24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 64:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4d2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 00e6af4b4e3d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 00e6af4b4e3d…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 17/27 AV engines flagged this file. 15 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c"],"about":{"@type":"SoftwareApplication","name":"7z2600-x32.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":17,"total":27},"behavioralIndicators":{"malicious":15,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T956,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt32" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "GetBuffer" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "Dispose" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "WriteTo" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "get_Capacity" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin"26:Te1f,Found reference to "PbeSha1_RC2_40" (Indicator: "RC2"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found reference to "RC2_CBC_40" (Indicator: "RC2"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found reference to "SRTP_NULL_HMAC_SHA1_80" (Indicator: "HMAC"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found reference to "SRTP_AES128_CM_HMAC_SHA1_80" (Indicator: "HMAC"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found reference to "HMAC_SHA1" (Indicator: "HMAC"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found reference to "EncryptionECDsaWithSha1" (Indicator: "ECDsa"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found reference to "TRAILER_SHA512" (Indicator: "SHA512"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found reference to "ecka_eg_X963kdf_SHA512" (Indicator: "SHA512"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found reference to "sphincs256_with_SHA512" (Indicator: "SHA512"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found reference to "xmss_with_SHA512" (Indicator: "SHA512"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found reference to "xmss_mt_with_SHA512" (Indicator: "SHA512"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found reference to "ecdsa_plain_SHA512" (Indicator: "SHA512"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found reference to "EncryptionECDsaWithSha512" (Indicator: "ECDsa"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found reference to "SRTP_NULL_HMAC_SHA1_32" (Indicator: "HMAC"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found reference to "SRTP_AES128_CM_HMAC_SHA1_32" (Indicator: "HMAC"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found reference to "Aes192" (Indicator: "Aes"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found reference to "ECDsaWithSha2" (Indicator: "ECDsa"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found reference to "TRAILER_SHA512_224" (Indicator: "SHA512"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found reference to "EncryptionECDsaWithSha224" (Indicator: "ECDsa"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found reference to "RC2_64" (Indicator: "RC2"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found reference to "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found reference to "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found reference to "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found reference to "TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found reference to "TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin")27:T9c7,"" in Source: 00000000-00006908.00000000.267001.03310000.00000004.mdmp 00000000-00006908.00000001.267012.03310000.00000004.mdmp39:T4d4,Process 7mcn.cyou.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process 7mcn.cyou.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:844:120:WilError_01" Process 7mcn.cyou.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process 7mcn.cyou.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process 7mcn.cyou.exe created mutex with name "Local\SM0:844:120:WilError_01" Process 7mcn.cyou.exe created mutex with name "Local\ZonesCacheCounterMutex" Process 7mcn.cyou.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process 7mcn.cyou.exe created mutex with name "Local\SM0:844:304:WilStaging_02" Process 7mcn.cyou.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:844:304:WilStaging_02" Process 7mcn.cyou.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7840:120:WilError_01" Process 7mcn.cyou.exe created mutex with name "Local\SM0:7840:120:WilError_01" Process 7mcn.cyou.exe created mutex with name "Local\SM0:7840:304:WilStaging_02" Process 7mcn.cyou.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7840:304:WilStaging_02"3a:Ta48,Observed unmanaged function "GetForegroundWindow" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed unmanaged function "GetWindowThreadProcessId" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed unmanaged function "SetWindowsHookEx" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed unmanaged function "CallNextHookEx" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed unmanaged function "GetModuleHandle" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed unmanaged function "GetKeyState" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed unmanaged function "GetKeyboardState" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed unmanaged function "GetKeyboardLayout" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed unmanaged function "ToUnicodeEx" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed unmanaged function "MapVirtualKey" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed unmanaged function "SendARP" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed unmanaged function "LoadLibrary" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed unmanaged function "FreeLibrary" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed unmanaged function "GetProcAddress" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed unmanaged function "QueryFullProcessImageName" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed unmanaged function "BitBlt" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed unmanaged function "CreateDC" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed unmanaged function "DeleteDC" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed unmanaged function "GetLastInputInfo" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed unmanaged function "SetCursorPos" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed unmanaged function "GetMessageExtraInfo" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed unmanaged function "SendInput" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin"3b:T4523,"\Software\Microsoft" in Source: 00000000-00000844.00000000.266061.03140000.00000004.mdmp "\Software\Microsoft" in Source: 00000000-00000844.00000001.266258.03162000.00000004.mdmp "\Registry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00000844.00000001.266258.03162000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00000844.00000001.266258.03162000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00000844.00000001.266258.03162000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}" in Source: 00000000-00000844.00000001.266258.03162000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}" in Source: 00000000-00000844.00000001.266258.03162000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}@" in Source: 00000000-00000844.00000001.266258.03162000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}" in Source: 00000000-00000844.00000001.266258.03162000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00000844.00000001.266258.03162000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00000844.00000001.266258.03162000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\ShellFolder" in Source: 00000000-00000844.00000001.266258.1DD30000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\Instance" in Source: 00000000-00000844.00000001.266258.1DD30000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\Instance" in Source: 00000000-00000844.00000001.266258.1DD30000.00000004.mdmp "Registry\Machine\Software\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}" in Source: 00000000-00000844.00000001.266258.1DD30000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001\fdeploy" in Source: 00000000-00000844.00000001.266258.1DD30000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00000844.00000001.266258.1DD30000.00000004.mdmp "y\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00000844.00000001.266258.1DD30000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00000844.00000001.266258.1DD30000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00000844.00000001.266258.1DD30000.00000004.mdmp "e\Software\C" in Source: 00000000-00000844.00000001.266258.1DD30000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001368.00000001.270025.1DD82000.00000004.mdmp "Registry\Machine\Software\Classes\DelegateFolders" in Source: 00000000-00001368.00000001.270025.1DD82000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}" in Source: 00000000-00001368.00000001.270025.1DD82000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001\fdeploy" in Source: 00000000-00001368.00000001.270025.1DF20000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001368.00000001.270025.1DF20000.00000004.mdmp "istry\Machine\Software\Classes\WOW6S" in Source: 00000000-00001368.00000001.270025.1DF20000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001368.00000001.270025.1DF20000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00001368.00000001.270025.1DF20000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001368.00000001.270025.1DF20000.00000004.mdmp "Registry\Machine\Software\Classes\.bat\OpenWithProgids" in Source: 00000000-00001368.00000001.270025.1DF20000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00001368.00000001.270025.1DF20000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\Instance" in Source: 00000000-00001368.00000001.270025.1DF20000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}" in Source: 00000000-00001368.00000001.270025.1DF20000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00001368.00000001.270025.1DF20000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}" in Source: 00000000-00001368.00000001.270025.1DF20000.00000004.mdmp "Commo\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00001368.00000001.270025.1DF20000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;%NVM_HOME%;%NVM_SYMLINK%;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\Scripts\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mit\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}WSH;.MSC" in Source: 00000000-00001368.00000001.270025.1DF20000.00000004.mdmp "y\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00001368.00000001.270025.1DF20000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.80.1!7" in Source: 00000000-00001568.00000000.268085.03220000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00001568.00000000.268085.03220000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.76.6.1!7" in Source: 00000000-00001568.00000000.268085.03220000.00000004.mdmp "ACHINE\Software\WOW64" in Source: 00000000-00003624.00000000.268090.03890000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A07" in Source: 00000000-00003624.00000000.268090.03890000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7" in Source: 00000000-00003624.00000000.268090.1E1B2000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.80.1!7" in Source: 00000000-00004712.00000000.267002.036A0000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.67.1.1!7" in Source: 00000000-00004712.00000000.267002.036A0000.00000004.mdmp "Y\MACHINE\Software\ME" in Source: 00000000-00004712.00000000.267002.036A0000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.80.1!7" in Source: 00000000-00004712.00000001.267012.036A0000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.67.1.1!7" in Source: 00000000-00004712.00000001.267012.036A0000.00000004.mdmp "Y\MACHINE\Software\ME" in Source: 00000000-00004712.00000001.267012.036A0000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.80.1!7" in Source: 00000000-00004852.00000000.267003.029E0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00004852.00000000.267003.029E0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C296D07-90AE-4FAC-86F" in Source: 00000000-00004852.00000000.267003.029E0000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.76.6.1!7" in Source: 00000000-00005084.00000000.268087.033D0000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.80.1!7" in Source: 00000000-00005084.00000000.268087.033D0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00005084.00000000.268087.033D0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00005896.00000000.265911.037B0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A07Z" in Source: 00000000-00006448.00000000.268017.034F0000.00000004.mdmp "y\Machine\Software\Classh" in Source: 00000000-00006448.00000000.268017.034F0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A07Z" in Source: 00000000-00006448.00000001.268275.034F0000.00000004.mdmp "Registry\Machine\Software\Classes\SystemFileAssociations\.bat" in Source: 00000000-00006448.00000001.268275.034F0000.00000004.mdmp "y\Machine\Software\Classh" in Source: 00000000-00006448.00000001.268275.034F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00006448.00000001.268275.1DD52000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}" in Source: 00000000-00006448.00000001.268275.1DD52000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}" in Source: 00000000-00006448.00000001.268275.1DD52000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006448.00000001.268275.1DE10000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006448.00000001.268275.1DE10000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006448.00000001.268275.1DE10000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\Instance" in Source: 00000000-00006448.00000001.268275.1DE10000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000" in Source: 00000000-00006448.00000001.268275.1DE10000.00000004.mdmp "1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006448.00000001.268275.1DE10000.00000004.mdmp "ne\Software\Classes\WOW6432Node\CLSID\{7" in Source: 00000000-00006448.00000001.268275.1DE10000.00000004.mdmp "PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 79 St\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6" in Source: 00000000-00006448.00000001.268275.1DE10000.00000004.mdmp "ER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006448.00000001.268275.1E010000.00000004.mdmp "y\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00006448.00000001.268275.1E010000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00006448.00000001.268275.1E010000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006448.00000001.268275.1E010000.00000004.mdmp "Registry\Machine\Software\Classes\.bat\OpenWithProgids" in Source: 00000000-00006448.00000001.268275.1E010000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001\fdeploy" in Source: 00000000-00006448.00000001.268275.1E010000.00000004.mdmp "TRY\MACHINE\Software\WOW64" in Source: 00000000-00006908.00000000.267001.03310000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A07nition="MachineToApplication" />" in Source: 00000000-00006908.00000000.267001.03310000.00000004.mdmp "TRY\MACHINE\Software\WOW64" in Source: 00000000-00006908.00000001.267012.03310000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A07nition="MachineToApplication" />" in Source: 00000000-00006908.00000001.267012.03310000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00007732.00000000.268906.030D0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C296D07-90AE-4FAC-86F" in Source: 00000000-00007732.00000000.268906.030D0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00007732.00000000.268906.1D9C2000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A07" in Source: 00000000-00007840.00000000.266997.03610000.00000004.mdmp "y\Machine\Software\Classes\AppID(" in Source: 00000000-00007840.00000000.266997.03610000.00000004.mdmp "y\Machine\Software\Classes\AppID(" in Source: 00000000-00007840.00000001.267323.036F0000.00000004.mdmp "Registry\Machine\Software\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}" in Source: 00000000-00007840.00000001.267323.1DEB2000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007840.00000001.267323.1DF45000.00000004.mdmp "\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007840.00000001.267323.1DF45000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-0000000000" in Source: 00000000-00007840.00000001.267323.1DF70000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007840.00000001.267323.1DF70000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007840.00000001.267323.1DF70000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00007840.00000001.267323.1DF70000.00000004.mdmp "Registry\Machine\Software\Classes\.bat\OpenWithProgids" in Source: 00000000-00007840.00000001.267323.1DF70000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00007840.00000001.267323.1DF70000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007840.00000001.267323.1DF70000.00000004.mdmp "Registry\Machine\Software\Classes\SystemFileAssociations\.bat" in Source: 00000000-00007840.00000001.267323.1E170000.00000004.mdmp "Registry\Machine\Software\Classes\DelegateFolders" in Source: 00000000-00007840.00000001.267323.1E170000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\ShellFolder" in Source: 00000000-00007840.00000001.267323.1E170000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\Instance" in Source: 00000000-00007840.00000001.267323.1E170000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\ShellFolder" in Source: 00000000-00007840.00000001.267323.1E170000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00007840.00000001.267323.1E170000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00007840.00000001.267323.1E170000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001\fdeploy" in Source: 00000000-00007840.00000001.267323.1E170000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{1" in Source: 00000000-00007840.00000001.267323.1E170000.00000004.mdmp3c:T25b1," nulstart "" "" (Indicator: "ping -"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin"), Found string "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\Vyi511DIuZ88.bat"" (Indicator: "ping -"; File: "Vyi511DIuZ88.bat"), Found string "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\q1GS2yqNp1eW.bat"" (Indicator: "ping -"; File: "q1GS2yqNp1eW.bat"), Found string "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\nytrrMuIrcv1.bat"" (Indicator: "ping -"; File: "nytrrMuIrcv1.bat"), Found string "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\YcK5cPJj4hLA.bat"" (Indicator: "ping -"; File: "YcK5cPJj4hLA.bat"), Found string "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\0tWLGPY471pr.bat"" (Indicator: "ping -"; File: "0tWLGPY471pr.bat"), Found string "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\nqoNKiyiHw1A.bat"" (Indicator: "ping -"; File: "nqoNKiyiHw1A.bat"), Found string "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\fgStmV089eKk.bat"" (Indicator: "ping -"; File: "fgStmV089eKk.bat"), Found string "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\XVdRd9KBJecD.bat"" (Indicator: "ping -"; File: "XVdRd9KBJecD.bat"), Found string "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\bjQ3fc4VedHL.bat"" (Indicator: "ping -"; File: "bjQ3fc4VedHL.bat"), Found string "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\HT0rHcr3buEO.bat"" (Indicator: "ping -"; File: "HT0rHcr3buEO.bat"), Found string "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\0sKldXZl7oiC.bat"" (Indicator: "ping -"; File: "0sKldXZl7oiC.bat"), Found string "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\5QWtXlRt0Cbf.bat"" (Indicator: "ping -"; File: "5QWtXlRt0Cbf.bat"), Found string "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\vkATxKP5gZXd.bat"" (Indicator: "ping -"; File: "vkATxKP5gZXd.bat"), Found string "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\K1cdlu3g7HII.bat"" (Indicator: "ping -"; File: "K1cdlu3g7HII.bat"), Found string "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\U0UAP7NvGToh.bat"" (Indicator: "ping -"; File: "U0UAP7NvGToh.bat"), Found string "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\gvl0OZyGaxOD.bat"" (Indicator: "ping -"; File: "gvl0OZyGaxOD.bat"), Found string "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\iOh4cAMzbQE6.bat"" (Indicator: "ping -"; File: "iOh4cAMzbQE6.bat"), Found string "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\ljYPgL4Bv4Bz.bat"" (Indicator: "ping -"; File: "ljYPgL4Bv4Bz.bat"), Found string "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\ypp3r7o6X7xn.bat"" (Indicator: "ping -"; File: "ypp3r7o6X7xn.bat"), Found string "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\s6qMagPpNgzQ.bat"" (Indicator: "ping -"; File: "s6qMagPpNgzQ.bat"), Found string "@echo off\r\nchcp 65001\r\necho DONT CLOSE THIS WINDOW!\r\nping -n 10 localhost > nul\r\ndel /a /q /f \"" (Indicator: "ping -"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "@echo off\r\nchcp 65001\r\necho DONT CLOSE THIS WINDOW!\r\nping -n 10 localhost > nul\r\nstart \"\" \"" (Indicator: "ping -"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin")4b:T4e9,Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Connect" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_Connected" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed Namespace "System.Net.Sockets.NetworkStream" and MemberReference ".ctor" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Dispose" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "IOControl" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_OSSupportsIPv6" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed Namespace "System.Net.Sockets.SocketException" and MemberReference "get_SocketErrorCode" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin"4c:T619,Observed Namespace "System.Net.WebClient" and MemberReference ".ctor" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadString" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed Namespace "System.Net.WebClient" and MemberReference "set_Proxy" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed Namespace "System.Net.WebClient" and MemberReference "add_DownloadFileCompleted" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed Namespace "System.Net.WebClient" and MemberReference "get_IsBusy" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed Namespace "System.Net.WebClient" and MemberReference "CancelAsync" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFileAsync" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed Namespace "System.Net.WebClient" and MemberReference "remove_DownloadFileCompleted" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_UserAgent" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_AllowAutoRedirect" in "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin"4d:Ta78,"2.5.4.5" "2.5.4.72" "2.5.29.9" "2.5.29.14" "2.5.29.16" "2.5.29.20" "2.5.29.21" "2.5.29.23" "2.5.29.24" "2.5.29.27" "2.5.29.28" "2.5.29.29" "2.5.29.30" "2.5.29.31" "2.5.29.32" "2.5.29.33" "2.5.29.35" "2.5.29.36" "2.5.29.46" "2.5.29.54" "2.5.29.56" "2.5.29.55" "2.5.29.60" "2.5.4.6" "2.5.4.10" "2.5.4.11" "2.5.4.12" "2.5.4.3" "2.5.4.9" "2.5.4.7" "2.5.4.8" "2.5.4.4" "2.5.4.42" "2.5.4.43" "2.5.4.44" "2.5.4.45" "2.5.4.15" "2.5.4.17" "2.5.4.46" "2.5.4.65" "2.5.4.16" "2.5.4.54" "2.5.4.20" "2.5.4.41" "2.5.4.97" "1.3.36.8" "1.3.1.1" "1.2.2.1" "1.2.2.2" "1.2.2.3" "1.2.2.4" "1.2.2.5" "1.2.2.6" "1.3.36.3" "2.4.8.1" "1.9.0.1" "1.4.1.0" "2.5.29.19" "2.5.29.15" "2.5.29.37" "2.5.29.17" "2.5.29.18" "1.3.132.0" "2.5.1.1" "192.168.0.2" Potential IP "4.0.0.0" found in string "ystem.ServiceModel,4.0.0.0,,b77a5c561934e089" Potential IP "4.0.0.0" found in string "4.0.0.0,3" "104.21.28.196" Potential IP "2.5.29.35" found in string "#2.5.29.35" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.1" "2.5.29.10" Potential IP "4.0.0.0" found in string "n=4.0.0.0, Culture=neutral, PublicKer" Potential IP "4.0.0.0" found in string "n=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50^" Potential IP "4.0.0.0" found in string "4.0.0.0,Z" Potential IP "4.0.0.0" found in string "n=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />", Potential IP "4.0.0.0" found in string "=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089" />" Potential IP "4.0.0.0" found in string "4.0.0.0," Potential IP "11.76.6.1" found in string "11.76.6.1!7" Potential IP "4.0.0.0" found in string "n=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50*" Potential IP "4.0.0.0" found in string "ork=4.0.0.0, CulMb" Potential IP "11.10.3.37" found in string "11.10.3.37!7" Potential IP "4.0.0.0" found in string "4.0.0.0~" Potential IP "4.0.0.0" found in string "on=4.0.0.0, Cult" Potential IP "4.0.0.0" found in string "ion=4.0.0.0," Potential IP "4.0.0.0" found in string "sion=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"", Potential IP "4.0.0.0" found in string "rsion=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a" allowLocation="false" />" Potential IP "4.0.0.0" found in string "=4.0.0.0, Culture=n!" Potential IP "4.0.0.0" found in string "sion=4.0.0.0, Cu" Potential IP "4.0.0.0" found in string "n=4.0.0.0, Culture=neutral, PublicKeyTokx" Potential IP "4.0.0.0" found in string "4.0.0.0,(" Potential IP "11.92.1.1" found in string "11.92.1.1!7" Potential IP "4.0.0.0" found in string "on=4.0.0.0, CultF" Potential IP "4.0.0.0" found in string "4.0.0.0,,A_"4e:T1862,Heuristic match: "org.bouncycastle.asn1.ua" Heuristic match: "org.bouncycastle.math.ec" Heuristic match: "org.bouncycastle.crypto.ec" Heuristic match: "org.bouncycastle.asn1.gm" Heuristic match: "org.bouncycastle.math.ec.custom.gm" Heuristic match: "org.bouncycastle.crypto.io" Heuristic match: "org.bouncycastle.utilities.io" Pattern match: "https://api.ipify.org/" Pattern match: "https://stackoverflow.com/q/2152978/23354" Heuristic match: "mestizo.co.com" Pattern match: "https://ipwho.is/" Pattern match: "https://stackoverflow.com/q/11564914/23354" Pattern match: "https://stackoverflow.com/q/14436606/23354" Heuristic match: "%windir%\system32\chcp.com" Heuristic match: "on.lk" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "el.co" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Heuristic match: ".microsoftstore.co" Heuristic match: ".msn.co.jp" Pattern match: "www.vw6" Pattern match: "t.com/pki/certs/miccertrulispca_2009-04-02.crt0" Heuristic match: "microsoftrootcert.cr" Heuristic match: "ntrust.net" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.digicert.com1" Pattern match: "www.digicert.com1$0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1!0" Pattern match: "http://crl.globalsign" Pattern match: "www.geotrust.com/resources/cps0" Pattern match: "www.globalsign.com/repository/03" Heuristic match: "n, system.co" Heuristic match: "propem.np" Heuristic match: "sl.om" Pattern match: "www.verisign" Pattern match: "https://www.verisign.com/" Pattern match: "oft.com/pki/crl/" Pattern match: "www.mic" Pattern match: "www.dig" Pattern match: "crl.microsoft.com/pki/crl/products/mi" Heuristic match: "ystem.drawing.ni" Pattern match: "microsoft.net/assembly/gac_64/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Heuristic match: "ystem.windows.fo" Pattern match: "microsoft.net/assembly/gac_msil/system/v4.0_4.0.0.0__b77a5c561934e089/system.dll" Heuristic match: ":\windows\system32\rsaenh.de" Heuristic match: "d897c.bi" Heuristic match: "stem.security.in" Pattern match: "hawte.com/cps07" Pattern match: "http://crl.thawt" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to"4f:T860b,Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00000844.00000001.266258.03232000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000844.00000001.266258.03232000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00000844.00000001.266258.03232000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*ltsssponfi0," - Source: "00000000-00000844.00000001.266258.1D9B2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000844.00000001.266258.1D9B2000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00000844.00000001.266258.1DA1E000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00000844.00000001.266258.1DA1E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00000844.00000001.266258.1DA1E000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00000844.00000001.266258.1DA1E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00000844.00000001.266258.1DA1E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000844.00000001.266258.1DA1E000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00000844.00000001.266258.1DA1E000.00000004.mdmp") Found URL "http://www.vw6t.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00000844.00000001.266258.1DB30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00000844.00000001.266258.1DB30000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00000844.00000001.266258.1DB30000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00000844.00000001.266258.1DD30000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00000844.00000001.266258.1DD30000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00000844.00000001.266258.1DD30000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00000844.00000001.266258.1DD30000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?edigicert" - Source: "00000000-00000844.00000001.266258.1DD30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00000844.00000001.266258.1DD30000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%ydigicert" - Source: "00000000-00000844.00000001.266258.1DD30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00000844.00000001.266258.1DD30000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000844.00000001.266258.1DD30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000844.00000001.266258.1DD30000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000844.00000001.266258.1DD30000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000844.00000001.266258.1DD30000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000844.00000001.266258.1DD30000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000844.00000001.266258.1DD30000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000844.00000001.266258.1DD30000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0geotrust" - Source: "00000000-00000844.00000001.266258.1DD30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3cfsfappdatalocaltemp\lp" - Source: "00000000-00000844.00000001.266258.1DD30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9iqmgvw,czc=ym'quj->domeqyxcpx" - Source: "00000000-00001368.00000001.270025.1DF20000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00001368.00000001.270025.1DF20000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00001368.00000001.270025.1DF20000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00001368.00000001.270025.1DF20000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00001368.00000001.270025.1DF20000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00001368.00000001.270025.1DF20000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00001368.00000001.270025.1DF20000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00001368.00000001.270025.1DF20000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%ydigicert" - Source: "00000000-00001368.00000001.270025.1DF20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001368.00000001.270025.1DF20000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001368.00000001.270025.1DF20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00001368.00000001.270025.1DF20000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001368.00000001.270025.1DF20000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001368.00000001.270025.1DF20000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001368.00000001.270025.1DF20000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001368.00000001.270025.1DF20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001368.00000001.270025.1DF20000.00000004.mdmp") Found URL "https://www.verisign.com/," - Source: "00000000-00001368.00000001.270025.1DF20000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001368.00000001.270025.1DF20000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http:xliabilit3jbe3ebc3@bh3^bc3tbh3rb\3mbi" - Source: "00000000-00001368.00000001.270025.1DF20000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00001368.00000001.270025.1DF20000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00001368.00000001.270025.1DF20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00001368.00000001.270025.1DF20000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00001368.00000001.270025.1DF20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00001368.00000001.270025.1DF20000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00001368.00000001.270025.1DF20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mia2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00001368.00000001.270025.1DF20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006448.00000001.268275.1DD52000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lkicfmicrosoft" - Source: "00000000-00006448.00000001.268275.1DD52000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006448.00000001.268275.1DD52000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00006448.00000001.268275.1DD52000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00006448.00000001.268275.1DE10000.00000004.mdmp") Found URL "http://crl.globalsignfwr/hxu@)" - Source: "00000000-00006448.00000001.268275.1DE10000.00000004.mdmp") Found URL "http://crl.thawtcfsfappdatalocaltempxvdrd9" - Source: "00000000-00006448.00000001.268275.1DE10000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006448.00000001.268275.1DE10000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006448.00000001.268275.1DE10000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006448.00000001.268275.1DE10000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006448.00000001.268275.1DE10000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006448.00000001.268275.1DE10000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006448.00000001.268275.1DE10000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006448.00000001.268275.1DE10000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006448.00000001.268275.1E010000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006448.00000001.268275.1E010000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006448.00000001.268275.1E010000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006448.00000001.268275.1E010000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00006448.00000001.268275.1E010000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006448.00000001.268275.1E010000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006448.00000001.268275.1E010000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006448.00000001.268275.1E010000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006448.00000001.268275.1E010000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006448.00000001.268275.1E010000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006448.00000001.268275.1E010000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00006448.00000001.268275.1E010000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?everisign," - Source: "00000000-00006448.00000001.268275.1E010000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%ydigicert" - Source: "00000000-00006448.00000001.268275.1E010000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006448.00000001.268275.1E010000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006448.00000001.268275.1E010000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006448.00000001.268275.1E010000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006448.00000001.268275.1E010000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006448.00000001.268275.1E010000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006448.00000001.268275.1E010000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006448.00000001.268275.1E010000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006448.00000001.268275.1E010000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007840.00000001.267323.1DF70000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007840.00000001.267323.1DF70000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00007840.00000001.267323.1DF70000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00007840.00000001.267323.1DF70000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00007840.00000001.267323.1DF70000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00007840.00000001.267323.1DF70000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007840.00000001.267323.1DF70000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microof" - Source: "00000000-00007840.00000001.267323.1DF70000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007840.00000001.267323.1DF70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007840.00000001.267323.1E170000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00007840.00000001.267323.1E170000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%ydigicert" - Source: "00000000-00007840.00000001.267323.1E170000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007840.00000001.267323.1E170000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007840.00000001.267323.1E170000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007840.00000001.267323.1E170000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007840.00000001.267323.1E170000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007840.00000001.267323.1E170000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007840.00000001.267323.1E170000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007840.00000001.267323.1E170000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszyszvonflstk" (Indicator: "System.Data.SqlClient"; Source: "00000000-00001568.00000000.268085.03220000.00000004.mdmp"), Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00002824.00000000.268910.02F00000.00000004.mdmp"), Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00003624.00000000.268090.03890000.00000004.mdmp"), Found string ";User Instance=true" providerName="System.Data.SqlClient"/>" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005084.00000000.268087.033D0000.00000004.mdmp") Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00006908.00000000.267001.03310000.00000004.mdmp, 00000000-00006908.00000001.267012.03310000.00000004.mdmp")53:T83f,"7mcn.cyou.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.ServiceModel\* (UID: 00000000-00000844) "7mcn.cyou.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00000844) "7mcn.cyou.exe" called "FindNextFileW" with parameter 3b9cf8abf6d42fe62158f8da994ecc20 (UID: 00000000-00000844) "7mcn.cyou.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Runteb92aa12#\* (UID: 00000000-00000844) "7mcn.cyou.exe" called "FindNextFileW" with parameter 59a4984a6afe6b209eaaa379927ab81d (UID: 00000000-00000844) "7mcn.cyou.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Security\* (UID: 00000000-00000844) "7mcn.cyou.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Accessibility\* (UID: 00000000-00000844) "7mcn.cyou.exe" called "FindNextFileW" with parameter af089aca36389b4c976815f39c9d7669 (UID: 00000000-00000844) "7mcn.cyou.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\* (UID: 00000000-00000844) "7mcn.cyou.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Servd1dec626#\* (UID: 00000000-00000844) "7mcn.cyou.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.IdentityModel\* (UID: 00000000-00000844) "7mcn.cyou.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\* (UID: 00000000-00000844) "7mcn.cyou.exe" called "FindNextFileW" with parameter 604272b0faec2e09d53d38e03bc89c6c (UID: 00000000-00000844) "7mcn.cyou.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Ente96d83b35#\* (UID: 00000000-00000844) "7mcn.cyou.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xaml\* (UID: 00000000-00000844) "7mcn.cyou.exe" called "FindNextFileW" with parameter 0212deecd5dfa435c6588fd68900ab8c (UID: 00000000-00000844)54:Tf25,Found string "P~AeS" (Indicator: "aes"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "PQAeS~" (Indicator: "aes"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "mChacha20" (Indicator: "chacha"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "ecdsa_plain_RIPEMD160" (Indicator: "ecdsa"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "SRTP_AES128_CM_HMAC_SHA1_80" (Indicator: "aes"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "SRTP_AES128_CM_HMAC_SHA1_80" (Indicator: "aes128"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "ecdsa_plain_SHA1" (Indicator: "ecdsa"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "id_TA_ECDSA_SHA_1" (Indicator: "ecdsa"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "EncryptionECDsaWithSha1" (Indicator: "ecdsa"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "ecdsa_sha1" (Indicator: "ecdsa"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "ecdsa_plain_SHA512" (Indicator: "ecdsa"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "IdEcdsaWithSha3_512" (Indicator: "ecdsa"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "id_TA_ECDSA_SHA_512" (Indicator: "ecdsa"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "THREEFISH_512" (Indicator: "threefish"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "EncryptionECDsaWithSha512" (Indicator: "ecdsa"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "ecdsa_secp521r1_sha512" (Indicator: "ecdsa"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "ecdsa_brainpoolP512r1tls13_sha512" (Indicator: "ecdsa"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "SRTP_AES128_CM_HMAC_SHA1_32" (Indicator: "aes"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "SRTP_AES128_CM_HMAC_SHA1_32" (Indicator: "aes128"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "ecka_eg_SessionKDF_AES192" (Indicator: "aes"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "ecka_eg_SessionKDF_AES192" (Indicator: "aes192"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "AES_192" (Indicator: "aes"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "Aes192" (Indicator: "aes"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "Aes192" (Indicator: "aes192"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "ECDsaWithSha2" (Indicator: "ecdsa"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "THREEFISH_1024" (Indicator: "threefish"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "ecdsa_plain_SHA224" (Indicator: "ecdsa"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "IdEcdsaWithSha3_224" (Indicator: "ecdsa"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "id_TA_ECDSA_SHA_224" (Indicator: "ecdsa"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin")55:Tc52,Found string "passwordBasedMac" (Indicator: "password"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "extended_master_secret" (Indicator: "secret"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "password" (Indicator: "password"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "extended master secret" (Indicator: "secret"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "master secret" (Indicator: "secret"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "PKCS12 key store MAC invalid - wrong password or corrupted file." (Indicator: "password"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "password supplied for keystore that does not require one" (Indicator: "password"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "No password finder specified, but a password is required" (Indicator: "password"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "Password is null, but a password is required" (Indicator: "password"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "Partner MacTag validation failed. Therefore, the password, MAC, or digest algorithm of each participant does not match." (Indicator: "password"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "verification requires password check" (Indicator: "password"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "can't create secret key object:" (Indicator: "secret"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "exception decrypting secret key" (Indicator: "secret"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "secret key ring doesn't start with secret key tag: tag 0x" (Indicator: "secret"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "Export of key material requires extended_master_secret" (Indicator: "secret"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "no password supplied when one expected" (Indicator: "password"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "cannot export keying material without extended_master_secret" (Indicator: "secret"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "BCrypt password must be <= 72 bytes" (Indicator: "password"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "Missing password." (Indicator: "password"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00001368.00000001.270025.1DD82000.00000004.mdmp")56:T6fd,Found string "SELECT * FROM win32_operatingsystem" (Indicator: " Win32_OperatingSystem"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "Select * from AntivirusProduct" (Indicator: "antivirusproduct"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "SELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "Select * From Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "SELECT * FROM Win32_BIOS" (Indicator: " Win32_BIOS"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "SELECT * FROM Win32_BaseBoard" (Indicator: " Win32_BaseBoard"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "SELECT * FROM Win32_OperatingSystem WHERE Primary='true'" (Indicator: " Win32_OperatingSystem"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "SELECT * FROM AntivirusProduct" (Indicator: "antivirusproduct"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin") Found string "SELECT Caption FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; File: "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin")57:T14c4,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00000844.00000000.266061.03140000.00000004.mdmp, 00000000-00000844.00000001.266258.03162000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000844.00000000.266061.03140000.00000004.mdmp, 00000000-00000844.00000001.266258.03162000.00000004.mdmp") Found string "m32\drivers\SandboxFltr.sys" (Indicator: "\drivers\"; Source: "00000000-00000844.00000000.266061.03970000.00000002.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}7" (Indicator: "\Device\"; Source: "00000000-00000844.00000001.266258.1DB30000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}7" (Indicator: "\DosDevices\"; Source: "00000000-00000844.00000001.266258.1DB30000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\Device\"; Source: "00000000-00000844.00000001.266258.1DB30000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\DosDevices\"; Source: "00000000-00000844.00000001.266258.1DB30000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}{" (Indicator: "\Device\"; Source: "00000000-00000844.00000001.266258.1DB30000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}{" (Indicator: "\DosDevices\"; Source: "00000000-00000844.00000001.266258.1DB30000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00001368.00000001.270025.033C0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\Device\"; Source: "00000000-00001368.00000001.270025.033C0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\DosDevices\"; Source: "00000000-00001368.00000001.270025.033C0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001368.00000001.270025.033C0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00001568.00000000.268085.03220000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001568.00000000.268085.03220000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00002824.00000000.268910.02F00000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002824.00000000.268910.02F00000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00003624.00000000.268090.03890000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003624.00000000.268090.03890000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00004712.00000000.267002.036A0000.00000004.mdmp, 00000000-00004712.00000001.267012.036A0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004712.00000000.267002.036A0000.00000004.mdmp, 00000000-00004712.00000001.267012.036A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00004852.00000000.267003.029E0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004852.00000000.267003.029E0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00005084.00000000.268087.033D0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005084.00000000.268087.033D0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00005896.00000000.265911.037B0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005896.00000000.265911.037B0000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00005896.00000000.265911.0388B000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00006448.00000000.268017.034F0000.00000004.mdmp, 00000000-00006448.00000001.268275.034F0000.00000004.mdmp")58:T1476,Observed string: "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\Vyi511DIuZ88.bat"" (Indicator: ""del ") in Source: Vyi511DIuZ88.bat Observed string: "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\q1GS2yqNp1eW.bat"" (Indicator: ""del ") in Source: q1GS2yqNp1eW.bat Observed string: "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\nytrrMuIrcv1.bat"" (Indicator: ""del ") in Source: nytrrMuIrcv1.bat Observed string: "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\YcK5cPJj4hLA.bat"" (Indicator: ""del ") in Source: YcK5cPJj4hLA.bat Observed string: "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\0tWLGPY471pr.bat"" (Indicator: ""del ") in Source: 0tWLGPY471pr.bat Observed string: "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\nqoNKiyiHw1A.bat"" (Indicator: ""del ") in Source: nqoNKiyiHw1A.bat Observed string: "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\fgStmV089eKk.bat"" (Indicator: ""del ") in Source: fgStmV089eKk.bat Observed string: "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\XVdRd9KBJecD.bat"" (Indicator: ""del ") in Source: XVdRd9KBJecD.bat Observed string: "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\bjQ3fc4VedHL.bat"" (Indicator: ""del ") in Source: bjQ3fc4VedHL.bat Observed string: "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\HT0rHcr3buEO.bat"" (Indicator: ""del ") in Source: HT0rHcr3buEO.bat Observed string: "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\0sKldXZl7oiC.bat"" (Indicator: ""del ") in Source: 0sKldXZl7oiC.bat Observed string: "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\5QWtXlRt0Cbf.bat"" (Indicator: ""del ") in Source: 5QWtXlRt0Cbf.bat Observed string: "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\vkATxKP5gZXd.bat"" (Indicator: ""del ") in Source: vkATxKP5gZXd.bat Observed string: "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\K1cdlu3g7HII.bat"" (Indicator: ""del ") in Source: K1cdlu3g7HII.bat Observed string: "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\U0UAP7NvGToh.bat"" (Indicator: ""del ") in Source: U0UAP7NvGToh.bat Observed string: "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\gvl0OZyGaxOD.bat"" (Indicator: ""del ") in Source: gvl0OZyGaxOD.bat Observed string: "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\iOh4cAMzbQE6.bat"" (Indicator: ""del ") in Source: iOh4cAMzbQE6.bat Observed string: "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\ljYPgL4Bv4Bz.bat"" (Indicator: ""del ") in Source: ljYPgL4Bv4Bz.bat Observed string: "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\ypp3r7o6X7xn.bat"" (Indicator: ""del ") in Source: ypp3r7o6X7xn.bat Observed string: "@echo offchcp 65001echo DONT CLOSE THIS WINDOW!ping -n 10 localhost > nulstart "" "C:\WINDOWS\system32\SubDirs\7mcn.cyou.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\s6qMagPpNgzQ.bat"" (Indicator: ""del ") in Source: s6qMagPpNgzQ.bat59:T672,"7mcn.cyou.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS") "7mcn.cyou.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "2109934B05D0DC010000000000000000000000000200000000") "7mcn.cyou.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "3657A14B05D0DC010000000000000000000000000200000000") "7mcn.cyou.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "C3CD974B05D0DC010000000000000000000000000200000000") "7mcn.cyou.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: ".(~]") "7mcn.cyou.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "908A805D05D0DC010000000000000000000000000200000000") "7mcn.cyou.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "E1EC825D05D0DC010000000000000000000000000200000000")5a:T96a,">) at cbf264674171a3810c737e31e851abe0-6000154-_~_","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"69e47e0b3d80cdacd90e2e10"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network adapter information (Dotnet)","description":"Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin\"","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-137","sources":[{"report_type":"sandbox","report_id":"69e47e0b3d80cdacd90e2e10"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"69e47e0b3d80cdacd90e2e10"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00005084.00000000.268087.033D0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"69e47e0b3d80cdacd90e2e10"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"PlugKeyLogger.Modules.Keylogger.Keylogger::GetKeyboardLayout(System.UInt32) at cbf264674171a3810c737e31e851abe0-600001b-Keylogger~KeyboardLayout\n Gma.System.MouseKeyHook.WinApi.KeyboardNativeMethods::GetKeyboardLayout(System.Int32) at cbf264674171a3810c737e31e851abe0-60008f8-KeyboardNativeMethods~GetActiveKeyboard","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"69e47e0b3d80cdacd90e2e10"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"15083630630,5944,3024,,RtlGetVersion,NTDLL.dll,\"01:09:20.000\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00000844.00000001.266258.1DD30000.00000004.mdmp\")\n Found reference to API \"13464758105,6112,3024,,RtlGetVersion,NTDLL.dll,\"01:10:19.031\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00001368.00000001.270025.1DF20000.00000004.mdmp\")\n Found reference to API \"13524477784,3968,3024,,RtlGetVersion,NTDLL.dll,\"01:10:19.046\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00001368.00000001.270025.1DF20000.00000004.mdmp\")\n Found reference to API \"tlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00004712.00000000.267002.036A0000.00000004.mdmp\")\n Found reference to API \"tlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00004852.00000000.267003.029E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69e47e0b3d80cdacd90e2e10"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"HARDWARE\\Description\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c.bin","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"69e47e0b3d80cdacd90e2e10"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$32","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"69e47e0b3d80cdacd90e2e10"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"