOFTWARE PRODUCT on your other computers over an internal network; however you must acquire and dedicate a license for each separate computer on which the SOFTWARE PRODUCT is installed or run from the storage device. A license for the SOFTWA

Creates a software restore point

Source: C:\Users\user\AppData\Local\Temp\SPTD2inst.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore SRInitDone

Jump to behavior

PE / OLE file has a valid certificate

Source: Alcohol120_trial_2.1.1.1019.exe

Static PE information: certificate valid

Binary contains paths to debug symbols

Source:	Binary string: alcoholx.pdb source: 7zG.exe, 00000019.00000002.2458405645.000001BAF1639000.00000004.00000020.00020000.00000000.sdmp, Alcoholx.dll.25.dr
Source:	Binary string: C:\projects\ipnetwork\src\System.Net.IPNetwork\obj\release\net45\System.Net.IPNetwork.pdb source: net_updater32.exe.25.dr, lum_sdk32.dll.25.dr
Source:	Binary string: alcohol.pdbH source: 7zG.exe, 00000019.00000002.2458405645.000001BAF1639000.00000004.00000020.00020000.00000000.sdmp, Alcoholx.dll.25.dr
Source:	Binary string: P.pdbZ source: 7zG.exe, 00000019.00000002.2458405645.000001BAF1639000.00000004.00000020.00020000.00000000.sdmp, NapalmBurn.dll.25.dr
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, net_updater32.exe.25.dr
Source:	Binary string: c:\cygwin\home\bat\bat\checkout\zon\build.app_win64r\pkg\win\sdk\lum_sdk32.dll.pdb source: net_updater32.exe.25.dr, lum_sdk32.dll.25.dr
Source:	Binary string: E:\A\_work\39\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.ValueTuple\netstandard1.0\System.ValueTuple.pdb source: net_updater32.exe.25.dr, lum_sdk32.dll.25.dr
Source:	Binary string: C:\Users\Richard\Documents\GitHub\NTFS-Streams\ntfsstreams\Trinet.Core.IO.Ntfs\obj\Release\net35\Trinet.Core.IO.Ntfs.pdb source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, net_updater32.exe.25.dr
Source:	Binary string: c:\cygwin\home\bat\bat\checkout\zon\build.app_win64r\pkg\win\sdk\test_wpf.exe.pdb source: net_updater32.exe.25.dr
Source:	Binary string: sptd2.pdb source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, SPTD2inst.exe, 00000006.00000000.1343326394.00007FF7E4556000.00000002.00000001.01000000.0000000F.sdmp, nso7B63.tmp.24.dr, sptd2.sys.6.dr, nsfCAF0.tmp.16.dr, SPTD2inst.exe.25.dr, nsg1C41.tmp.0.dr, SPTD2inst.exe.0.dr
Source:	Binary string: C:\projects\dotnetzip-semverd\src\Zip\obj\Release\DotNetZip.pdb source: net_updater32.exe.25.dr, lum_sdk32.dll.25.dr
Source:	Binary string: c:\cygwin\home\bat\bat\checkout\zon\build.app_win64r\pkg\win\sdk\lum_sdk_int.dll.pdb source: net_updater32.exe.25.dr, lum_sdk32.dll.25.dr
Source:	Binary string: c:\svn\sptd\setup\objfre_wnet_amd64\amd64\SPTDinst.pdb source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, nsg1C41.tmp.0.dr
Source:	Binary string: SPTD2inst.pdb source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, SPTD2inst.exe, 00000006.00000000.1343130023.00007FF7E4547000.00000002.00000001.01000000.0000000F.sdmp, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, SPTD2inst.exe.25.dr, nsg1C41.tmp.0.dr, SPTD2inst.exe.0.dr
Source:	Binary string: c:\cygwin\home\bat\bat\checkout\zon\build.app_win64r\pkg\win\sdk\idle_report.exe.pdb source: net_updater32.exe.25.dr, lum_sdk32.dll.25.dr
Source:	Binary string: msvcr120.i386.pdb source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, net_updater32.exe.25.dr
Source:	Binary string: c:\cygwin\home\bat\bat\checkout\zon\build.app_win64r\pkg\win\util\websocket_sharp\WebSocketSharp.dll.pdb source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, net_updater32.exe.25.dr
Source:	Binary string: E:\A\_work\39\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.ValueTuple\netstandard1.0\System.ValueTuple.pdbSHA256 source: net_updater32.exe.25.dr, lum_sdk32.dll.25.dr
Source:	Binary string: imgengine.pdb source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2443082516.000001BAEF32F000.00000004.00000020.00020000.00000000.sdmp, imgengine.dll.25.dr
Source:	Binary string: c:\cygwin\home\bat\bat\checkout\zon\build.app_win64r\pkg\win\sdk\lum_sdk32_clr.dll.pdb source: net_updater32.exe.25.dr, lum_sdk32.dll.25.dr
Source:	Binary string: alcohol.pdbU source: 7zG.exe, 00000019.00000002.2458405645.000001BAF1639000.00000004.00000020.00020000.00000000.sdmp, Alcoholx.dll.25.dr
Source:	Binary string: c:\cygwin\home\bat\bat\checkout\zon\build.app_win64r\pkg\win\util\lum_sdk_util.dll.pdb source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, net_updater32.exe.25.dr
Source:	Binary string: c:\cygwin\home\bat\bat\checkout\zon\build.app_win64r\pkg\win\sdk\lum_sdk_int.dll.pdbr source: net_updater32.exe.25.dr, lum_sdk32.dll.25.dr
Source:	Binary string: c:\svn\sptd\setup\objfre_wxp_x86\i386\SPTDinst.pdb source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, SPTDinst.exe.25.dr, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, nsg1C41.tmp.0.dr
Source:	Binary string: C:\Documents and Settings\martin\My Documents\Visual Studio 2010\Projects\KillAxShlExHlper\Release\KillAxShlExHlper.pdb source: 7zG.exe, 00000019.00000002.2462678727.000001BAF18B5000.00000004.00000020.00020000.00000000.sdmp, KillAxShlExHlper.exe.25.dr
Source:	Binary string: c:\svn\sptd\setup\objfre_wnet_amd64\amd64\SPTDinst.pdbH source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, nsg1C41.tmp.0.dr
Source:	Binary string: c:\cygwin\home\bat\bat\checkout\zon\build.app_win64r\pkg\win\sdk\net_updater32.exe.pdb source: net_updater32.exe.25.dr
Source:	Binary string: alcohol.pdb source: 7zG.exe, 00000019.00000002.2458405645.000001BAF1639000.00000004.00000020.00020000.00000000.sdmp, Alcoholx.dll.25.dr
Source:	Binary string: C:\projects\ipnetwork\src\System.Net.IPNetwork\obj\release\net45\System.Net.IPNetwork.pdbSHA256j source: net_updater32.exe.25.dr, lum_sdk32.dll.25.dr
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256^Y source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, net_updater32.exe.25.dr
Source:	Binary string: C:\Users\Richard\Documents\GitHub\NTFS-Streams\ntfsstreams\Trinet.Core.IO.Ntfs\obj\Release\net35\Trinet.Core.IO.Ntfs.pdbma source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, net_updater32.exe.25.dr
Source:	Binary string: c:\svn\sptd\setup\objfre_wxp_x86\i386\SPTDinst.pdbf source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, SPTDinst.exe.25.dr, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, nsg1C41.tmp.0.dr

Spreading

Source: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019.exe	File opened: C:\Users\user\AppData\Local\Temp\nsg1C42.tmp\W10_17763RegHlper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019.exe	File opened: C:\Users\user\AppData\Local\Temp\nsg1C42.tmp\	Jump to behavior
Source: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior

Networking

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, net_updater32.exe.25.dr, lum_sdk32.dll.25.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, net_updater32.exe.25.dr, lum_sdk32.dll.25.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, net_updater32.exe.25.dr	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, net_updater32.exe.25.dr, AXLumSDKHlper.exe.25.dr, lum_sdk32.dll.25.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: svchost.exe, 00000003.00000002.2449883320.000002AA1888B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2443082516.000001BAEF32F000.00000004.00000020.00020000.00000000.sdmp, imgengine.dll.25.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2443082516.000001BAEF32F000.00000004.00000020.00020000.00000000.sdmp, imgengine.dll.25.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, SetupHlp.dll.16.dr, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, nsg1C41.tmp.0.dr, SetupHlp.dll.25.dr	String found in binary or memory: http://crl.daemon-tools.cc/entity.crl0
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, SPTDinst.exe.25.dr, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, nsg1C41.tmp.0.dr	String found in binary or memory: http://crl.duplexsecure.com/entity.crl0
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2458405645.000001BAF1639000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2444387632.000001BAEF3B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2442500190.000001BAEEDFC000.00000004.00000020.00020000.00000000.sdmp, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, SPTDIntf.dll.0.dr, nsg1C41.tmp.0.dr, SPTDIntf.dll.25.dr, Alcoholx.dll.25.dr, SPTDIntf.dll0.25.dr	String found in binary or memory: http://crl.globalsign.com/gs/gscodesigng2.crl0
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, SPTDinst.exe.25.dr, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, nsg1C41.tmp.0.dr	String found in binary or memory: http://crl.globalsign.com/gs/gscodesigng3.crl0
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1531570592.0000000000409000.00000004.00000001.01000000.00000003.sdmp, SPTD2inst.exe, 00000006.00000000.1343326394.00007FF7E4556000.00000002.00000001.01000000.0000000F.sdmp, 7zG.exe, 00000019.00000002.2442500190.000001BAEEDFC000.00000004.00000020.00020000.00000000.sdmp, SPTDinst.exe.25.dr, nso7B63.tmp.24.dr, sptd2.sys.6.dr, nsfCAF0.tmp.16.dr, SPTD2inst.exe.25.dr, SPTDIntf.dll.0.dr, nsg1C41.tmp.0.dr, SPTDIntf.dll.25.dr, SPTD2inst.exe.0.dr, SPTDIntf.dll0.25.dr	String found in binary or memory: http://crl.globalsign.com/gs/gscodesignsha2g2.crl0
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2458405645.000001BAF1639000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2444387632.000001BAEF3B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2443082516.000001BAEF32F000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2442500190.000001BAEEDFC000.00000004.00000020.00020000.00000000.sdmp, SPTDinst.exe.25.dr, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, SPTDIntf.dll.0.dr, nsg1C41.tmp.0.dr, SPTDIntf.dll.25.dr, Alcoholx.dll.25.dr, imgengine.dll.25.dr, SPTDIntf.dll0.25.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingg2.crl0T
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1531570592.0000000000409000.00000004.00000001.01000000.00000003.sdmp, SPTD2inst.exe, 00000006.00000000.1343326394.00007FF7E4556000.00000002.00000001.01000000.0000000F.sdmp, nso7B63.tmp.24.dr, sptd2.sys.6.dr, nsfCAF0.tmp.16.dr, SPTD2inst.exe.25.dr, nsg1C41.tmp.0.dr, SPTD2inst.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2442500190.000001BAEEDFC000.00000004.00000020.00020000.00000000.sdmp, SPTDinst.exe.25.dr, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, SPTDIntf.dll.0.dr, nsg1C41.tmp.0.dr, SPTDIntf.dll.25.dr, SPTDIntf.dll0.25.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0X
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, SPTDinst.exe.25.dr, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, nsg1C41.tmp.0.dr	String found in binary or memory: http://crl.globalsign.com/root.crl0Y
Source: svchost.exe, 00000003.00000002.2449883320.000002AA1888B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1531570592.0000000000409000.00000004.00000001.01000000.00000003.sdmp, SPTD2inst.exe, 00000006.00000000.1343326394.00007FF7E4556000.00000002.00000001.01000000.0000000F.sdmp, SPTD2inst.exe, 00000006.00000003.1348098962.00000292B902A000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2442500190.000001BAEEDFC000.00000004.00000020.00020000.00000000.sdmp, SPTDinst.exe.25.dr, nso7B63.tmp.24.dr, sptd2.sys.6.dr, nsfCAF0.tmp.16.dr, SPTD2inst.exe.25.dr, SPTDIntf.dll.0.dr, nsg1C41.tmp.0.dr, SPTDIntf.dll.25.dr, SPTD2inst.exe.0.dr, SPTDIntf.dll0.25.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2458405645.000001BAF1639000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2444387632.000001BAEF3B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2443082516.000001BAEF32F000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2442500190.000001BAEEDFC000.00000004.00000020.00020000.00000000.sdmp, SPTDinst.exe.25.dr, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, SPTDIntf.dll.0.dr, nsg1C41.tmp.0.dr, SPTDIntf.dll.25.dr, Alcoholx.dll.25.dr, imgengine.dll.25.dr, SPTDIntf.dll0.25.dr	String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1531570592.0000000000409000.00000004.00000001.01000000.00000003.sdmp, SPTD2inst.exe, 00000006.00000000.1343326394.00007FF7E4556000.00000002.00000001.01000000.0000000F.sdmp, 7zG.exe, 00000019.00000002.2442500190.000001BAEEDFC000.00000004.00000020.00020000.00000000.sdmp, SPTDinst.exe.25.dr, nso7B63.tmp.24.dr, sptd2.sys.6.dr, nsfCAF0.tmp.16.dr, SPTD2inst.exe.25.dr, SPTDIntf.dll.0.dr, nsg1C41.tmp.0.dr, SPTDIntf.dll.25.dr, SPTD2inst.exe.0.dr, SPTDIntf.dll0.25.dr	String found in binary or memory: http://crl.globalsign.net/root.crl0O
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, SetupHlp.dll.16.dr, SPTDinst.exe.25.dr, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, nsg1C41.tmp.0.dr, SetupHlp.dll.25.dr	String found in binary or memory: http://crl.grsign.com/rootca.crl0Q
Source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, net_updater32.exe.25.dr, AXLumSDKHlper.exe.25.dr, lum_sdk32.dll.25.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: Alcohol120_trial_2.1.1.1019.exe, AXLumSDKHlper.exe.25.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: UACHlper.exe.25.dr, W10_17763RegHlper.dll.24.dr, W10_17763RegHlper.dll.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: svchost.exe, 00000003.00000002.2446511929.000002AA172D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, net_updater32.exe.25.dr, lum_sdk32.dll.25.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, net_updater32.exe.25.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, net_updater32.exe.25.dr	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, net_updater32.exe.25.dr, lum_sdk32.dll.25.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, net_updater32.exe.25.dr, lum_sdk32.dll.25.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, net_updater32.exe.25.dr	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
Source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, net_updater32.exe.25.dr, lum_sdk32.dll.25.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, net_updater32.exe.25.dr, AXLumSDKHlper.exe.25.dr, lum_sdk32.dll.25.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: Alcohol120_trial_2.1.1.1019.exe, AXLumSDKHlper.exe.25.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: svchost.exe, 00000003.00000003.1208811647.000002AA1CA4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 00000003.00000003.1208648695.000002AA1CA14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/AJzR0Zz0SQOCHzc0sR3MfHk_91.0.4472.77/91.0.4472.77_c
Source: svchost.exe, 00000003.00000003.1208811647.000002AA1CA4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ANlaTV2JH2WK9RCoHi__mxg_1.0.6/S3ybLvFx94H
Source: svchost.exe, 00000003.00000003.1208811647.000002AA1CA4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/APVOrL1aIZFPVuxAFYGUnkE_20210520.37540039
Source: svchost.exe, 00000003.00000003.1208811647.000002AA1CA4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/APXXLABkvVhhXtYF5CAJK8E_43/G7yvLIv4RYlDG8
Source: net_updater32.exe.25.dr	String found in binary or memory: http://james.newtonking.com/projects/json
Source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, net_updater32.exe.25.dr, lum_sdk32.dll.25.dr	String found in binary or memory: http://luminati.io0
Source: Alcohol120_trial_2.1.1.1019.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: Alcohol120_trial_2.1.1.1019.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2443082516.000001BAEF32F000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, net_updater32.exe.25.dr, imgengine.dll.25.dr, AXLumSDKHlper.exe.25.dr, lum_sdk32.dll.25.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, net_updater32.exe.25.dr, lum_sdk32.dll.25.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, net_updater32.exe.25.dr	String found in binary or memory: http://ocsp.digicert.com0K
Source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, net_updater32.exe.25.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, net_updater32.exe.25.dr, lum_sdk32.dll.25.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1531570592.0000000000409000.00000004.00000001.01000000.00000003.sdmp, SPTD2inst.exe, 00000006.00000000.1343326394.00007FF7E4556000.00000002.00000001.01000000.0000000F.sdmp, 7zG.exe, 00000019.00000002.2442500190.000001BAEEDFC000.00000004.00000020.00020000.00000000.sdmp, SPTDinst.exe.25.dr, nso7B63.tmp.24.dr, sptd2.sys.6.dr, nsfCAF0.tmp.16.dr, SPTD2inst.exe.25.dr, SPTDIntf.dll.0.dr, nsg1C41.tmp.0.dr, SPTDIntf.dll.25.dr, SPTD2inst.exe.0.dr, SPTDIntf.dll0.25.dr	String found in binary or memory: http://ocsp.globalsign.com/ExtendedSSLSHA256CACross0
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, SPTDinst.exe.25.dr, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, nsg1C41.tmp.0.dr	String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, net_updater32.exe.25.dr, AXLumSDKHlper.exe.25.dr, lum_sdk32.dll.25.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: UACHlper.exe.25.dr, W10_17763RegHlper.dll.24.dr, W10_17763RegHlper.dll.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2458405645.000001BAF1639000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2444387632.000001BAEF3B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2442500190.000001BAEEDFC000.00000004.00000020.00020000.00000000.sdmp, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, SPTDIntf.dll.0.dr, nsg1C41.tmp.0.dr, SPTDIntf.dll.25.dr, Alcoholx.dll.25.dr, SPTDIntf.dll0.25.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesigng20
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, SPTDinst.exe.25.dr, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, nsg1C41.tmp.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesigng30V
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1531570592.0000000000409000.00000004.00000001.01000000.00000003.sdmp, SPTD2inst.exe, 00000006.00000000.1343326394.00007FF7E4556000.00000002.00000001.01000000.0000000F.sdmp, 7zG.exe, 00000019.00000002.2442500190.000001BAEEDFC000.00000004.00000020.00020000.00000000.sdmp, SPTDinst.exe.25.dr, nso7B63.tmp.24.dr, sptd2.sys.6.dr, nsfCAF0.tmp.16.dr, SPTD2inst.exe.25.dr, SPTDIntf.dll.0.dr, nsg1C41.tmp.0.dr, SPTDIntf.dll.25.dr, SPTD2inst.exe.0.dr, SPTDIntf.dll0.25.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g20
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1531570592.0000000000409000.00000004.00000001.01000000.00000003.sdmp, SPTD2inst.exe, 00000006.00000000.1343326394.00007FF7E4556000.00000002.00000001.01000000.0000000F.sdmp, nso7B63.tmp.24.dr, sptd2.sys.6.dr, nsfCAF0.tmp.16.dr, SPTD2inst.exe.25.dr, nsg1C41.tmp.0.dr, SPTD2inst.exe.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: svchost.exe, 00000003.00000003.1208648695.000002AA1CA14000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr	String found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHF
Source: svchost.exe, 00000003.00000003.1208811647.000002AA1CA4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/AIZk8O7Cv2UUbxc_aaUykKI_7/ALzUVHP-vRgKCz
Source: svchost.exe, 00000003.00000003.1208811647.000002AA1CA4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/AT25IXegX04GPhlqizv_jg_281/cp83jQFxy4Co7
Source: svchost.exe, 00000003.00000003.1208811647.000002AA1CA4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/CLzUPOY7PeNCWmHSoqszxQ_9.27.0/ANtasjH7xN
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2458405645.000001BAF1639000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2444387632.000001BAEF3B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2443082516.000001BAEF32F000.00000004.00000020.00020000.00000000.sdmp, AxtraWd.dll.25.dr, nso7B63.tmp.24.dr, DevSupp.dll.25.dr, AxCmd.exe.25.dr, nsfCAF0.tmp.16.dr, AxAHCIServiceEx.exe.25.dr, W10_17763RegHlper.dll.16.dr, nsg1C41.tmp.0.dr, W10_17763RegHlper.dll.24.dr, W10_17763RegHlper.dll.0.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2458405645.000001BAF1639000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2443082516.000001BAEF32F000.00000004.00000020.00020000.00000000.sdmp, AxtraWd.dll.25.dr, nso7B63.tmp.24.dr, DevSupp.dll.25.dr, AxCmd.exe.25.dr, nsfCAF0.tmp.16.dr, AxAHCIServiceEx.exe.25.dr, W10_17763RegHlper.dll.16.dr, nsg1C41.tmp.0.dr, W10_17763RegHlper.dll.24.dr, W10_17763RegHlper.dll.0.dr	String found in binary or memory: http://s2.symcb.com0
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2458405645.000001BAF1639000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2444387632.000001BAEF3B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2442500190.000001BAEEDFC000.00000004.00000020.00020000.00000000.sdmp, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, SPTDIntf.dll.0.dr, nsg1C41.tmp.0.dr, SPTDIntf.dll.25.dr, Alcoholx.dll.25.dr, SPTDIntf.dll0.25.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesigng2.crt04
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, SPTDinst.exe.25.dr, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, nsg1C41.tmp.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesigng3ocsp.crt04
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1531570592.0000000000409000.00000004.00000001.01000000.00000003.sdmp, SPTD2inst.exe, 00000006.00000000.1343326394.00007FF7E4556000.00000002.00000001.01000000.0000000F.sdmp, 7zG.exe, 00000019.00000002.2442500190.000001BAEEDFC000.00000004.00000020.00020000.00000000.sdmp, SPTDinst.exe.25.dr, nso7B63.tmp.24.dr, sptd2.sys.6.dr, nsfCAF0.tmp.16.dr, SPTD2inst.exe.25.dr, SPTDIntf.dll.0.dr, nsg1C41.tmp.0.dr, SPTDIntf.dll.25.dr, SPTD2inst.exe.0.dr, SPTDIntf.dll0.25.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g2.crt08
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2458405645.000001BAF1639000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2444387632.000001BAEF3B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2443082516.000001BAEF32F000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2442500190.000001BAEEDFC000.00000004.00000020.00020000.00000000.sdmp, SPTDinst.exe.25.dr, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, SPTDIntf.dll.0.dr, nsg1C41.tmp.0.dr, SPTDIntf.dll.25.dr, Alcoholx.dll.25.dr, imgengine.dll.25.dr, SPTDIntf.dll0.25.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingg2.crt0
Source: nsg1C41.tmp.0.dr, SPTDIntf.dll.25.dr, SPTD2inst.exe.0.dr, SPTDIntf.dll0.25.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1532246381.000000000054B000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1531916915.00000000004E0000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000010.00000003.1698971628.000000000055D000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000018.00000003.2143049815.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2441540918.000001BAEEDCB000.00000004.00000020.00020000.00000000.sdmp, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, nsg1C41.tmp.0.dr	String found in binary or memory: http://support.alcohol-soft.com/display_trial_fe_adpage_in_intaller.php
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1531916915.00000000004E0000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000010.00000003.1698971628.000000000055D000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000018.00000003.2143049815.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2441540918.000001BAEEDCB000.00000004.00000020.00020000.00000000.sdmp, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, nsg1C41.tmp.0.dr	String found in binary or memory: http://support.alcohol-soft.com/display_trial_fe_adpage_in_intaller.php/SILENTget1023
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000003.1297952869.000000000059C000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000010.00000003.1698971628.000000000055D000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000018.00000003.2143049815.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2441540918.000001BAEEDCB000.00000004.00000020.00020000.00000000.sdmp, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, nsg1C41.tmp.0.dr	String found in binary or memory: http://support.alcohol-soft.com/install_special_page.php?ref=A120T
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1531916915.00000000004E0000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000010.00000003.1698971628.000000000055D000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000018.00000003.2143049815.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2441540918.000001BAEEDCB000.00000004.00000020.00020000.00000000.sdmp, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, nsg1C41.tmp.0.dr	String found in binary or memory: http://support.alcohol-soft.com/install_special_page.php?ref=A120TAdPageTitleSubTitleURL
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1531916915.00000000004E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://support.alcohol-soft.com/install_special_page.php?ref=A120TH~
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000003.1295640182.00000000039C0000.00000004.00000800.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1531730987.0000000000434000.00000004.00000001.01000000.00000003.sdmp, InstallerADs.INI.0.dr, install_special_page[1].htm.0.dr	String found in binary or memory: http://support.alcohol-soft.com/install_special_page_contents.php
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1531730987.0000000000434000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://support.alcohol-soft.com/install_special_page_contents.php3284363278082047150324
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, nso7B63.tmp.24.dr, DevSupp.dll.25.dr, nsfCAF0.tmp.16.dr, AxAHCIServiceEx.exe.25.dr, W10_17763RegHlper.dll.16.dr, nsg1C41.tmp.0.dr, W10_17763RegHlper.dll.24.dr, W10_17763RegHlper.dll.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: 7zG.exe, 00000019.00000002.2458405645.000001BAF1639000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2443082516.000001BAEF32F000.00000004.00000020.00020000.00000000.sdmp, AxtraWd.dll.25.dr, AxCmd.exe.25.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2458405645.000001BAF1639000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2443082516.000001BAEF32F000.00000004.00000020.00020000.00000000.sdmp, AxtraWd.dll.25.dr, nso7B63.tmp.24.dr, DevSupp.dll.25.dr, AxCmd.exe.25.dr, nsfCAF0.tmp.16.dr, AxAHCIServiceEx.exe.25.dr, W10_17763RegHlper.dll.16.dr, nsg1C41.tmp.0.dr, W10_17763RegHlper.dll.24.dr, W10_17763RegHlper.dll.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2458405645.000001BAF1639000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2443082516.000001BAEF32F000.00000004.00000020.00020000.00000000.sdmp, AxtraWd.dll.25.dr, nso7B63.tmp.24.dr, DevSupp.dll.25.dr, AxCmd.exe.25.dr, nsfCAF0.tmp.16.dr, AxAHCIServiceEx.exe.25.dr, W10_17763RegHlper.dll.16.dr, nsg1C41.tmp.0.dr, W10_17763RegHlper.dll.24.dr, W10_17763RegHlper.dll.0.dr	String found in binary or memory: http://sv.symcd.com0&
Source: UACHlper.exe.25.dr, W10_17763RegHlper.dll.24.dr, W10_17763RegHlper.dll.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: UACHlper.exe.25.dr, W10_17763RegHlper.dll.24.dr, W10_17763RegHlper.dll.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: UACHlper.exe.25.dr, W10_17763RegHlper.dll.24.dr, W10_17763RegHlper.dll.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000003.1525184514.00000000005C8000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000000.00000003.1525469195.00000000039FC000.00000004.00000800.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1531916915.00000000004E0000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000010.00000003.1698971628.000000000055D000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000018.00000003.2143049815.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2441540918.000001BAEEDCB000.00000004.00000020.00020000.00000000.sdmp, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, nsg1C41.tmp.0.dr	String found in binary or memory: http://www.120search.com/terms.html
Source: nsg1C41.tmp.0.dr	String found in binary or memory: http://www.alcohol-soft.com/
Source: nsg1C41.tmp.0.dr	String found in binary or memory: http://www.alcohol-soft.com/hpdskflt.php
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1531916915.00000000004E0000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000010.00000003.1698971628.000000000055D000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000018.00000003.2143049815.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2441540918.000001BAEEDCB000.00000004.00000020.00020000.00000000.sdmp, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, nsg1C41.tmp.0.dr	String found in binary or memory: http://www.alcohol-soft.com/hpdskflt.phpopen
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1531916915.00000000004E0000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000010.00000003.1698971628.000000000055D000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000018.00000003.2143049815.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2441540918.000001BAEEDCB000.00000004.00000020.00020000.00000000.sdmp, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, nsg1C41.tmp.0.dr	String found in binary or memory: http://www.alcohol-soft.com/images/a_logo_144x140.png
Source: nsg1C41.tmp.0.dr	String found in binary or memory: http://www.alcohol-soft.com/install.php?pid=Alcohol120_trial__2.1.1.1019&SFA=
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1531916915.00000000004E0000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000010.00000003.1698971628.000000000055D000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000018.00000003.2143049815.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2441540918.000001BAEEDCB000.00000004.00000020.00020000.00000000.sdmp, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, nsg1C41.tmp.0.dr	String found in binary or memory: http://www.alcohol-soft.com/open
Source: 7zG.exe, 00000019.00000002.2439672212.000001BAED4B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3
Source: svchost.exe, 00000008.00000002.1461600399.000001698E613000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: lum_sdk32.dll.25.dr	String found in binary or memory: http://www.codeplex.com/DotNetZip
Source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, net_updater32.exe.25.dr, lum_sdk32.dll.25.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: nsg1C41.tmp.0.dr	String found in binary or memory: http://www.duplexsecure.com/
Source: nsg1C41.tmp.0.dr	String found in binary or memory: http://www.filefacts.net/redirect.php?
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1531916915.00000000004E0000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000010.00000003.1698971628.000000000055D000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000018.00000003.2143049815.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2441540918.000001BAEEDCB000.00000004.00000020.00020000.00000000.sdmp, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, nsg1C41.tmp.0.dr	String found in binary or memory: http://www.filefacts.net/redirect.php?ext=%s
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1531916915.00000000004E0000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000010.00000003.1698971628.000000000055D000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000018.00000003.2143049815.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2441540918.000001BAEEDCB000.00000004.00000020.00020000.00000000.sdmp, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, nsg1C41.tmp.0.dr	String found in binary or memory: http://www.filefacts.net/redirect.php?lang=%04x&ext=%s
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1531916915.00000000004E0000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000010.00000003.1698971628.000000000055D000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000018.00000003.2143049815.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2441540918.000001BAEEDCB000.00000004.00000020.00020000.00000000.sdmp, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, nsg1C41.tmp.0.dr	String found in binary or memory: http://www.filefacts.net/redirect.php?lang=%04x&ext=%shttp://www.filefacts.net/redirect.php?ext=%s
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1531570592.0000000000409000.00000004.00000001.01000000.00000003.sdmp, SPTD2inst.exe, 00000006.00000000.1343326394.00007FF7E4556000.00000002.00000001.01000000.0000000F.sdmp, 7zG.exe, 00000019.00000002.2442500190.000001BAEEDFC000.00000004.00000020.00020000.00000000.sdmp, SPTDinst.exe.25.dr, nso7B63.tmp.24.dr, sptd2.sys.6.dr, nsfCAF0.tmp.16.dr, SPTD2inst.exe.25.dr, SPTDIntf.dll.0.dr, nsg1C41.tmp.0.dr, SPTDIntf.dll.25.dr, SPTD2inst.exe.0.dr, SPTDIntf.dll0.25.dr	String found in binary or memory: http://www.globalsign.net/repository/03
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2458405645.000001BAF1639000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2443082516.000001BAEF32F000.00000004.00000020.00020000.00000000.sdmp, AxtraWd.dll.25.dr, nso7B63.tmp.24.dr, DevSupp.dll.25.dr, AxCmd.exe.25.dr, nsfCAF0.tmp.16.dr, AxAHCIServiceEx.exe.25.dr, W10_17763RegHlper.dll.16.dr, nsg1C41.tmp.0.dr, W10_17763RegHlper.dll.24.dr, W10_17763RegHlper.dll.0.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2458405645.000001BAF1639000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2443082516.000001BAEF32F000.00000004.00000020.00020000.00000000.sdmp, AxtraWd.dll.25.dr, nso7B63.tmp.24.dr, DevSupp.dll.25.dr, AxCmd.exe.25.dr, nsfCAF0.tmp.16.dr, AxAHCIServiceEx.exe.25.dr, W10_17763RegHlper.dll.16.dr, nsg1C41.tmp.0.dr, W10_17763RegHlper.dll.24.dr, W10_17763RegHlper.dll.0.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: svchost.exe, 00000004.00000002.2441101764.00000186F7641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000004.00000002.2441101764.00000186F7641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000004.00000002.2441101764.00000186F7641000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.2440547697.00000186F762B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.2442338679.00000186F7670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 00000008.00000003.1460033766.000001698E648000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1459902320.000001698E646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000004.00000002.2441101764.00000186F7641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bn2-df.notify.windows.com/v2/register/xplatform/device
Source: net_updater32.exe.25.dr, lum_sdk32.dll.25.dr	String found in binary or memory: https://brightdata.com/faq#accepted_usage?
Source: net_updater32.exe.25.dr, lum_sdk32.dll.25.dr	String found in binary or memory: https://brightdata.com/faq#lum-peers?
Source: net_updater32.exe.25.dr, lum_sdk32.dll.25.dr	String found in binary or memory: https://brightdata.com/legal/sdk-privacy?
Source: net_updater32.exe.25.dr, lum_sdk32.dll.25.dr	String found in binary or memory: https://brightdata.com/sdk/faq#sdk_app_connect?
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2458405645.000001BAF1639000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2443082516.000001BAEF32F000.00000004.00000020.00020000.00000000.sdmp, AxtraWd.dll.25.dr, nso7B63.tmp.24.dr, DevSupp.dll.25.dr, AxCmd.exe.25.dr, nsfCAF0.tmp.16.dr, AxAHCIServiceEx.exe.25.dr, W10_17763RegHlper.dll.16.dr, nsg1C41.tmp.0.dr, W10_17763RegHlper.dll.24.dr, W10_17763RegHlper.dll.0.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2458405645.000001BAF1639000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2443082516.000001BAEF32F000.00000004.00000020.00020000.00000000.sdmp, AxtraWd.dll.25.dr, nso7B63.tmp.24.dr, DevSupp.dll.25.dr, AxCmd.exe.25.dr, nsfCAF0.tmp.16.dr, AxAHCIServiceEx.exe.25.dr, W10_17763RegHlper.dll.16.dr, nsg1C41.tmp.0.dr, W10_17763RegHlper.dll.24.dr, W10_17763RegHlper.dll.0.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: svchost.exe, 00000008.00000003.1459902320.000001698E646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1461892365.000001698E649000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000008.00000003.1459960151.000001698E645000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1462146805.000001698E673000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1461706501.000001698E62B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1459576112.000001698E669000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1459220051.000001698E671000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000008.00000003.1460133276.000001698E65C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000008.00000003.1460033766.000001698E648000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1459902320.000001698E646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000008.00000003.1459636917.000001698E663000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000008.00000003.1460133276.000001698E65C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000008.00000003.1459576112.000001698E669000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1459220051.000001698E671000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000008.00000002.1462146805.000001698E673000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1459576112.000001698E669000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1459220051.000001698E671000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000008.00000003.1460033766.000001698E648000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1459902320.000001698E646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000008.00000002.1461706501.000001698E62B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000008.00000003.1460133276.000001698E65C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000008.00000003.1460033766.000001698E648000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1459902320.000001698E646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000008.00000003.1459636917.000001698E663000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1461706501.000001698E62B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000008.00000003.1460033766.000001698E648000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1459902320.000001698E646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000008.00000003.1460033766.000001698E648000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1459902320.000001698E646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000008.00000003.1460033766.000001698E648000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1459902320.000001698E646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000008.00000002.1461706501.000001698E62B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000008.00000003.1460289271.000001698E641000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1461867097.000001698E642000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000008.00000003.1459576112.000001698E669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Stops/
Source: svchost.exe, 00000008.00000003.1460033766.000001698E648000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1459902320.000001698E646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000008.00000003.1459636917.000001698E663000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1459902320.000001698E646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1461996142.000001698E664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000008.00000003.1459326475.000001698E64F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000008.00000003.1459220051.000001698E671000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000008.00000003.1459636917.000001698E663000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1461996142.000001698E664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000008.00000003.1459960151.000001698E645000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1459750239.000001698E660000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
Source: svchost.exe, 00000008.00000003.1459220051.000001698E671000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000008.00000003.1460033766.000001698E648000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1459902320.000001698E646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000008.00000003.1357822076.000001698E636000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000008.00000003.1459636917.000001698E663000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1461706501.000001698E62B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1459576112.000001698E669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000008.00000003.1459576112.000001698E669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/roadshield.ashx?bucket=
Source: svchost.exe, 00000003.00000003.1209247666.000002AA1CA92000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProduction?OneDriveUpdate=8832247681fc94bb89bb92977c3-C
Source: svchost.exe, 00000003.00000003.1209247666.000002AA1CA92000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProduction?OneDriveUpdate=a8436e7320e39c903a35da9b911
Source: svchost.exe, 00000003.00000003.1209053117.000002AA1CA7B000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProduction?OneDriveUpdate=f48c47f7803b912ab9b4c1a01f72
Source: qmgr.db.3.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod
Source: svchost.exe, 00000003.00000003.1209247666.000002AA1CA92000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1208953641.000002AA1CA73000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1208730670.000002AA1CA37000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000003.00000003.1209247666.000002AA1CA92000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod?OneDriveUpdate=60c3c2b058b5ae1621bf716ac53a-C:
Source: net_updater32.exe.25.dr, lum_sdk32.dll.25.dr	String found in binary or memory: https://github.com/dotnet/corefx/tree/30ab651fcb4354552bd4891619a0bdd81e0ebdbf
Source: net_updater32.exe.25.dr, lum_sdk32.dll.25.dr	String found in binary or memory: https://github.com/dotnet/corefx/tree/30ab651fcb4354552bd4891619a0bdd81e0ebdbf8
Source: svchost.exe, 00000004.00000002.2441101764.00000186F7641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://global.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000003.00000003.1209053117.000002AA1CA7B000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.073.0411.0002/OneDriveSetup.exe
Source: svchost.exe, 00000003.00000003.1208730670.000002AA1CA37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.073.0411.0002/OneDriveSetup.exe-C:
Source: svchost.exe, 00000003.00000003.1209247666.000002AA1CA92000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.083.0425.0003/OneDriveSetup.exe
Source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, net_updater32.exe.25.dr, AXLumSDKHlper.exe.25.dr, lum_sdk32.dll.25.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: Alcohol120_trial_2.1.1.1019.exe, AXLumSDKHlper.exe.25.dr	String found in binary or memory: https://sectigo.com/CPS0D
Source: 7zG.exe, 00000019.00000002.2439672212.000001BAED4B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: svchost.exe, 00000008.00000003.1460289271.000001698E641000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000008.00000002.1461842039.000001698E63F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000008.00000003.1460194805.000001698E644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1459902320.000001698E646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000008.00000003.1357822076.000001698E636000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000008.00000002.1461706501.000001698E62B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000008.00000003.1460033766.000001698E648000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1459902320.000001698E646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000008.00000003.1460194805.000001698E644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1459902320.000001698E646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
Source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, net_updater32.exe.25.dr, lum_sdk32.dll.25.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: nsg1C41.tmp.0.dr, SPTDIntf.dll.25.dr, Alcoholx.dll.25.dr, SPTD2inst.exe.0.dr, imgengine.dll.25.dr, SPTDIntf.dll0.25.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2458405645.000001BAF1639000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2444387632.000001BAEF3B9000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2443082516.000001BAEF32F000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2442500190.000001BAEEDFC000.00000004.00000020.00020000.00000000.sdmp, SPTDinst.exe.25.dr, nso7B63.tmp.24.dr, nsfCAF0.tmp.16.dr, SPTDIntf.dll.0.dr, nsg1C41.tmp.0.dr, SPTDIntf.dll.25.dr, Alcoholx.dll.25.dr, imgengine.dll.25.dr, SPTDIntf.dll0.25.dr	String found in binary or memory: https://www.globalsign.com/repository/03
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp, Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1531570592.0000000000409000.00000004.00000001.01000000.00000003.sdmp, SPTD2inst.exe, 00000006.00000000.1343326394.00007FF7E4556000.00000002.00000001.01000000.0000000F.sdmp, SPTD2inst.exe, 00000006.00000003.1348098962.00000292B902A000.00000004.00000020.00020000.00000000.sdmp, 7zG.exe, 00000019.00000002.2442500190.000001BAEEDFC000.00000004.00000020.00020000.00000000.sdmp, SPTDinst.exe.25.dr, nso7B63.tmp.24.dr, sptd2.sys.6.dr, nsfCAF0.tmp.16.dr, SPTD2inst.exe.25.dr, SPTDIntf.dll.0.dr, nsg1C41.tmp.0.dr, SPTDIntf.dll.25.dr, SPTD2inst.exe.0.dr, SPTDIntf.dll0.25.dr	String found in binary or memory: https://www.globalsign.com/repository/06
Source: 7zG.exe, 00000019.00000002.2439672212.000001BAED4B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: 7zG.exe, 00000019.00000002.2439672212.000001BAED4B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/88.0.1/releasenotes
Source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, net_updater32.exe.25.dr	String found in binary or memory: https://www.newtonsoft.com/json
Source: net_updater32.exe.25.dr	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: 7zG.exe, 00000019.00000002.2447681599.000001BAF11A3000.00000004.00000020.00020000.00000000.sdmp, net_updater32.exe.25.dr	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson

Source: unknown

DNS traffic detected: queries for: support.alcohol-soft.com

Source: global traffic	HTTP traffic detected: GET /display_trial_fe_adpage_in_intaller.php HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: support.alcohol-soft.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /install_special_page.php?ref=A120T HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: support.alcohol-soft.comConnection: Keep-AliveCache-Control: no-cache

System Summary

Malicious sample detected (through community Yara rule)

Source: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\lumsdk\net_updater32.exe, type: DROPPED

Matched rule: misc_pos Author: @patrickrolsen

PE file has a writeable .text section

Source: SetupHlp.dll.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SetupHlp.dll.16.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SetupHlp.dll.24.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SetupHlp.dll.25.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Alcoholx.dll.25.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Uses 32bit PE files

Source: Alcohol120_trial_2.1.1.1019.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Creates files inside the driver directory

Source: C:\Users\user\AppData\Local\Temp\SPTD2inst.exe

File created: C:\Windows\System32\Drivers\sptd2.sys

Jump to behavior

Yara signature match

Source: C:\Users\user\Desktop\Alcohol120_trial_2.1.1.1019\lumsdk\net_updater32.exe, type: DROPPED

Matched rule: misc_pos author = @patrickrolsen, reference = POS Malware

Creates files inside the system directory

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

PE file contains executable resources (Code or Archives)

Source: SPTD2inst.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (native) x86-64, for MS Windows
Source: SPTD2inst.exe.25.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (native) Intel 80386, for MS Windows
Source: lum_sdk32.dll.25.dr	Static PE information: Resource name: BINARY type: PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: lum_sdk32.dll.25.dr	Static PE information: Resource name: BINARY type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: lum_sdk32.dll.25.dr	Static PE information: Resource name: BINARY type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: net_updater32.exe.25.dr	Static PE information: Resource name: BINARY type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: Alcohol.exe.25.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM)
Source: Alcohol.exe.25.dr	Static PE information: Resource name: RT_STRING type: COM executable for DOS
Source: AxSwindHlp.dll.25.dr	Static PE information: Resource name: RT_STRING type: COM executable for DOS
Source: Alcoholx.dll.25.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (native) Intel 80386, for MS Windows
Source: Alcoholx.dll.25.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (native) x86-64, for MS Windows
Source: AxtraWd.dll.25.dr	Static PE information: Resource name: RT_BITMAP type: COM executable for DOS

Sample file is different than original file name gathered from version info

Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesptd.sysR vs Alcohol120_trial_2.1.1.1019.exe
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesptdinst.exeR vs Alcohol120_trial_2.1.1.1019.exe
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesptd2inst.exeR vs Alcohol120_trial_2.1.1.1019.exe
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesptd2.sysR vs Alcohol120_trial_2.1.1.1019.exe
Source: Alcohol120_trial_2.1.1.1019.exe, 00000000.00000002.1533593477.000000000270E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesptdintf.dllR vs Alcohol120_trial_2.1.1.1019.exe

PE file contains strange resources

Source: Alcohol120_trial_2.1.1.1019.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Alcohol120_trial_2.1.1.1019.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SPTD2inst.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SPTDinst.exe.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SPTD2inst.exe.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: lum_sdk32.dll.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Alcohol.exe.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Alcohol.exe.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AxShlRes.dll.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AxShlRes.dll.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AxShlRes.dll.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AxShlRes.dll.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AxShlRes.dll.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AxShlRes.dll.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AxShlRes.dll.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AxShlRes.dll.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AxShlRes.dll.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AxShlRes.dll.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AxShlRes.dll.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AxShlRes.dll.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AxShlRes.dll.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AxShlRes.dll.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AxShlRes.dll.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AxShlRes.dll.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AxShlRes.dll.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AxShlRes.dll.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AxShlRes.dll.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AxShlRes.dll.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AxShlRes.dll.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AxShlRes.dll.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AxShlRes.dll.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AxShlRes.dll.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AxShlRes.dll.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: AxShlRes.dll.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Tries to load missing DLLs

Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wmi.dll			Jump to behavior

Creates driver files

Source: C:\Users\user\AppData\Local\Temp\SPTD2inst.exe

File created: C:\Windows\System32\Drivers\sptd2.sys

Jump to behavior

Source: AxShlExHlper.exe.25.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9943769904458599
Source: Alcohol.exe.25.dr	Static PE information: Section: SSE2 ZLIB complexity 0.9993558636476633
Source: DPM.dll.25.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9892711900684932
Source: DPMChart.dll.25.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9966781695272021
Source: AxSwindHlp.dll.25.dr	Static PE information: Section: UPX1 ZLIB complexity 0.994308909921671
Source: AxXMLPoster.exe.25.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9956221064814815
Source: AxtraWd.dll.25.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9977099910164271

Source: Alcohol120_trial_2.1.1.1019.exe	ReversingLabs: Detection: 61%
Source: Alcohol120_trial_2.1.1.1019.exe	Virustotal: Detection: 57%