26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 73:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4b3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 01c3b22efb07… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 01c3b22efb07…. Malware family: Trojan.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 5 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231"],"about":{"@type":"SoftwareApplication","name":"SecuriteInfo.com.Trojan.DownLoader48.41005.29979.907.exe","applicationCategory":["peexe","executable"],"identifier":"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":19,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1072,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "NamedPipeListener WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "[Msg]WaitForMultipleObjects failed" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp")28:T7fb,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "DsRoleFreeMemory" (Indicator: "FreeMemory"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "DsRoleFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp")29:T949,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp")2a:T736,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005104.00000000.301945.00401000.00000020.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005104.00000000.301945.00401000.00000020.mdmp")2b:Tf58,Found reference to "CryptCNGInitHMAC" (Indicator: "HMAC"; Source: "00000000-00004780.00000000.303075.00300000.00000004.mdmp, 00000000-00004780.00000001.304995.00300000.00000004.mdmp, 00000000-00004780.00000002.306919.00300000.00000004.mdmp, 00000000-00004780.00000003.313232.00300000.00000004.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp, 00000000-00004780.00000001.304995.00B40000.00000004.mdmp, 00000000-00004780.00000002.306919.00B40000.00000004.mdmp, 00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found reference to "HMAC_DRBG - The entropy source failed" (Indicator: "HMAC"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to "HMAC_DRBG - Read/write error in file" (Indicator: "HMAC"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to "HMAC_DRBG - Input too large (Entropy + additional)" (Indicator: "HMAC"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to "HMAC_DRBG - Too many random requested in single call" (Indicator: "HMAC"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to "pbeWithSHAAnd2-KeyTripleDES-CBC" (Indicator: "TripleDES"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to "pbeWithSHAAnd3-KeyTripleDES-CBC" (Indicator: "TripleDES"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to "ECDSA with SHA512" (Indicator: "SHA512"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to "ecdsa-with-SHA512" (Indicator: "SHA512"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to "ECDSA with SHA384" (Indicator: "SHA384"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to "ecdsa-with-SHA384" (Indicator: "SHA384"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to "TLS-ECDH-ECDSA-WITH-AES-256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to "TLS-ECDH-ECDSA-WITH-AES-256-CBC-SHA384" (Indicator: "SHA384"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to "TLS-ECDH-RSA-WITH-AES-256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to "TLS-ECDH-RSA-WITH-AES-256-CBC-SHA384" (Indicator: "SHA384"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to "TLS-RSA-WITH-AES-256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to "TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to "TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA384" (Indicator: "SHA384"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to "TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384" (Indicator: "SHA384"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to "TLS-ECDHE-ECDSA-WITH-AES-256-CBC-SHA384" (Indicator: "SHA384"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to "Server used HashAlgorithm %d" (Indicator: "HashAlgorithm"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to "server used HashAlgorithm that was not offered" (Indicator: "HashAlgorithm"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp")2c:Tbda,Assembly shows XOR instruction xor byte ptr [eax+00h] al in Stream UID: 16713-971-0042A6F8 Assembly shows XOR instruction xor ch byte ptr [esi] in Stream UID: 16713-971-0042A6F8 Assembly shows XOR instruction xor al 13h in Stream UID: 16713-2015-00406344 Assembly shows XOR instruction xor dl byte ptr [ecx] in Stream UID: 16713-2045-00406434 Assembly shows XOR instruction xor eax edx in Stream UID: 16713-2067-00425028 Assembly shows XOR instruction xor al 01h in Stream UID: 16713-2216-0042CBDC Assembly shows XOR instruction xor al 01h in Stream UID: 16713-2219-0042CC38 Assembly shows XOR instruction xor bl byte ptr [edi+eax] in Stream UID: 16713-2450-004065E4 Assembly shows XOR instruction xor al 0Dh in Stream UID: 16713-2627-004061BC Assembly shows XOR instruction xor dword ptr [esi] edi in Stream UID: 16713-3251-0046AB08 Assembly shows XOR instruction xor eax C37BCAAEh in Stream UID: 16713-3264-00402E2F Assembly shows XOR instruction xor al 12h in Stream UID: 16713-3557-004063B4 Assembly shows XOR instruction xor byte ptr [eax+00h] al in Stream UID: 00000000-00005104-19463-142-004483D4 Assembly shows XOR instruction xor byte ptr [eax+00h] al in Stream UID: 00000000-00005104-19463-464-0042A6F8 Assembly shows XOR instruction xor ch byte ptr [esi] in Stream UID: 00000000-00005104-19463-464-0042A6F8 Assembly shows XOR instruction xor byte ptr [eax+00h] al in Stream UID: 00000000-00005104-19463-532-0041EAE0 Assembly shows XOR instruction xor al byte ptr [edx] in Stream UID: 00000000-00005104-19463-532-0041EAE0 Assembly shows XOR instruction xor eax dword ptr [eax+00h] in Stream UID: 00000000-00005104-19463-750-00407A68 Assembly shows XOR instruction xor byte ptr [eax+00h] al in Stream UID: 00000000-00005104-19463-750-00407A68 Assembly shows XOR instruction xor al byte ptr [ebp-01h] in Stream UID: 00000000-00005104-19463-758-0040CBCC Assembly shows XOR instruction xor byte ptr [eax+00h] al in Stream UID: 00000000-00005104-19463-761-004079B4 Assembly shows XOR instruction xor al 04h in Stream UID: 00000000-00005104-19463-761-004079B4 Assembly shows XOR instruction xor eax dword ptr [eax+00h] in Stream UID: 00000000-00005104-19463-761-004079B4 Assembly shows XOR instruction xor byte ptr [eax+00h] al in Stream UID: 00000000-00005104-19463-802-004011C4 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00005104-19463-1380-004218D8 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00005104-19463-1426-00423B58 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00005104-19463-1444-00425028 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00005104-19463-1578-0042CBDC Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00005104-19463-1580-0042CC38 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00005104-19463-1592-0043000C Assembly shows XOR instruction xor al byte ptr [edx+000000B4h] in Stream UID: 00000000-00005104-19463-1629-0042FC4C2d:T613,Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContext"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "CertCloseStore" (Indicator: "CertCloseStore"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "CryptHashData" (Indicator: "CryptHashData"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "CryptDeriveKey" (Indicator: "CryptDeriveKey"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe")2e:Tfcb,Found string "ncrypted Private Key" (Indicator: "private key"; Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp, 00000000-00004780.00000001.304995.00B40000.00000004.mdmp, 00000000-00004780.00000002.306919.00B40000.00000004.mdmp, 00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found string "Private key is not an RSA key" (Indicator: "private key"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "Private key is not an ECDSA key" (Indicator: "private key"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "Certificate public key is not an RSA key" (Indicator: "public key"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "Certificate public key is not an ECDSA key" (Indicator: "public key"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "File containing the RSA private key." (Indicator: "private key"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "Total number of bits to use when generating public and private keys" (Indicator: "private key"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "Invalid private key" (Indicator: "private key"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "Invalid public key" (Indicator: "public key"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "Generating RSA private key" (Indicator: "private key"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "SSL - Public key type mismatch (eg, asked for RSA key exchange and presented EC key)" (Indicator: "public key"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "SSL - The own private key or pre-shared key is not set, but needed" (Indicator: "private key"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "RSA - The private key operation failed" (Indicator: "private key"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "RSA - The public key operation failed" (Indicator: "public key"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "PKCS5 - Given private key password does not allow for correct decryption" (Indicator: "private key"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "PKCS12 - Given private key password does not allow for correct decryption" (Indicator: "private key"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "PK - Given private key password does not allow for correct decryption" (Indicator: "private key"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "PK - Private key password can't be empty" (Indicator: "private key"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "PEM - Given private key password does not allow for correct decryption" (Indicator: "private key"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "PEM - Private key password can't be empty" (Indicator: "private key"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "ECP - Invalid private or public key" (Indicator: "public key"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "-----BEGIN ENCRYPTED PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "-----END ENCRYPTED PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "-----BEGIN PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "-----END PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp")2f:Te9c,Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/9UVbN0w5E6Y" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCF9JCsde%2FXjQrTM033%2FMEh HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.pki.goog" Contains base64 string in header "User" in header "GET /wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCF9JCsde%2FXjQrTM033%2FMEh HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCF9JCsde%2FXjQrTM033%2FMEh HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.pki.goog"30:T4c0,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to use PEM certificate for encryption and decryption Matched sigs: Possibly contains Public/Private key (encryption) Matched sigs: Contains reference to cryptographic keys Matched sigs: Able to use RSA keys for encryption and decryption Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: YARA signature match - RC4 Encryption31:T411,Found string "usercontent.youtube.com" (Indicator: "youtube.com"; Source: "00000000-00004780.00000000.303075.00300000.00000004.mdmp, 00000000-00004780.00000000.303075.005B0000.00000004.mdmp, 00000000-00004780.00000001.304995.00300000.00000004.mdmp, 00000000-00004780.00000002.306919.00300000.00000004.mdmp, 00000000-00004780.00000003.313232.00300000.00000004.mdmp") Found string "*.usercontent.youtube.com" (Indicator: "youtube.com"; Source: "00000000-00004780.00000000.303075.00300000.00000004.mdmp, 00000000-00004780.00000000.303075.005B0000.00000004.mdmp, 00000000-00004780.00000001.304995.00300000.00000004.mdmp, 00000000-00004780.00000002.306919.00300000.00000004.mdmp, 00000000-00004780.00000003.313232.00300000.00000004.mdmp") Found string "ercontent.youtube.com" (Indicator: "youtube.com"; Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp, 00000000-00004780.00000001.304995.00B40000.00000004.mdmp, 00000000-00004780.00000002.306919.00B40000.00000004.mdmp, 00000000-00004780.00000003.313232.00B40000.00000004.mdmp")32:T5d7,Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "svcF6C.tmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp")33:T713,Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetLocaleInfo(Ex)" (Indicator: "GetLocaleInfo"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp")34:T58f,Found reference to API "PostMessageA" (Indicator: "postmessage"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp")35:T611,Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp")36:Tbb6,Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetMonitorInfoA" (Indicator: "GetMonitorInfo"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "ExpandEnvironmentStrings" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "failed to GetMonitorInfo" (Indicator: "GetMonitorInfo"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "no GetMonitorInfo" (Indicator: "GetMonitorInfo"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetMonitorInfoA" (Indicator: "GetMonitorInfo"; Source: "00000000-00005104.00000000.301945.00401000.00000020.mdmp") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; Source: "00000000-00005104.00000000.301945.00401000.00000020.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00005104.00000000.301945.00401000.00000020.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp")37:T611,Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp")38:T5ba,Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "FindWindowA" (Indicator: "FindWindow"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp")39:T7b5,Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp")3a:T754,"svchost015.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "svchost015.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "svchost015.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "svchost015.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "svchost015.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "svchost015.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "svchost015.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "svchost015.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "svchost015.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "svchost015.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")3b:Ta03,"svchost015.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "svchost015.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "svchost015.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "svchost015.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "svchost015.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "svchost015.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "svchost015.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "svchost015.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "svchost015.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "svchost015.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "svchost015.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "svchost015.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "svchost015.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "svchost015.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "svchost015.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "svchost015.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "svchost015.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "svchost015.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "svchost015.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "svchost015.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "svchost015.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "svchost015.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "svchost015.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "svchost015.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "svchost015.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")3c:T5a7,"svchost015.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "svchost015.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "svchost015.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "svchost015.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "svchost015.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "svchost015.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "svchost015.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "svchost015.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "svchost015.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "svchost015.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "svchost015.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "svchost015.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "svchost015.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")3d:T683,"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "LoadLibrary" with a parameter KtmW32.dll (UID: 00000000-00005104)3e:Tae8e,"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetTextExtentExPointWPri (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter VirtualProtectEx (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter FlushInstructionCache (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter Process32First (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter Process32Next (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter lstrcmpA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetTempPathA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetTempFileNameA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter lstrcatA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter lstrcatW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter lstrcpyW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CreateTransaction (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CreateFileTransactedA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter RollbackTransaction (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter NtProtectVirtualMemory (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter NtCreateSection (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter NtMapViewOfSection (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter NtAllocateVirtualMemory (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter NtCreateThreadEx (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter NtWaitForSingleObject (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter RtlInitUnicodeString (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter FindFirstFileA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter FindNextFileA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CreateRemoteThread (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetLogicalDriveStringsA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetLogicalDriveStringsW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CopyFileA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CreateDirectoryA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter RemoveDirectoryA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter RemoveDirectoryW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter WinExec (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter FindResourceA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter FindResourceW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter LoadResource (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter OpenMutexA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter OpenMutexW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetSystemDefaultLangID (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetLocaleInfoA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetLocaleInfoW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter FileTimeToLocalFileTime (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter FileTimeToSystemTime (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter MoveFileA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CreateNamedPipeA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetWriteWatch (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter HeapWalk (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter IsNativeVhdBoot (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter DebugBreak (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetUserGeoID (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetGeoInfoW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter RtlGetNtProductType (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter LdrLoadDll (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter LdrUnloadDll (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter LdrGetDllHandle (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter LdrGetProcedureAddress (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter RtlAddVectoredExceptionHandler (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter NtSystemDebugControl (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter RtlCompressBuffer (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter RtlDecompressBuffer (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter RtlDecompressBufferEx (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetAsyncKeyState (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetActiveWindow (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetWindowTextA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter SystemParametersInfoA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter SwapMouseButton (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CredEnumerateA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CredEnumerateW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter LookupAccountSidA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter LookupAccountNameA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter QueryServiceStatusEx (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter ChangeServiceConfigA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter ChangeServiceConfigW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CreateProcessWithTokenW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter LsaLookupSids (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter SystemFunction032 (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter SystemFunction033 (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CryptEncrypt (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter CryptGenKey (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter RpcServerRegisterIf (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter RpcServerRegisterIf2 (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter RpcServerUseProtseqEpW (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter gethostname (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005104)3f:T755,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "CreateFile failed opening file "%s"" (Indicator: "CreateFile"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "CreateFileMapping" (Indicator: "CreateFile"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "CreateFile(pipe)" (Indicator: "CreateFile"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp")40:T955,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp")41:T4b6,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp")42:T4d9,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "OpenProcess(%lu)" (Indicator: "OpenProcess"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp")43:T6d4,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "WSASetLastError" (Indicator: "SetLastError"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "WSASetLastError" (Indicator: "SetLastError"; Source: "00000000-00005104.00000000.301945.00401000.00000020.mdmp") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; Source: "00000000-00005104.00000000.301945.00401000.00000020.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp")44:T7a1,"SOFTWARE\Borland\Delphi\RTL" in Source: 01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe "Software\Borland\Locales" in Source: 01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe "Software\Borland\Delphi\Locales" in Source: 01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: 01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004780.00000000.303075.00300000.00000004.mdmp 00000000-00004780.00000001.304995.00300000.00000004.mdmp 00000000-00004780.00000002.306919.00300000.00000004.mdmp 00000000-00004780.00000003.313232.00300000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004780.00000000.303075.00B40000.00000004.mdmp 00000000-00004780.00000001.304995.00B40000.00000004.mdmp 00000000-00004780.00000002.306919.00B40000.00000004.mdmp 00000000-00004780.00000003.313232.00B40000.00000004.mdmp "Software\%s%s" in Source: 00000000-00004780.00000003.313232.01290000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009" in Source: 00000000-00004780.00000003.313232.01290000.00000002.mdmp "HARDWARE\DESCRIPTION\System\BIOS" in Source: 00000000-00004780.00000003.313232.01290000.00000002.mdmp "SYSTEM\CurrentControlSet\services\LanmanServer\Parameters" in Source: 00000000-00004780.00000003.313232.01290000.00000002.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00005104.00000000.301945.00401000.00000020.mdmp "Software\Borland\Locales" in Source: 00000000-00005104.00000000.301945.00401000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005104.00000000.301945.00401000.00000020.mdmp "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: 00000000-00005104.00000000.301945.00401000.00000020.mdmp45:Tfc2,"GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Content-Security-Policy-Report-Only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/sytroprc:52:0 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to=sytroprc:52:0 Report-To: {"group":"sytroprc:52:0" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/sytroprc:52:0"}] } Server: scaffolding on HTTPServer2 Content-Length: 1446 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Tue 08 Jul 2025 11:41:51 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 9445 with response body ==>33303A38323A30353A61323A30613A30313A30303A61303A38323A30353A39623A33303A38323A30353A39373A30363A30393A32623A30363A30313A30353A30....... "GET /r/r1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 993 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue 08 Jul 2025 14:07:42 GMT Expires: Tue 08 Jul 2025 14:57:42 GMT Cache-Control: public max-age=3000 Age: 694 Last-Modified: Thu 03 Apr 2025 14:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>33303A38323A30333A64643A33303A38323A30313A63353A30323A30313A30313A33303A30643A30363A30393A32613A38363A34383A38363A66373A30643A30....... "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 11508 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue 08 Jul 2025 13:51:49 GMT Expires: Tue 08 Jul 2025 14:41:49 GMT Cache-Control: public max-age=3000 Age: 1647 Last-Modified: Tue 08 Jul 2025 10:01:56 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>33303A38323A32633A66303A33303A38323A32623A64383A30323A30313A30313A33303A30643A30363A30393A32613A38363A34383A38363A66373A30643A30....... "GET /wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCF9JCsde%2FXjQrTM033%2FMEh HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: o.pki.goog" Response ==> HTTP/1.1 200 OK Content-Security-Policy-Report-Only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/sytroprc:52:0 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to=sytroprc:52:0 Report-To: {"group":"sytroprc:52:0" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/sytroprc:52:0"}] } Server: scaffolding on HTTPServer2 Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Tue 08 Jul 2025 10:48:03 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 12673 with response body ==>33303A38323A30313A64343A30613A30313A30303A61303A38323A30313A63643A33303A38323A30313A63393A30363A30393A32623A30363A30313A30353A30.......46:T4b9,"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71a40000 "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" loaded module "KERNEL32" at base 75860000 "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" loaded module "ADVAPI32.DLL" at base 76120000 "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" loaded module "CRYPTBASE.DLL" at base 752b0000 "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" loaded module "UXTHEME.DLL" at base 73f20000 "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" loaded module "COMCTL32" at base 742b0000 "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" loaded module "KERNEL32.DLL" at base 75860000 "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" loaded module "NTDLL.DLL" at base 774b000047:T82b,"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x10,mov eax, 0x46adb8,call 0x405edc,mov eax, dword ptr [0x46e058],mov eax, dword ptr [eax],call 0x451550,mov ecx, dword ptr [0x46dd84],mov eax, dword ptr [0x46e058],mov eax, dword ptr [eax],mov edx, dword ptr [0x46a974],call 0x451568,mov eax, dword ptr [0x46e058],mov eax, dword ptr [eax],call 0x4515e8,call 0x403d80,lea eax, [eax],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "svchost015.exe" file has an entrypoint instructions - "call 0x5a2b9d,jmp 0x595aba,push ebp,mov ebp, esp,push esi,mov esi, dword ptr [ebp + 0x14],push edi,xor edi, edi,cmp esi, edi,jne 0x595cb6,xor eax, eax,jmp 0x595d1b,cmp dword ptr [ebp + 8], edi,jne 0x595cd6,call 0x59a86e,push 0x16,pop esi,mov dword ptr [eax], esi,push edi,push edi,push edi,push edi,push edi,call 0x596135,add esp, 0x14,mov eax, esi,jmp 0x595d1b,cmp dword ptr [ebp + 0x10], edi,je 0x595cf1,cmp dword ptr [ebp + 0xc], esi,jb 0x595cf1,push esi,push dword ptr [ebp + 0x10],push dword ptr [ebp + 8],call 0x596d50,add esp, 0xc,jmp 0x595cb2,push dword ptr [ebp + 0xc],push edi,push dword ptr [ebp + 8],call 0x597c90," "svcF6C.tmp" file has an entrypoint instructions - "call 0x409132,jmp 0x4089d3,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x408339,jmp 0x408b59,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x42a018],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax,"48:T674,The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: A6:85:37:18:41:2C:2C:A3:14:80:3A:BD:59:1E:0E:4E:13:76:2F:36; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=VeriSign Time Stamping Services CA, O="VeriSign Inc.", C=US" (SHA1: AD:A8:AA:A6:43:FF:7D:C3:8D:D4:0F:A4:C9:7A:D5:59:FF:48:46:DE; see report for more information) The input sample is signed with a certificate issued by "CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA" (SHA1: F4:6A:C0:C6:EF:BB:8C:6A:14:F5:5F:09:E2:D3:7D:F4:C0:DE:01:2D; see report for more information) The input sample is signed with a certificate issued by "OU=Class 3 Public Primary Certification Authority, O="VeriSign Inc.", C=US" (SHA1: 19:7A:4A:EB:DB:25:F0:17:00:79:BB:8C:73:CB:2D:65:5E:00:18:A4; see report for more information) The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Code Signing 2004 CA, OU=Terms of use at https://www.verisign.com/rpa c04, OU=VeriSign Trust Network, O="VeriSign Inc.", C=US" (SHA1: 66:D2:59:22:A4:92:9F:62:83:8E:A1:FE:CB:E7:BE:93:41:A2:EA:60; see report for more information)49:T6c8,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp")4a:Ta0f,"svchost015.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\svchost015.exe]- [targetUID: 00000000-00005104] "svcF6C.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\svcF6C.tmp]- [targetUID: 00000000-00005104] "9C69E496D546F49A980D7350EC49A180" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\9C69E496D546F49A980D7350EC49A180]- [targetUID: 00000000-00004780] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4761 bytes 1 file at 0x2c last modified Sun Dec 04 2024 10:02:46 +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00004780] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00004780] "05DDC6AA91765AACACDB0A5F96DF8199" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199]- [targetUID: 00000000-00004780] "C02877841121CC45139CB51404116B25_79CC29E1F7D035B115276DC794FE8DD4" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\C02877841121CC45139CB51404116B25_79CC29E1F7D035B115276DC794FE8DD4]- [targetUID: 00000000-00004780] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00004780] "C02877841121CC45139CB51404116B25_79CC29E1F7D035B115276DC794FE8DD4" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\C02877841121CC45139CB51404116B25_79CC29E1F7D035B115276DC794FE8DD4]- [targetUID: 00000000-00004780] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00004780] "9C69E496D546F49A980D7350EC49A180" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\9C69E496D546F49A980D7350EC49A180]- [targetUID: 00000000-00004780] "05DDC6AA91765AACACDB0A5F96DF8199" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199]- [targetUID: 00000000-00004780]4b:T9fd,"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "")4c:Te84,"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "01C3B22EFB07D44D2102650A3896E08C4CD5424B176A943FA7E7E93DEF3DC231"; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "")4d:Tbef,"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to touch file "C:\version.dll" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to touch file "C:\Windows\system32\version.dll" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to touch file "C:\01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe.Local\" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to touch file "C:\01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.ENU" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to touch file "C:\01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.ENU.DLL" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to touch file "C:\01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.EN" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to touch file "C:\01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.EN.DLL" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to touch file "C:\Windows\system32\uxtheme.dll" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to touch file "C:\dwmapi.dll" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to touch file "C:\Windows\system32\dwmapi.dll" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to touch file "C:\FLTLIB.DLL" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll"4e:T831,"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to access non-existent file "C:\version.dll" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to access non-existent file "C:\01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.ENU.DLL" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to access non-existent file "C:\01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.EN.DLL" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to access non-existent file "C:\dwmapi.dll" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to access non-existent file "C:\FLTLIB.DLL" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to access non-existent file "C:\KtmW32.dll" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to access non-existent file "C:\VERSION.DLL" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to access non-existent file "C:\01C3B22EFB07D44D2102650A3896E08C4CD5424B176A943FA7E7E93DEF3DC231.ENU.DLL" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to access non-existent file "C:\01C3B22EFB07D44D2102650A3896E08C4CD5424B176A943FA7E7E93DEF3DC231.EN.DLL" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to access non-existent file "C:\DWMAPI.DLL" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL"4f:T70a,"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to access non-existent file "C:\01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe.Local\" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to access non-existent file "C:\01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.ENU" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to access non-existent file "C:\01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.EN" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to access non-existent file "C:\Windows\system32\uxtheme.dll.Config" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to access non-existent file "C:\01C3B22EFB07D44D2102650A3896E08C4CD5424B176A943FA7E7E93DEF3DC231.EXE.LOCAL" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to access non-existent file "C:\01C3B22EFB07D44D2102650A3896E08C4CD5424B176A943FA7E7E93DEF3DC231.ENU" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to access non-existent file "C:\01C3B22EFB07D44D2102650A3896E08C4CD5424B176A943FA7E7E93DEF3DC231.EN" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" trying to access non-existent file "C:\Windows\System32\UXTHEME.DLL.CONFIG" "svchost015.exe" trying to access non-existent file "\Device\RasAcd" "svchost015.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}" "svchost015.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{AC07BF4D-B150-47EB-A71E-488912826651}" "svchost015.exe" trying to access non-existent file "C:\Users\wLv7pNc\AppData\Local\Temp\svchost015.exe.Local\"50:T526,"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" writes file "c:\users\%osuser%\appdata\local\temp\svchost015.exe" "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" writes file "c:\users\%osuser%\appdata\local\temp\svcf6c.tmp" "svchost015.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157" "svchost015.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\57c8edb95df3f0ad4ee2dc2b8cfd4157" "svchost015.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\24bd96d5497f70b3f510a6b53cd43f3e_3a89246fb90c5ee6620004f1ae0eb0ea" "svchost015.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\24bd96d5497f70b3f510a6b53cd43f3e_3a89246fb90c5ee6620004f1ae0eb0ea" "svchost015.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\05ddc6aa91765aacacdb0a5f96df8199" "svchost015.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\05ddc6aa91765aacacdb0a5f96df8199" "svchost015.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\c02877841121cc45139cb51404116b25_79cc29e1f7d035b115276dc794fe8dd4"51:T862,Found reference to API "WSARecv" (Indicator: "WSARecv"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "WSARecvDisconnect" (Indicator: "WSARecv"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "WSASend" (Indicator: "WSASend"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "WSASendDisconnect" (Indicator: "WSASend"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "WSASendTo" (Indicator: "WSASend"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "WSARecvEx" (Indicator: "WSARecv"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00005104.00000000.301945.00401000.00000020.mdmp") Found reference to API "WSARecvDisconnect" (Indicator: "WSARecv"; Source: "00000000-00005104.00000000.301945.00401000.00000020.mdmp") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; Source: "00000000-00005104.00000000.301945.00401000.00000020.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00005104.00000000.301945.00401000.00000020.mdmp") Found reference to API "WSASendDisconnect" (Indicator: "WSASend"; Source: "00000000-00005104.00000000.301945.00401000.00000020.mdmp") Found reference to API "WSASendTo" (Indicator: "WSASend"; Source: "00000000-00005104.00000000.301945.00401000.00000020.mdmp") Found reference to API "WSARecvEx" (Indicator: "WSARecv"; Source: "00000000-00005104.00000000.301945.00401000.00000020.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00005104.00000000.301945.00401000.00000020.mdmp")52:Tdb1,Found reference to API "WSARecv" (Indicator: "WSARecv"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "WSARecvDisconnect" (Indicator: "WSARecv"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "WSASend" (Indicator: "WSASend"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "WSASendDisconnect" (Indicator: "WSASend"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "WSASendTo" (Indicator: "WSASend"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "WSARecvEx" (Indicator: "WSARecv"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00005104.00000000.301945.00401000.00000020.mdmp") Found reference to API "WSARecvDisconnect" (Indicator: "WSARecv"; Source: "00000000-00005104.00000000.301945.00401000.00000020.mdmp") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; Source: "00000000-00005104.00000000.301945.00401000.00000020.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00005104.00000000.301945.00401000.00000020.mdmp")53:T41b,Found reference to API "CreateNamedPipeW" (Indicator: "CreateNamedPipe"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "CreateNamedPipe" (Indicator: "CreateNamedPipe"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "process sync failed w/GetNamedPipeServerProcessId" (Indicator: "GetNamedPipe"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetNamedPipeServerProcessId" (Indicator: "GetNamedPipe"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "CreateNamedPipeW" (Indicator: "CreateNamedPipe"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp")54:T4a6,Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "NetUserGetGroups" (Indicator: "NetUserGetGroups"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "NetUserGetLocalGroups" (Indicator: "NetUserGetLocalGroups"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "NetGetAnyDCName" (Indicator: "NetGetAnyDCName"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "NetUserGetLocalGroups" (Indicator: "NetUserGetLocalGroups"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "NetUserGetGroups" (Indicator: "NetUserGetGroups"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "NetGetAnyDCName" (Indicator: "NetGetAnyDCName"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp")55:T963,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "WinHttpGetDefaultProxyConfiguration" (Indicator: "WinHttpGetDefaultProxyConfiguration"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "WinHttpGetProxyForUrlEx" (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "WinHttpGetProxyForUrlEx" (Indicator: "WinHttpGetProxyForUrlEx"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "WinHttpCreateProxyResolver" (Indicator: "WinHttpCreateProxyResolver"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "WinHttpSetStatusCallback" (Indicator: "WinHttpSetStatusCallback"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "WinHttpGetProxyResult" (Indicator: "WinHttpGetProxyResult"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "WinHttpFreeProxyResult" (Indicator: "WinHttpFreeProxyResult"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "WinHttpGetProxyForUrlEx callback" (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "WinHttpGetProxyForUrlEx callback" (Indicator: "WinHttpGetProxyForUrlEx"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "WinHttpGetProxyForUrlEx: timed out" (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "WinHttpGetProxyForUrlEx: timed out" (Indicator: "WinHttpGetProxyForUrlEx"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp")56:T423,"1.0.0.0" "192.168.0.2" "85.156.73.98" Potential IP "185.156.73.98" found in string "185.156.73.98/service" Potential IP "185.156.73.98" found in string "ttp://185.156.73.98/success?substr=mixsix&s=three&sub=none" "185.156.73.98" "5.156.73.98" "2.5.29.15" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.19" "2.5.29.14" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.17" "2.5.29.32" "2.5.29.31" "2.5.29.1" "2.5.4.3" "2.5.29.4" "2.5.29.10" "2.5.29.16" Potential IP "185.156.73.98" found in string "185.156.73.98/success?substr=mixsix&s=three&sub=none" Potential IP "185.156.73.98" found in string "http://185.156.73.98/success?substr=mixsix&s=three&sub=none" Potential IP "185.156.73.98" found in string "tp://185.156.73.98/success?substr=mixsix&s=three&sub=none" Potential IP "185.156.73.98" found in string "Host: 185.156.73.98" "2.5.29.21" "2.5.4.6" "2.5.4.10" "2.5.4.11" "2.5.29.20" "2.5.29.28" Potential IP "185.156.73.98" found in string "://185.156.73.98/success?substr=mixsix&s=three&sub=none"57:T228c,Pattern match: "updateswdrive.usercontent.google.com/download?id=1ybvidkzgygnfuu2rbjxxcydrzay5rmdy&export=download&authuser=0&confirm=t/servicesub=mixelevenmixtwelvemixthirtnonemixsixunordered_map/set" Pattern match: "http://c.pki.goog/wr2/9uvbn0w5e6y.crl4.ug\7l+$$ptb|v}6ejx" Heuristic match: "drive.usercontent.google.com" Heuristic match: "pki-goog.l.google.com" Heuristic match: "edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com" Heuristic match: "wu-b-net.trafficmanager.net" Heuristic match: "ctldl.windowsupdate.com" Heuristic match: "ed-cds.cqloud.com" Heuristic match: "oogle.com" Heuristic match: "rive.usercontent.google.com" Pattern match: "drive.usercontent.google.com/download?id=1ybvidkzgygnfuu2rbjxxcydrzay5rmdy&export=download&authuser=0&confirm=t" Pattern match: "http://o.pki.goog/wr20%" Pattern match: "http://i.pki.goog/wr2.crt0" Heuristic match: "*.usercontent.google.com" Heuristic match: "usercontent.google.com" Heuristic match: "*.usercontent.sandbox.google.com" Heuristic match: "fife.google.com" Heuristic match: "*.fife.google.com" Heuristic match: "fife.usercontent.google.com" Heuristic match: "*.fife.usercontent.google.com" Heuristic match: "usercontent.youtube.com" Heuristic match: "*.usercontent.youtube.com" Heuristic match: "$lti.workspace.usercontent.google.com" Heuristic match: "lti.drive.usercontent.google.com" Heuristic match: "!lti.gemini.usercontent.google.com" Pattern match: "http://c.pki.goog/wr2/9uvbn0w5e6y.crl0" Heuristic match: "ma.aw" Pattern match: "http://i.pki.goog/r1.crt0+" Pattern match: "http://c.pki.goog/r/r1.crl0" Heuristic match: "ive.usercontent.google.com" Pattern match: "http://ocsp.pki.goog/gsr10" Pattern match: "http://pki.goog/gsr1/gsr1.crt02" Pattern match: "http://crl.pki.goog/gsr1/gsr1.crl0" Pattern match: "http://c.pki.goog/wr2/9uvbn0w5e6y.crl" Heuristic match: "i.com" Pattern match: "c.pki.goog/r/r1.crl" Pattern match: "o.pki.goog/wr2/mfiwudbomewwsjajbgurdgmcgguabbrtqtsei8ex%2bbyutxd8%2bymxd3s1zqqu3hse7xkv1d43jmmhu%2bw0ow1csjaceqcf9jcsde%2fxjqrtm033%2fmeh" Pattern match: "c.pki.goog/wr2/9uvbn0w5e6y.crl" Pattern match: "http://i.pki.goog/r1.crt" Pattern match: "http://ocsp.pki.goog/gsr1" Pattern match: "http://crl.pki.goog/gsr1/gsr1.crl" Pattern match: "http://o.pki.goog/wr2/mfiwudbomewwsjajbgurdgmcgguabbrtqtsei8ex%2bbyutxd8%2bymxd3s1zqqu3hse7xkv1d43jmmhu%2bw0ow1csjaceqcf9jcsde%2fxjqrtm033%2fmehv" Pattern match: "http://c.pki.goog/r/r1.crl" Pattern match: "http://o.pki.goog/wr2/mfiwudbomewwsjajbgurdgmcgguabbrtqtsei8ex%2bbyutxd8%2bymxd3s1zqqu3hse7xkv1d43jmmhu%2bw0ow1csjaceqcf9jcsde%2fxjqrtm033%2fmeh" Pattern match: "https://csp.withgoogle.com/csp/scaffolding/sytroprc:52:0" Pattern match: "https://csp.withgoogle.com/csp/report-to/scaffolding/sytroprc:52:0" Pattern match: "https://csp.withgoogle.com/csp/report-to/cacerts" Pattern match: "https://csp.withgoogle.com/csp/cacerts" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://g.symcd.com0" Pattern match: "http://www.geotrust.com/resources/cps06" Pattern match: "http://g.symcb.com/geotrustpca-g3.crl0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://isrg.trustid.ocsp.identrust.com0" Pattern match: "http://apps.identrust.com/roots/dstrootcax3.p7c0" Pattern match: "http://cps.root-x1.letsencrypt.org0" Pattern match: "http://crl.identrust.com/dstrootcax3crl.crl0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "http://www.usertrust.com1" Pattern match: "https://secure.comodo.com/cps0" Pattern match: "crl.comodoca.com/utn-userfirst-hardware.crl06" Pattern match: "crl.comodo.net/utn-userfirst-hardware.crl0q" Pattern match: "http://crt.comodoca.com/utnaddtrustserverca.crt0$" Pattern match: "http://ocsp.comodoca.com05" Heuristic match: "addons.mozilla.org" Pattern match: "www.addons.mozilla.org0" Pattern match: "www.google.com0" Pattern match: "http://ocsp.comodoca.com0%" Pattern match: "www.google.com" Pattern match: "http://www.public-trust.com/cps/omniroot.html0" Pattern match: "www.public-trust.com/cgi-bin/crl/2018/cdp.crl0" Pattern match: "2www.entrust.net/cps" Pattern match: "http://ocsp.entrust.net03" Pattern match: "http://crl.entrust.net/server1.crl0" Pattern match: "http://www.diginotar.nl/cps/pkioverheid0" Pattern match: "http://crl.pkioverheid.nl/domovlatestcrl.crl0" Pattern match: "http://cybertrust.omniroot.com/repository.cfm0" Pattern match: "http://ocsp.comodoca.com0/" Heuristic match: "login.skype.com" Pattern match: "www.login.skype.com0" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0" Pattern match: "www.verisign.com/repository/cps" Pattern match: "https://www.verisign.com/repository/cps" Pattern match: "https://www.verisign.com" Pattern match: "www.verisign.com/repository/verisignlogo.gif0d" Pattern match: "https://www.verisign.com/rpa0" Heuristic match: "login.yahoo.com" Pattern match: "www.login.yahoo.com0" Heuristic match: "mail.google.com" Pattern match: "www.mail.google.com0" Pattern match: "http://ocsp.comodoca.com0-" Heuristic match: "login.live.com" Pattern match: "www.login.live.com0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://ocsp.entrust.net0d" Pattern match: "http://www.digicert.com.my/cps.htm02" Pattern match: "http://crl.entrust.net/2048ca.crl0" Heuristic match: "f.com" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "www.digicert.com1+0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.digicert.com1" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Heuristic match: "ercontent.youtube.com" Heuristic match: "ercontent.google.com" Pattern match: "crl.usertrust.com/utn-userfirst-object.crl0" Pattern match: "http://www.microsoft.com0" Pattern match: "http://185.156.73.98/success?substr=mixsix&s=three&sub=none" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Heuristic match: "usercontent.sandbox.google.com" Heuristic match: "i.drive.usercontent.google.com" Heuristic match: "i.workspace.usercontent.google.com" Heuristic match: "i.gemini.usercontent.google.com" Heuristic match: "fe.google.com" Pattern match: "crl.microsoft.com/pki/crl/prod" Pattern match: "http://www.microsoft.com/pki/certs" Pattern match: "https://csp.withgoogle.com/csp/rep" Pattern match: "http://c.pki.goog/wr2/9uvbn0w5e6" Pattern match: "https://csp.withgoogle.com/csp/caotjjs" Pattern match: "http://c.pki.goog/wr2/9uvbn0w" Pattern match: "https://www.realvnc.com/forgot-password?email=%s" Pattern match: "https://www.realvnc.com/legal/#eulas" Pattern match: "https://www.realvnc.com/legal/#privacy" Pattern match: "https://www.realvnc.com/sign-up" Pattern match: "https://www.realvnc.com/security" Pattern match: "https://www.realvnc.com/pricing" Pattern match: "https://www.realvnc.com/docs/faq/join-computer.html" Pattern match: "https://www.realvnc.com/teams/%s/computers" Pattern match: "https://www.realvnc.com/docs/%.3s/foss.html" Pattern match: "https://www.realvnc.com" Pattern match: "https://hb-a.services.vnc.com:443/bootstrap/1.2/configuration" Pattern match: "https://hb-b.services.vnc.com:443/bootstrap/1.2/configuration" Pattern match: "https://hb-c.services.vnc.com:443/bootstrap/1.2/configuration" Heuristic match: "=.sj" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Heuristic match: "font.name" Heuristic match: "~dfaa50c5778e3de2b9.tm" Heuristic match: "~dfd9fdf3f6c945c7b5.tm"58:Teb17,Found URL "http://o.pki.goog/wr20%http://i.pki.goog/wr2.crt0*.usercontent.google.comusercontent.google.com" - Source: "00000000-00004780.00000000.303075.00300000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/9uvbn0w5e6y.crl0" - Source: "00000000-00004780.00000000.303075.00300000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crt0+$0" - Source: "00000000-00004780.00000000.303075.00300000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/o" - Source: "00000000-00004780.00000000.303075.00300000.00000004.mdmp") Found URL "http://o.pki.goog/wr20%http://i.pki.goog/wr2.crt0*.usercontent.google.comusercontent.google.com" - Source: "00000000-00004780.00000000.303075.005B0000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/9uvbn0w5e6y.crl0" - Source: "00000000-00004780.00000000.303075.005B0000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crt0+$0" - Source: "00000000-00004780.00000000.303075.005B0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/o" - Source: "00000000-00004780.00000000.303075.005B0000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr10)http://pki.goog/gsr1/gsr1.crt02+0)0'!http://crl.pki.goog/gsr1/gsr1.crl0;40207okzgm=" - Source: "00000000-00004780.00000000.303075.005B0000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/9uvbn0w5e6y.crl:\users\hapubws\appdata\roaming\microsoft\systemcertificates\myc.pki.googc.pki.googo.pki.googo.pki.googc.pki.googoftware\policies\microsoft\systemcertificates\disallowedoftware\policies\microsoft\systemcertificates\disallowedttp://185.156.73.98/success?substr=mixsix&s=three&sub=noneuritttp://185.156.73.98/success?substr=mixsix&s=three&sub=nonettp://185.156.73.98/success?substr=mixsix&s=three&sub=nonealrpc:[dnsresolver,security=impersonation" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/9uvbn0w5e6y.crlsa/sha1raudulentntrustedntrustedsa/sha1raudulentntrustedntrustedntrustedntrustedsa/sha1raudulentntrustedsubcantrustedsa/sha1raudulentsa/sha1raudulentsa/sha1raudulentsa/sha1raudulenthawte" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crtte" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr1http://crl.pki.goog/gsr1/gsr1.crl85.156.73.9885.156.73.9885.156.73.985.156.73.98etwork" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://o.pki.goog/wr2/mfiwudbomewwsjajbgurdgmcgguabbrtqtsei8ex%2bbyutxd8%2bymxd3s1zqqu3hse7xkv1d43jmmhu%2bw0ow1csjaceqcf9jcsde%2fxjqrtm033%2fmehvhttp://c.pki.goog/wr2/9uvbn0w5e6y.crl33%2fmehcceswr2/9uvbn0w5e6y.crlroxysettingsperuserhttp://c.pki.goog/r/r1.crl:\users\hapubws0-50-56-91-91-a8paddecisionreasonsubcasers\hapubws\appdata\locallow\microsoft\cryptneturlcache\content\c02877841121cc45139cb51404116b25_79cc29e1f7d035b115276dc794fe8dd4pseudo-interface" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://o.pki.goog/wr2/mfiwudbomewwsjajbgurdgmcgguabbrtqtsei8ex%2bbyutxd8%2bymxd3s1zqqu3hse7xkv1d43jmmhu%2bw0ow1csjaceqcf9jcsde%2fxjqrtm033%2fmehc02877841121cc45139cb51404116b25_edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.comctldl.windowsupdate.comintel(r)" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "https://csp.withgoogle.com/csp/scaffolding/sytroprc:52:0cross-origin-opener-policy-report-only:" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "https://csp.withgoogle.com/csp/report-to/scaffolding/sytroprc:52:0" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "https://csp.withgoogle.com/csp/report-to/cacerts" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "https://csp.withgoogle.com/csp/cacertspersistent-authwww-authenticateaccept-encodingvaryset-cookiesffeserverretry-afterproxy-supportproxy-authenticatelocationetagauthentication-info1647bytesaccept-rangestue," - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr10)http://pki.goog/gsr1/gsr1.crt02+0)0'!http://crl.pki.goog/gsr1/gsr1.crl0;40207okzgm=" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0=jag=j35=j" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'gte" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0salt" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,o2;n)wp+(the" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0(+pw)salt" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nsalt" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9ckx!!0ikfgif0f$\_)$bf!internet1verisign," - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!ki0!!salt" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0oc*9entrust.net1;092www.entrust.net/cps" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrusverisign" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?mnk't" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://185.156.73.98/success?substr=mixsix&s=three&sub=nonehttp://185.156.73.98/success?substr=mixsix&s=three&sub=nonetp://185.156.73.98/success?substr=mixsix&s=three&sub=none3jsu3jjo3jz03jer3jo.schemedllretrieveencodedobjectwcontextdllcreateobjectcontexthost:" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0nf:8" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/prod3j/moceraut_2010-06-23.crl0z>http://www.microsoft.com/pki/certs3jroaut_2010-06-23.crt07ya'4>@6t+a6" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "https://csp.withgoogle.com/csp/cacertscross-origin-resource-policy:" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "https://csp.withgoogle.com/csp/scaffolding/sytroprc:52:0persistent-authwww-authenticatevaryset-cookiescaffolding" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/9uvbn0w5e6y.crl4" - Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp") Found URL "http://o.pki.goog/wr20%http://i.pki.goog/wr2.crt0*.usercontent.google.comusercontent.google.com" - Source: "00000000-00004780.00000001.304995.00300000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/9uvbn0w5e6y.crl0" - Source: "00000000-00004780.00000001.304995.00300000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crt0+$0" - Source: "00000000-00004780.00000001.304995.00300000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/o" - Source: "00000000-00004780.00000001.304995.00300000.00000004.mdmp") Found URL "http://invalid" - Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp") Found URL "http://c.pki.goog/wr2/9uvbn0w5e6y.crl:\users\hapubws\appdata\roaming\microsoft\systemcertificates\myc.pki.googc.pki.googo.pki.googo.pki.googc.pki.googoftware\policies\microsoft\systemcertificates\disallowedoftware\policies\microsoft\systemcertificates\disallowedttp://185.156.73.98/success?substr=mixsix&s=three&sub=nonealrpc:[dnsresolver,security=impersonation" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crtte" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr1http://crl.pki.goog/gsr1/gsr1.crl5.156.73.985.156.73.9885.156.73.9885.156.73.985.156.73.9885.156.73.985.156.73.985.156.73.98etwork" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://o.pki.goog/wr2/mfiwudbomewwsjajbgurdgmcgguabbrtqtsei8ex%2bbyutxd8%2bymxd3s1zqqu3hse7xkv1d43jmmhu%2bw0ow1csjaceqcf9jcsde%2fxjqrtm033%2fmehvhttp://c.pki.goog/wr2/9uvbn0w5e6y.crl33%2fmehcceswr2/9uvbn0w5e6y.crlroxysettingsperusercalrpchttp://c.pki.goog/r/r1.crl:\users\hapubws0-50-56-91-91-a8paddecisionreasonsubcasers\hapubws\appdata\localache\content\c02877841121cc45139cb51404116b25_79cc29e1f7d035b115276dc794fe8dd4pseudo-interface" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "https://csp.withgoogle.com/csp/scaffolding/sytroprc:52:0cross-origin-opener-policy-report-only:" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "https://csp.withgoogle.com/csp/report-to/scaffolding/sytroprc:52:0" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "https://csp.withgoogle.com/csp/report-to/cacerts" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "https://csp.withgoogle.com/csp/cacertspersistent-authwww-authenticateaccept-encodingvaryset-cookiesffeserverretry-afterproxy-supportproxy-authenticatelocationetagauthentication-info1647bytesaccept-rangestue," - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr10)http://pki.goog/gsr1/gsr1.crt02+0)0'!http://crl.pki.goog/gsr1/gsr1.crl0;40207okzgm=" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0=jag=j35=j" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'gte" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0salt" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,o2;n)wp+(the" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0(+pw)salt" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nsalt" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9ckx!!0ikfgif0f$\_)$bf!internet1verisign," - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!ki0!!salt" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0oc*9entrust.net1;092www.entrust.net/cps" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrusverisign" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?mnk't" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://185.156.73.98/success?substr=mixsix&s=three&sub=nonetp://185.156.73.98/success?substr=mixsix&s=three&sub=nonehttp://185.156.73.98/success?substr=mixsix&s=three&sub=nonetp://185.156.73.98/success?substr=mixsix&s=three&sub=nonetp://185.156.73.98/success?substr=mixsix&s=three&sub=none3jsu3jjo3jz03jer3jo.schemedllretrieveencodedobjectwcontextdllcreateobjectcontextcache-control:" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0nf:8" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/prod3j/moceraut_2010-06-23.crl0z>http://www.microsoft.com/pki/certs3jroaut_2010-06-23.crt07ya'4>@6t+a6" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "https://csp.withgoogle.com/csp/cacertscross-origin-resource-policy:" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "https://csp.withgoogle.com/csp/scaffolding/sytroprc:52:0persistent-authwww-authenticatevaryset-cookiescaffolding" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/9uvbn0w5e6y.crl4" - Source: "00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found URL "http://o.pki.goog/wr20%http://i.pki.goog/wr2.crt0*.usercontent.google.comusercontent.google.com" - Source: "00000000-00004780.00000002.306919.00300000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/9uvbn0w5e6y.crl0" - Source: "00000000-00004780.00000002.306919.00300000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crt0+$0" - Source: "00000000-00004780.00000002.306919.00300000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/o" - Source: "00000000-00004780.00000002.306919.00300000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/9uvbn0w5e6y.crl:\users\hapubws\appdata\roaming\microsoft\systemcertificates\myc.pki.googc.pki.googo.pki.googo.pki.goog+ncalrpc:[ole2e75e6995d444de3951ef42c329a]apubws-pc\hapubwsoftware\policies\microsoft\systemcertificates\disallowedoftware\policies\microsoft\systemcertificates\disallowedhapubws-pc192.168.0.2ttp://185.156.73.98/success?substr=mixsix&s=three&sub=nonettp://185.156.73.98/success?substr=mixsix&s=three&sub=nonettp://185.156.73.98/success?substr=mixsix&s=three&sub=nonealrpc:[dnsresolver,security=impersonation" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crtte" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr1http://crl.pki.goog/gsr1/gsr1.crlsfactorybuffer85.156.73.98sfactorybuffer85.156.73.98sfactorybuffer85.156.73.985.156.73.98etwork" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://o.pki.goog/wr2/mfiwudbomewwsjajbgurdgmcgguabbrtqtsei8ex%2bbyutxd8%2bymxd3s1zqqu3hse7xkv1d43jmmhu%2bw0ow1csjaceqcf9jcsde%2fxjqrtm033%2fmehvisatap." - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/9uvbn0w5e6y.crl33%2fmehccesetwork" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crlcalrpc:[dhcpcsvc,security=impersonation" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "https://csp.withgoogle.com/csp/scaffolding/sytroprc:52:0cross-origin-opener-policy-report-only:" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "https://csp.withgoogle.com/csp/report-to/scaffolding/sytroprc:52:0" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "https://csp.withgoogle.com/csp/repacerts" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "https://csp.withgoogle.com/csp/cacertspersistent-authwww-authenticatencodingvaryset-cookiesffeserverretry-afterproxy-supportproxy-authenticatep3plhetagauthentication-info1647bytesaccept-rangestue," - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr10)http://pki.goog/gsr1/gsr1.crt02+0)0'!http://c7okzwih(=j50=jon=jt0=jt.=j.c=jle=jgo=jgl=jle?r<0" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0=jag=j35=j" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'gte" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0salt" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,o2;n)wp+(the" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0(+pw)salt" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nsalt" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9ckx!!0ikfgif0f$\_)$bf!internet1verisign," - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!ki0!!salt" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0oc*9entrust.net1;092www.entrust.net/cps" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrusverisign" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?mnk't" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://185.156.73.98/success?substr=mixsix&s=three&sub=nonehttp://185.156.73.98/success?substr=mixsix&s=three&sub=nonelmem03jsu3jjo3jz03jer3jo.schemedllretrieveencodedobjectwcontextdllcreateobjectcontext3j61cache-control:" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0nf:8" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/prod3j/moceraut_2010-06-23.crl0z>http://www.microsoft.com/pki/certs3jroaut_2010-06-23.crt07ya'4>@6t+a6" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "https://csp.withgoogle.com/csp/cacertscross-origin-resource-policy:" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "https://csp.withgoogle.com/csp/report-to/cacerts" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/9uvbn0w5e64" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/9uvbn0w5e6y.crl4" - Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found URL "http://o.pki.goog/wr20%http://i.pki.goog/wr2.crt0*.usercontent.google.comusercontent.google.com" - Source: "00000000-00004780.00000003.313232.00300000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/9uvbn0w5e6y.crl0" - Source: "00000000-00004780.00000003.313232.00300000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crt0+$0" - Source: "00000000-00004780.00000003.313232.00300000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crl0h3/o" - Source: "00000000-00004780.00000003.313232.00300000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/9uvbn0w5e6y.crl:\users\hapubws\appdata\roaming\microsoft\systemcertificates\myc.pki.googc.pki.googo.pki.googo.pki.goog+ncalrpc:[ole921db1262a3e44e4a6d607f5798b]apubws-pc\hapubwsoftware\policies\microsoft\systemcertificates\disallowedoftware\policies\microsoft\systemcertificates\disallowedalrpc:[dnsresolver,security=impersonation" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://i.pki.goog/r1.crtte" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr1http://crl.pki.goog/gsr1/gsr1.crlsfactorybuffer5.156.73.9885.156.73.9885.156.73.98sfactorybufferssspku2usfactorybuffer5.156.73.98insta0\default5.156.73.9885.156.73.98etwork" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://o.pki.goog/wr2/mfiwudbomewwsjajbgurdgmcgguabbrtqtsei8ex%2bbyutxd8%2bymxd3s1zqqu3hse7xkv1d43jmmhu%2bw0ow1csjaceqcf9jcsde%2fxjqrtm033%2fmehvrpc:hon36-32pccesetwork" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://c.pki.goog/r/r1.crlcalrpc:[dhcpcsvc,security=impersonation" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://185.156.73.98/success?substr=mixsix&s=three&sub=nonetp://185.156.73.98/success?substr=mixsix&s=three&sub=nonelmem0" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "https://csp.withgoogle.com/csp/repacerts" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "https://csp.withgoogle.com/csp/cacertspersistent-authwww-authenticatencodingvaryset-cookiesffeserverretry-afterproxy-supportproxy-authenticatep3plhetagauthentication-info1647bytesaccept-rangestue," - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://ocsp.pki.goog/gsr10)http://pki.goog/gsr1/gsr1.crt02+0)0'!http://c7okzwih(=j50=jon=jt0=jt.=j.c=jle=jgo=jgl=jle?r<0" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0=jag=j35=j" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'gte" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0salt" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,o2;n)wp+(the" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0(+pw)salt" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nsalt" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9ckx!!0ikfgif0f$\_)$bf!internet1verisign," - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!ki0!!salt" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0oc*9entrust.net1;092www.entrust.net/cps" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrusverisign" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?mnk't" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://185.156.73.98/success?substr=mixsix&s=three&sub=none3jsu3jjo3jz03jer3jo.schemedllretrieveencodedobjectwcontextdllcreateobjectcontexthost:" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0nf:8" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/prod3j/moceraut_2010-06-23.crl0z>http://www.microsoft.com/pki/certs3jroaut_2010-06-23.crt07ya'4>@6t+a6" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "https://csp.withgoogle.com/csp/scaffolding/sytroprc:52:0cross-origin-opener-policy-report-only:" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "https://csp.withgoogle.com/csp/report-to/scaffolding/sytroprc:52:0" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "https://csp.withgoogle.com/csp/report-to/cacerts" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "https://csp.withgoogle.com/csp/caotjjsss-origin-resource-policy:" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/9uvbn0w5e64" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "http://c.pki.goog/wr2/9uvbn0wej.c4" - Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found URL "https://www.realvnc.com/forgot-password?email=%shttps://www.realvnc.com/legal/" - Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found URL "https://www.realvnc.com/legal/" - Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found URL "https://www.realvnc.com/sign-upforgotbtnpasswordedtemailedtuisigninpage..\..\..\libs\licwiz\uinosigninpage.cxx..\..\..\libs\licwiz\uichooseauthpage.cxxoptionslytuichooseauthpage..\..\..\libs\licwiz\uinochooseauthpage.cxxhttps://www.realvnc.com/securityuinochooseauthpage0123456789..\..\..\libs\licwiz\uiauthcodepage.cxxcodeedituientercodepage..\..\..\libs\licwiz\uichooseteampage.cxxlistuichooseteampage..\..\..\libs\licwiz\uichooseplanpage.cxxhomerdoprofessionalrdoenterpriserdohttps://www.realvnc.com/pricinguichooseplanpage..\..\..\libs\licwiz\uimanuallicensepage.cxxloc(url_licensing)https://www.realvnc.com/docs/faq/join-computer.htmlkeyedituimanuallicensepagepasswordconfirmedt..\..\..\libs\licwiz\uispecifypasswordpage.cxxuispecifypasswordpage..\..\..\libs\licwiz\uiaddtoteampage.cxx%i/%iinfolytnoofcomputerstxtteamnametxtlbllytteaminfolytdirectandcloudrdodirectonlyrdouiaddtoteampage..\..\..\libs\licwiz\uioutofslotspage.cxxhttps://www.realvnc.com/teams/%s/computersuioutofslotspage..\..\..\libs\licwiz\uidonepage.cxxconnectivitytxttrialendstxtplannametxtapp://%s" - Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found URL "https://retrying" - Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found URL "https://www.realvnc.com/docs/%.3s/foss.html6.0.1.23971https://www.realvnc.com%s" - Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found URL "https://www.realvnc.com" - Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found URL "https://www.realvnc.com" - Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found URL "https://www.realvnc.com.

klicken" - Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found URL "https://www.realvnc.com.copyright" - Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found URL "https://hb-a.services.vnc.com:443/bootstrap/1.2/configuration=https://hb-b.services.vnc.com:443/bootstrap/1.2/configuration=https://hb-c.services.vnc.com:443/bootstrap/1.2/configurationbtp/config-countbtp/initial-discovery-uribtp/max-age-secsabtp/max-backoff-secs!any/signed-data-signaturevendorcfg.certificatescertificatesvnc/pem-certificate-----begin" - Source: "00000000-00004780.00000003.313232.01309000.00000002.mdmp") Found URL "http://invalid" - Source: "00000000-00005104.00000001.302819.00980000.00000040.mdmp") Found URL "http://invalid" - Source: "00000000-00005104.00000001.302819.009E0000.00000004.mdmp")59:T8db,Found string "T /r/r1.crl HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004780.00000000.303075.00300000.00000004.mdmp, 00000000-00004780.00000001.304995.00300000.00000004.mdmp, 00000000-00004780.00000002.306919.00300000.00000004.mdmp, 00000000-00004780.00000003.313232.00300000.00000004.mdmp") Found string "nload?id=1YBVIDkZgygNfUU2rbJXXCYdrzay5rMdY&export=download&authuser=0&confirm=t HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004780.00000000.303075.00300000.00000004.mdmp, 00000000-00004780.00000001.304995.00300000.00000004.mdmp, 00000000-00004780.00000002.306919.00300000.00000004.mdmp, 00000000-00004780.00000003.313232.00300000.00000004.mdmp") Found string "/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCF9JCsde%2FXjQrTM033%2FMEh HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004780.00000000.303075.00300000.00000004.mdmp") Found string "T /wr2/9UVbN0w5E6Y.crl HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp, 00000000-00004780.00000001.304995.00B40000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp, 00000000-00004780.00000001.304995.00B40000.00000004.mdmp, 00000000-00004780.00000002.306919.00B40000.00000004.mdmp, 00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found string "GET /success?substr=mixsix&s=three&sub=none HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp, 00000000-00004780.00000001.304995.00B40000.00000004.mdmp, 00000000-00004780.00000002.306919.00B40000.00000004.mdmp, 00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found string "%s %s HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "Issuing request "%s %s HTTP/1.1" to %s [%p]" (Indicator: "HTTP/1.1"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "CONNECT %s:%d HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp")5a:T7c8,Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00004780.00000000.303075.00300000.00000004.mdmp, 00000000-00004780.00000002.306919.00300000.00000004.mdmp, 00000000-00004780.00000003.313232.00300000.00000004.mdmp") Found string "+ncalrpc:[OLE838AE75AEAE7476E95A4B1CA1756]" (Indicator: "ncalrpc"; Source: "00000000-00004780.00000000.303075.00300000.00000004.mdmp, 00000000-00004780.00000002.306919.00300000.00000004.mdmp, 00000000-00004780.00000003.313232.00300000.00000004.mdmp") Found string "+ncalrpc:[OLEEEC7A7B408CD40A7AF6D56FCA1F6]" (Indicator: "ncalrpc"; Source: "00000000-00004780.00000000.303075.00300000.00000004.mdmp") Found string "I+ncalrpc:[OLE6FD1BF4C5C08416D99F40C28B6E4]" (Indicator: "ncalrpc"; Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp, 00000000-00004780.00000001.304995.00B40000.00000004.mdmp, 00000000-00004780.00000002.306919.00300000.00000004.mdmp, 00000000-00004780.00000002.306919.00B40000.00000004.mdmp, 00000000-00004780.00000003.313232.00300000.00000004.mdmp, 00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found string "+ncalrpc:[OLE6FD1BF4C5C08416D99F40C28B6E4]" (Indicator: "ncalrpc"; Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp, 00000000-00004780.00000002.306919.00B40000.00000004.mdmp, 00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found string "ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00004780.00000001.304995.00300000.00000004.mdmp") Found string "+ncalrpc:[OLE2E75E6995D444DE3951EF42C329A]" (Indicator: "ncalrpc"; Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found string "A+ncalrpc:[OLE2E75E6" (Indicator: "ncalrpc"; Source: "00000000-00004780.00000002.306919.00B40000.00000004.mdmp") Found string "+ncalrpc:[OLE921DB1262A3E44E4A6D607F5798B]" (Indicator: "ncalrpc"; Source: "00000000-00004780.00000003.313232.00B40000.00000004.mdmp")5b:Ta19,Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00004780.00000000.303075.00300000.00000004.mdmp, 00000000-00004780.00000000.303075.00B40000.00000004.mdmp, 00000000-00004780.00000001.304995.00300000.00000004.mdmp, 00000000-00004780.00000001.304995.00B40000.00000004.mdmp, 00000000-00004780.00000002.306919.00300000.00000004.mdmp, 00000000-00004780.00000002.306919.00B40000.00000004.mdmp, 00000000-00004780.00000003.313232.00300000.00000004.mdmp, 00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found string ":\Windows\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00004780.00000000.303075.00300000.00000004.mdmp, 00000000-00004780.00000001.304995.00300000.00000004.mdmp, 00000000-00004780.00000002.306919.00300000.00000004.mdmp, 00000000-00004780.00000003.313232.00300000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00004780.00000000.303075.00300000.00000004.mdmp, 00000000-00004780.00000001.304995.00300000.00000004.mdmp, 00000000-00004780.00000002.306919.00300000.00000004.mdmp, 00000000-00004780.00000003.313232.00300000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp, 00000000-00004780.00000001.304995.00B40000.00000004.mdmp, 00000000-00004780.00000002.306919.00B40000.00000004.mdmp, 00000000-00004780.00000003.313232.00B40000.00000004.mdmp") file/memory contains long string with (Indicator: "kerberos"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "e comme une correspondance. Ce mode est utile si vous utilisez Kerberos avec NIS, mais n'est pas n" (Indicator: "kerberos"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "cessaire si vous utilisez Kerberos avec LDAP." (Indicator: "kerberos"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "til cuando se utiliza Kerberos con NIS, pero no deber" (Indicator: "kerberos"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "a ser necesaria para Kerberos con LDAP." (Indicator: "kerberos"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "tzlich, wenn Kerberos zusammen mit NIS verwendet wird. F" (Indicator: "kerberos"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "r Kerberos mit LDAP sollte dies jedoch nicht erforderlich sein." (Indicator: "kerberos"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp")5c:Tf90,"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "FindFirstFileW" with parameter %TEMP%\*.* (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "FindNextFileW" with parameter 10D5CC3F-71C4-40D7-8173-E990C25C1412.Diagnose.Admin.0.etl (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "FindNextFileW" with parameter 1df892bc-2ec3-4d0e-ac47-1eabbc40bce1.tmp (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "FindNextFileW" with parameter 8578e504-fb9e-4973-8218-da2b499cb57d.tmp (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "FindNextFileW" with parameter 99F9947D-30DB-4640-92C7-6BB2A24B05F1.Diagnose.Admin.0.etl (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "FindNextFileW" with parameter a881a3c9-dc11-47c4-9cf5-94257bfac790.tmp (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "FindNextFileW" with parameter AA7D7BE8-CE8F-4570-A39C-1992F0466AAE.Diagnose.Admin.0.etl (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "FindNextFileW" with parameter AdobeARM.log (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "FindNextFileW" with parameter AdobeARM_NotLocked.log (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "FindNextFileW" with parameter AdobeSFX.log (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "FindNextFileW" with parameter Adobe_ADMLogs (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "FindNextFileW" with parameter ASPNETSetup_00001.log (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "FindNextFileW" with parameter ASPNETSetup_00002.log (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "FindNextFileW" with parameter c278146c-ed5a-46a3-b7ee-8da417122e54.tmp (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "FindNextFileW" with parameter ccversion.tag (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "FindNextFileW" with parameter chromesetup.msi (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "FindNextFileW" with parameter chrome_installer.log (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "FindNextFileW" with parameter CVR640E.tmp.cvr (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "FindNextFileW" with parameter CVR78E9.tmp.cvr (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "FindNextFileW" with parameter CVRC166.tmp.cvr (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "FindNextFileW" with parameter CVRE8FB.tmp.cvr (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "FindNextFileW" with parameter dat17FA.tmp (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "FindNextFileW" with parameter dat17FB.tmp (UID: 00000000-00005104) "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe" called "FindNextFileW" with parameter dat2336.tmp (UID: 00000000-00005104)5d:Tefd,Found string "ECDSA_P256" (Indicator: "ecdsa"; Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp, 00000000-00004780.00000001.304995.00B40000.00000004.mdmp, 00000000-00004780.00000002.306919.00B40000.00000004.mdmp, 00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004780.00000000.303075.00B40000.00000004.mdmp, 00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000001.304995.00B40000.00000004.mdmp, 00000000-00004780.00000002.306919.00B40000.00000004.mdmp, 00000000-00004780.00000003.313232.00B40000.00000004.mdmp") Found string "128-bit AES encryption" (Indicator: "aes"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "256-bit AES encryption" (Indicator: "aes"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "Chiffrement AES 128 bits" (Indicator: "aes"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "Chiffrement AES 256 bits" (Indicator: "aes"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "Cifrado AES de 128 bits" (Indicator: "aes"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "Cifrado AES de 256 bits" (Indicator: "aes"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "128-Bit-AES-Verschl" (Indicator: "aes"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "256-Bit-AES-Verschl" (Indicator: "aes"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "Private key is not an ECDSA key" (Indicator: "ecdsa"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "Certificate public key is not an ECDSA key" (Indicator: "ecdsa"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "rfb_security_128_AES" (Indicator: "aes"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "rfb_security_256_AES" (Indicator: "aes"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "mbedtls_ecdsa_sign_det" (Indicator: "ecdsa"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "Error: Base64 decode output buffer is too small" (Indicator: "base64"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "Error: Base64-string contains an illegal character" (Indicator: "base64"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "Warning: Base64-string is truncated" (Indicator: "base64"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "Warning: Base64-string length is not a multiple of 4" (Indicator: "base64"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "BASE64 - Invalid character in input" (Indicator: "base64"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "BASE64 - Output buffer too small" (Indicator: "base64"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "AES - Invalid data input length" (Indicator: "aes"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "AES - Invalid key length" (Indicator: "aes"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "PK - Type mismatch, eg attempt to encrypt with an ECDSA key" (Indicator: "ecdsa"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "The CRL is signed with an unacceptable PK alg (eg RSA vs ECDSA)." (Indicator: "ecdsa"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp")5e:Tc31,Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetDCOrgEx" (Indicator: "GetDC"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "CreateCompatibleBitmap() failed" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetDC/GetWindowDC failed" (Indicator: "GetDC"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetDC/GetWindowDC failed" (Indicator: "GetWindowDC"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "CreateCompatibleDC failed" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "CreateDC failed for %s" (Indicator: "CreateDC"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp")5f:T782,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "FindFirstFile" (Indicator: "FindFirstFile"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "FindNextFile" (Indicator: "FindNextFile"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp")60:Tf0b,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp")61:Tc9c,Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "RegNotifyChangeKeyValue" (Indicator: "RegNotifyChangeKeyValue"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp") Found reference to API "RegNotifyChangeKeyValue" (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "RegQueryValueEx" (Indicator: "RegQueryValue"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "RegEnumKey/Value" (Indicator: "RegEnumKey"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "RegQueryInfoKey" (Indicator: "RegQueryInfoKey"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "RegOpenKeyEx" (Indicator: "RegOpenKey"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp")62:T608,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp")63:T11a5,Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp") Found reference to API "GetFileInformationByHandle failed opening file "%s"" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp")64:T73f,Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetKeyNameTextA" (Indicator: "GetKeyNameText"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "VkKeyScanExA" (Indicator: "VkKeyScan"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "VkKeyScanExW" (Indicator: "VkKeyScan"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "VkKeyScanExA" (Indicator: "VkKeyScan"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "VkKeyScanExW" (Indicator: "VkKeyScan"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp")65:T4bd,Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetModuleFileName" (Indicator: "GetModuleFileName"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp")66:Tc57,Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetUserName failed" (Indicator: "GetUserName"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetTokenInformation(data)" (Indicator: "GetTokenInformation"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetTokenInformation(length)" (Indicator: "GetTokenInformation"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "LookupAccountSid(names) failed" (Indicator: "LookupAccountSid"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "LookupAccountSid(lengths) failed" (Indicator: "LookupAccountSid"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "LookupAccountName" (Indicator: "LookupAccountName"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp")67:Tdf6,Found string "licWiz_specify_password_password" (Indicator: "password"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "licWiz_specify_password_header" (Indicator: "password"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "Specify VNC password" (Indicator: "password"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "licWiz_specify_password_desc2" (Indicator: "password"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "This password should have a minimum of 6 characters and be difficult to guess. It should not be the same as your RealVNC account password." (Indicator: "password"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "licWiz_specify_password_desc1" (Indicator: "password"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "You must specify a password to prevent unauthorized remote access to this computer." (Indicator: "password"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "licWiz_specify_password_confirm" (Indicator: "password"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "Confirm password" (Indicator: "password"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "licWiz_page_password_edit" (Indicator: "password"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "licWiz_page_forgot_password_link" (Indicator: "password"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "Forgot password?" (Indicator: "password"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "stateData->password" (Indicator: "password"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "https://www.realvnc.com/forgot-password?email=%s" (Indicator: "password"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "passwordEdt" (Indicator: "password"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "passwordConfirmEdt" (Indicator: "password"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "The account password has been changed; re-authentication required" (Indicator: "password"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "The password does not meet the minimum requirements" (Indicator: "password"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "Expected password" (Indicator: "password"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "Expected secret" (Indicator: "secret"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "cloud/principal-password" (Indicator: "password"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "cloud/my-secret" (Indicator: "secret"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "Authenticated password, second factors required..." (Indicator: "password"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "The account password has changed." (Indicator: "password"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp")68:T484,Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "RegDeleteKeyEx" (Indicator: "RegDeleteKey"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "RegDeleteValue" (Indicator: "RegDeleteValue"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "RegDeleteKey" (Indicator: "RegDeleteKey"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "RegDeleteKeyEx not available and view is not default" (Indicator: "RegDeleteKey"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp")69:T408,Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp")6a:T1081,Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetSecurityDescriptorLength" (Indicator: "GetSecurityDescriptorLength"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "MakeSelfRelativeSD" (Indicator: "MakeSelfRelativeSD"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "SetSecurityDescriptorSacl" (Indicator: "SetSecurityDescriptorSacl"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "CopySid" (Indicator: "CopySid"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "CopySid failed" (Indicator: "CopySid"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetTokenInformation(data)" (Indicator: "GetTokenInformation"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "GetTokenInformation(length)" (Indicator: "GetTokenInformation"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp")6b:T4f1,Observed string: "shutdown" (Indicator: "shutdown") in Source: 01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe Observed string: "Shutdown error: %s" (Indicator: "shutdown ") in Source: 00000000-00004780.00000003.313232.01290000.00000002.mdmp Observed string: "shutdown %p, flush %d (tellHandler %d)" (Indicator: "shutdown ") in Source: 00000000-00004780.00000003.313232.01290000.00000002.mdmp Observed string: "shutdown complete %p" (Indicator: "shutdown ") in Source: 00000000-00004780.00000003.313232.01290000.00000002.mdmp Observed string: "shutdown completed by FdManager dtor %p (fd=%d)" (Indicator: "shutdown ") in Source: 00000000-00004780.00000003.313232.01290000.00000002.mdmp Observed string: "shutdown %p (fd=%d), flush %s (tellHandler %s)" (Indicator: "shutdown ") in Source: 00000000-00004780.00000003.313232.01290000.00000002.mdmp Observed string: "shutdown complete %p (fd=%d)" (Indicator: "shutdown ") in Source: 00000000-00004780.00000003.313232.01290000.00000002.mdmp Observed string: "shutdown completed" (Indicator: "shutdown ") in Source: 00000000-00004780.00000003.313232.01290000.00000002.mdmp Observed string: "shutdown" (Indicator: "shutdown") in Source: 00000000-00005104.00000000.301945.00401000.00000020.mdmp6c:T62e,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp")6d:Tc44,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: svchost015.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: svchost015.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: svchost015.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: svchost015.exe] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: svchost015.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: svchost015.exe] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: svchost015.exe] Observed import api "GetSecurityDescriptorLength" which can "return the length in bytes of a structurally valid security descriptor" [Source: svchost015.exe] Observed import api "GetSidIdentifierAuthority" which can "return a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: svchost015.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: svchost015.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: svchost015.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: svchost015.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: svchost015.exe] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: svchost015.exe] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: svchost015.exe] Observed import api "MakeSelfRelativeSD" which can "create a security descriptor in self-relative format by using a security descriptor in absolute format as a template" [Source: svchost015.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: svchost015.exe] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: svchost015.exe] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: svchost015.exe] Observed import api "SetSecurityDescriptorSacl" which can "set information in a system access control list (SACL)" [Source: svchost015.exe]6e:Tc2d,"svchost015.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "svchost015.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "svchost015.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "svchost015.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "svchost015.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "svchost015.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "svchost015.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "HELPERDLLNAME"; Value: "") "svchost015.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "svchost015.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "svchost015.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "svchost015.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "svchost015.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "svchost015.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPV6DOMAIN"; Value: "") "svchost015.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "svchost015.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "svchost015.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "svchost015.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "svchost015.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")6f:T831,Dropped file: "9C69E496D546F49A980D7350EC49A180" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\9C69E496D546F49A980D7350EC49A180]- [targetUID: 00000000-00004780] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00004780] Dropped file: "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00004780] Dropped file: "05DDC6AA91765AACACDB0A5F96DF8199" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199]- [targetUID: 00000000-00004780] Dropped file: "C02877841121CC45139CB51404116B25_79CC29E1F7D035B115276DC794FE8DD4" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\C02877841121CC45139CB51404116B25_79CC29E1F7D035B115276DC794FE8DD4]- [targetUID: 00000000-00004780] Dropped file: "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA]- [targetUID: 00000000-00004780] Dropped file: "C02877841121CC45139CB51404116B25_79CC29E1F7D035B115276DC794FE8DD4" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\C02877841121CC45139CB51404116B25_79CC29E1F7D035B115276DC794FE8DD4]- [targetUID: 00000000-00004780] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00004780] Dropped file: "9C69E496D546F49A980D7350EC49A180" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\9C69E496D546F49A980D7350EC49A180]- [targetUID: 00000000-00004780] Dropped file: "05DDC6AA91765AACACDB0A5F96DF8199" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199]- [targetUID: 00000000-00004780]70:T45f,Found string "No route to host." (Indicator: "route"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found string "Resolving hostname %s." (Indicator: "hostname"; File: "01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe") Found string "%s: duplicate hostname %s" (Indicator: "hostname"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "%s: new hostname %s" (Indicator: "hostname"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "No route to the host is known" (Indicator: "route"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "Route vers l'h" (Indicator: "route"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "Es ist keine Route zum Host bekannt" (Indicator: "route"; Source: "00000000-00004780.00000003.313232.01290000.00000002.mdmp") Found string "Resolving hostname %s." (Indicator: "hostname"; Source: "00000000-00005104.00000000.301945.017E0000.00000004.mdmp, 00000000-00005104.00000001.302819.017E0000.00000004.mdmp")71:T59f,RegOpenKeyExA RegCloseKey UnhandledExceptionFilter LoadLibraryA Sleep LoadLibraryExA GetCommandLineA GetProcAddress GetFileSize GetModuleHandleA GetTempPathA CreateThread GetSystemInfo GetVersionExA VirtualAlloc WriteFile GetModuleFileNameA CreateFileA LockResource GetStartupInfoA FindResourceA FindFirstFileA GetTickCount GetLastActivePopup GetWindowThreadProcessId FindWindowA GetCursorPos SetWindowsHookExA GetClipboardData OpenProcessToken CreateProcessAsUserW RegOpenKeyExW RegDeleteValueW RegDeleteKeyW SetSecurityDescriptorDacl RegEnumKeyExW GetUserNameW RegCreateKeyExW LookupAccountNameW CreateDirectoryW GetCommandLineW FindNextFileW GetFileAttributesExW CreateFileW GetModuleHandleW GetFileAttributesW FindFirstFileW GetSystemDirectoryW LoadLibraryW OutputDebugStringW CreateFileMappingW CreateProcessW GetModuleFileNameW GetComputerNameW IsDebuggerPresent OpenProcess FindResourceW MapViewOfFile GetSystemDirectoryA TerminateProcess GetVersionExW ConnectNamedPipe DeleteFileW ShellExecuteW SetWindowsHookExW bind WSASocketW WSAStartup closesocket send recv accept socket RegCreateKeyExA GetNativeSystemInfo FindFirstFileExW GetModuleHandleExW LoadLibraryExW GetStartupInfoW OutputDebugStringA GetFileSizeEx VirtualProtect CreateDirectoryA InternetCloseHandle HttpQueryInfoA InternetReadFile InternetConnectA HttpSendRequestA InternetOpenA72:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8ACzERERERERAAAAAAAAAAAAu7MzMzMzEQAAAAAAAAAAAIiIszMzMzEAAAAAAAAAAAADMzMzMzEQAAAAAAAAAAAACIiIi7u7EAAAAAAAAAAAAAADMzMzMxAARERAAAAAAAAACLu7OxAARGdnZEAAAAAAAAi7uzMQBHZ2dmdkAAAAAAAIiLszECJnZ2Z2dkAAAAAAALu7MxAnd3Z2J2dAAAAAAAC7uzMXd3d3IiZ2ZAAAAAAAiIuzF3d3dyInZ2QAAAAAAAu7szGHdyIiJnZkAAAAAAALu7Mxh3ciIiJmZAAAAAAACIi7MYd3cidyIiQAAAAAAACLuzMY93ciciIkAAAAAAAAi7szGH93ciIiQAAAAAAAAIiLsxcndyIvsEAAAAAAAAALu7MxcndyIvsAAAAAAAAACIizMXInd3JLsAAAAAAAAACIuzEAIiIgALsAAAAAAAAAiLszEAAAAAALsAAAAAAAAAiLsxAAAAAAu7sAAAAAAAAIi7MxAAAAu7u7twAAAAAAALuzMxAAALu7sAALMzMzMzO7szMQAAALu7AAC7MzMzMzO7szMAAAC7u7AAu7MzMzO7u7szAAAAC7u7AIu7u7u7u4i7swAAAAC7u7iLiIiIiIiIi7MAAAAAu7uwiIiIiIiIiIi7AAAAAAu7AAAAAAAAAAAAAAAAAAAAsACAAf//gAH//4AB///AA///wAP///ADg//wDgD/8AwAf/AIAD/4CAA/+AAAH/gAAB/8AAAf/AAAH/wAAB/+AAAf/gAAP/4AAD//AAA//wAAH/+Bg4//gP/H/8D8A//AfgH/4D4PAAA/BwAAPwMAAD+BAAA/wAAAP8EAAD/j////9w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791019580799,"unified_at":"2026-10-03T09:26:20.799Z","metadata":{"hashes":{"sha256":"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231","sha1":"21361b4c9f9023e946aaf4454ff311c4ae108877","md5":"f886224fcae94f279e57866ebe25ea2a","sha512":"eee4406f1e721b68cd79597df040e12e51a1298e32e190ad174f9448256bd8d5f6f8add2f6be76ece3501e763e481f84c59f8568d17aec996643e782e49adf2a","ssdeep":"49152:SXQv8RSHRx848ClwDNwMHjpLZPDBw9+N0fTZm1WEnuRJgZuE:Sg0QiCM/pVBg5LZmDn4m","ssdeep_chunks":["49152:SXQv8RS","49152:XQv8RSH","49152:Qv8RSHR","49152:v8RSHRx","49152:8RSHRx8","49152:RSHRx84","49152:SHRx848","49152:HRx848C","49152:Rx848Cl","49152:x848Clw","49152:848ClwD","49152:48ClwDN","49152:8ClwDNw","49152:ClwDNwM","49152:lwDNwMH","49152:wDNwMHj","49152:DNwMHjp","49152:NwMHjpL","49152:wMHjpLZ","49152:MHjpLZP","49152:HjpLZPD","49152:jpLZPDB","49152:pLZPDBw","49152:LZPDBw9","49152:ZPDBw9+","49152:PDBw9+N","49152:DBw9+N0","49152:Bw9+N0f","49152:w9+N0fT","49152:9+N0fTZ","49152:+N0fTZm","49152:N0fTZm1","49152:0fTZm1W","49152:fTZm1WE","49152:TZm1WEn","49152:Zm1WEnu","49152:m1WEnuR","49152:1WEnuRJ","49152:WEnuRJg","49152:EnuRJgZ","49152:nuRJgZu","49152:uRJgZuE","98304:SXQv8RS","98304:XQv8RSH","98304:Qv8RSHR","98304:v8RSHRx","98304:8RSHRx8","98304:RSHRx84","98304:SHRx848","98304:HRx848C","98304:Rx848Cl","98304:x848Clw","98304:848ClwD","98304:48ClwDN","98304:8ClwDNw","98304:ClwDNwM","98304:lwDNwMH","98304:wDNwMHj","98304:DNwMHjp","98304:NwMHjpL","98304:wMHjpLZ","98304:MHjpLZP","98304:HjpLZPD","98304:jpLZPDB","98304:pLZPDBw","98304:LZPDBw9","98304:ZPDBw9+","98304:PDBw9+N","98304:DBw9+N0","98304:Bw9+N0f","98304:w9+N0fT","98304:9+N0fTZ","98304:+N0fTZm","98304:N0fTZm1","98304:0fTZm1W","98304:fTZm1WE","98304:TZm1WEn","98304:Zm1WEnu","98304:m1WEnuR","98304:1WEnuRJ","98304:WEnuRJg","98304:EnuRJgZ","98304:nuRJgZu","98304:uRJgZuE","49152:Sg0QiCM","49152:g0QiCM/","49152:0QiCM/p","49152:QiCM/pV","49152:iCM/pVB","49152:CM/pVBg","49152:M/pVBg5","49152:/pVBg5L","49152:pVBg5LZ","49152:VBg5LZm","49152:Bg5LZmD","49152:g5LZmDn","49152:5LZmDn4","49152:LZmDn4m"],"imphash":"c85df4bfb526d5f0aabf5fbd3dd22def"},"file_info":{"file_name":"SecuriteInfo.com.Trojan.DownLoader48.41005.29979.907.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":5022496,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1751505622000,"last_seen":1751984305000,"last_multi_scan":1751984305000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["mixloader","commodity","criminal","loader","downloader","evasive"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":88},"sandbox_signatures":{"informative_count":221,"suspicious_count":19,"malicious_count":5,"total":245},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.GenKryptik","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.GenKryptik","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Kryptik.wqhkf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.76769713","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Egairtigado_rfn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.76769713 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/GenKryptik.HKDK trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"TrojanPSW.Tepfer.gen.xnqu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Malware.Win32.Gen.tr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/GCleaner.i","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005c9b4e1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Tepfer.kynvke","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Delf-HQC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Agent.KMX.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.DelphGen.ILI","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_43.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Resource Development","technique":"Digital Certificates","attack_id":"T1588.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1588/004","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"},{"type":"suspicious","value":"Contains ability to update the user profile"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Contains reference to Hijacked CLSID(s)"},{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"informative","value":"Contains reference to messaging system library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Defense Evasion","technique":"Clear Persistence","attack_id":"T1070.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/009","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"suspicious","value":"Looks up many procedures within the same disassembly stream (often used to hide usage)"},{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve keyboard strokes"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Imports DsRoleGetPrimaryDomainInformation API"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Found registry location string related to BIOS"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve state data for the computer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an APIs used to retrieve process information"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"},{"type":"informative","value":"Imports network management related APIs"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"suspicious","value":"Contains ability to read clipboard data"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"GETs files from a webserver"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"suspicious","value":"YARA signature match – Public-private key pair"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"malicious","value":"Able to use RSA keys for encryption and decryption"},{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Shows ability to use asymmetric encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" called \"FindResourceA\" with parameter \"25044896\" - (UID: 00000000-00005104)\n \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" called \"FindResourceA\" with parameter \"4631872\" - (UID: 00000000-00005104)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4704976'}\" (UID: 00000000-00005104)\n \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4704464'}\" (UID: 00000000-00005104)\n \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" called \"LoadResource with parameter {'hModule': '1981612032', 'hResInfo': '9373168'}\" (UID: 00000000-00005104)\n \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4704848'}\" (UID: 00000000-00005104)\n \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4704160'}\" (UID: 00000000-00005104)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to inject code into another process (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004780.00000001.304995.0041D000.00000002.mdmp\")\n Found reference to API \"RegSetValueEx\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005104.00000001.302819.00980000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005104.00000001.302819.009E0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found string - \\\\.\\pipe\\; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Tries to map intranet network resources to internet zone","description":"\"svchost015.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API ImageList_WriteEx@COMCTL32.DLL at 00000000-00005104-19463-1990-0043FEE8\n Found reference to API InitializeFlatSB@COMCTL32.DLL at 00000000-00005104-19463-4290-004285F8","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"BSS\" is zero\n Raw size of \".tls\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2c","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004780.00000001.304995.0041D000.00000002.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2f","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$30","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use asymmetric encryption algorithm","description":"The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Possibly contains Public/Private key (encryption)","origin":"Indicator Combinations","mitre_attack_id":"T1573.002","relevance":1,"id":"summary-33","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to create a new HTTP request (API string)\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Contains ability to create a HTTP or FTP session (API string)\n Matched sigs: Contacts server\n Matched sigs: Contacts domains\n Matched sigs: Spawned process connects to a network","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$31","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetUserGeoID\" (Indicator: \"getusergeoid\"; Source: \"00000000-00005104-00000C2B-3725972361\")\n Found reference to API \"GetGeoInfoW\" (Indicator: \"getgeoinfo\"; Source: \"00000000-00005104-00000C2B-3725973141\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005104-00000C2B-3726029308\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"GetAddrInfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00005104)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005104)\n \"svchost015.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004780)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" called \"RtlGetVersion\" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005104)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005104)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: svchost015.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00005104-19463-1566-0042CDB0\n GetTickCount@KERNEL32.DLL at 00000000-00005104-19463-1819-00439D38\n GetTickCount@KERNEL32.DLL at 00000000-00005104-19463-2098-00448E64\n GetTickCount@KERNEL32.DLL at 00000000-00005104-19463-2099-004069D8\n GetTickCount@KERNEL32.DLL at 00000000-00005104-19463-3452-00457A08","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileA@KERNEL32.DLL at 00000000-00005104-19463-47-004051CC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00000000-00005104-19463-912-00409854","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.DLL at 00000000-00005104-19463-944-0040BD4C\n GetVersion@KERNEL32.DLL at 00000000-00005104-19463-1949-0043D6CC\n GetVersion@KERNEL32.DLL at 00000000-00005104-19463-2004-00441A84","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoA@KERNEL32.DLL at 00000000-00005104-19463-46-00405384\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00005104-19463-702-0040ADD4\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00005104-19463-705-0040AD88\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00005104-19463-715-0040C430\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00005104-19463-872-00405C7C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00000000-00005104-19463-897-00408554","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005104.00000000.301945.00401000.00000020.mdmp\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"svchost015.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set Size Exceeded.*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)\" (Indicator: \"set \"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"GetDynamicTimeZoneInformation\" (Indicator: \"GetDynamicTimeZoneInformation\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"NetServerGetInfo\" (Indicator: \"NetServerGetInfo\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"NetServerGetInfo\" (Indicator: \"NetServerGetInfo\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetKeyboardLayoutList@USER32.DLL at 00000000-00005104-19463-1752-0044F3C8\n GetKeyboardLayout@USER32.DLL at 00000000-00005104-19463-1934-0044EF2C\n GetKeyboardType@USER32.DLL at 00000000-00005104-19463-2576-00402E2F\n GetKeyboardType@USER32.DLL at 00000000-00005104-19463-4817-00402F5E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"GetKeyboardType\" (Indicator: \"GetKeyboardType\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"GetKeyboardType\" (Indicator: \"GetKeyboardType\"; Source: \"00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: 01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\n \"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: 00000000-00005104.00000000.301945.00401000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to BIOS","description":"Observed string: \"HARDWARE\\DESCRIPTION\\System\\BIOS\" (Indicator: \"hardware\\description\\system\\bios\") in Source: 00000000-00004780.00000003.313232.01290000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-350","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 0004h\" and \"setnb byte ptr [0046FB18h]\" at 00000000-00005104-19463-1949-0043D6CC\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 0004h\" and \"jc 00441C3Ah\" at 00000000-00005104-19463-2004-00441A84","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"svchost015.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"svchost015.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" called \"CreateProcessA\" with parameter \"%TEMP%\\svchost015.exe\" - (UID: 00000000-00005104)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3e","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ocsp.pki.goog\"\n \"c.pki.goog\"\n \"o.pki.goog\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"142.251.35.161:443\"\n \"142.251.40.131:80\"\n \"185.156.73.98:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT ChassisTypes FROM Win32_SystemEnclosure\" (Source: 00000000-00004780.00000003.313232.01290000.00000002.mdmp, Indicator: \"select chassistypes from win32_systemenclosure\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004780.00000001.304995.0041D000.00000002.mdmp\")\n Found reference to API \"CreateDirectory failed for %s\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00004780.00000001.304995.0041D000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyEx\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"SetTimer at 00000000-00005104-19463-490-00429E94\n Sleep@KERNEL32.DLL at 00000000-00005104-19463-750-00407A68\n WaitForSingleObject@KERNEL32.DLL at 00000000-00005104-19463-759-0040CD8C\n WaitForSingleObject@KERNEL32.DLL at 00000000-00005104-19463-762-0040CD9C\n WaitForSingleObject@KERNEL32.DLL at 00000000-00005104-19463-1314-0041C4A0\n Sleep@KERNEL32.DLL at 00000000-00005104-19463-1566-0042CDB0\n SetTimer at 00000000-00005104-19463-1711-00452084\n WaitForSingleObject@KERNEL32.DLL at 00000000-00005104-19463-1714-0044FF1C\n Sleep@KERNEL32.DLL at 00000000-00005104-19463-2098-00448E64\n WaitForSingleObject@KERNEL32.DLL at 00000000-00005104-19463-2241-0044FE08","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: svchost015.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: svcF6C.tmp)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExA@KERNEL32.DLL at 00000000-00005104-19463-46-00405384\n LoadLibraryA@KERNEL32.DLL at 00000000-00005104-19463-79-00454CFC\n LoadLibraryA@KERNEL32.DLL at 00000000-00005104-19463-699-0040D037\n LoadLibraryA@KERNEL32.DLL at 00000000-00005104-19463-1507-00428C20\n LoadLibraryA@KERNEL32.DLL at 00000000-00005104-19463-1922-0043D09C\n LoadLibraryA@KERNEL32.DLL at 00000000-00005104-19463-3743-00406222","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"ShellExecute(open, %s) failed [%s]\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"ShellExecute(runas) failed [%s]. Relaunching directly.\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Contains reference to messaging system library (API string)","description":"Found string \"MAPI32.DLL\" (Indicator: \"MAPI32.dll\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found string \"MAPI32.DLL\" (Indicator: \"MAPI32.dll\"; Source: \"00000000-00005104.00000000.301945.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1137","relevance":1,"id":"string-571","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$44","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"svchost015.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"svcF6C.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"User-Agent: Microsoft-CryptoAPI/6.1\" (Indicator: \"user-agent: \"; Source: \"00000000-00004780.00000000.303075.00300000.00000004.mdmp, 00000000-00004780.00000000.303075.00B40000.00000004.mdmp, 00000000-00004780.00000001.304995.00300000.00000004.mdmp, 00000000-00004780.00000001.304995.00B40000.00000004.mdmp, 00000000-00004780.00000002.306919.00300000.00000004.mdmp, 00000000-00004780.00000003.313232.00300000.00000004.mdmp\")\n Found string \"User-Agent: 1\" (Indicator: \"user-agent: \"; Source: \"00000000-00004780.00000000.303075.00B40000.00000004.mdmp, 00000000-00004780.00000001.304995.00B40000.00000004.mdmp, 00000000-00004780.00000002.306919.00B40000.00000004.mdmp, 00000000-00004780.00000003.313232.00B40000.00000004.mdmp\")\n Found string \"User-Agent: %s\" (Indicator: \"user-agent: \"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$45","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$46","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"svchost015.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74ED0000\n \"svchost015.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74A90000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75F90000\n \"svchost015.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75F90000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"15001600c04e576a@advapi32.dll\"\n \"0e000f00704f576a@advapi32.dll\"\n \"0e000f00cc4f576a@advapi32.dll\"\n \"11001200b457576a@advapi32.dll\"\n \"110012004858576a@advapi32.dll\"\n \"120013008c58576a@advapi32.dll\"\n \"12001300e458576a@advapi32.dll\"\n \"140015000c80576a@advapi32.dll\"\n \"140015002480576a@advapi32.dll\"\n \"140015003c80576a@advapi32.dll\"\n \"170018005480576a@advapi32.dll\"\n \"0d000e006c80576a@advapi32.dll\"\n \"110012007c80576a@advapi32.dll\"\n \"110012009080576a@advapi32.dll\"\n \"0f001000d081576a@advapi32.dll\"\n \"140015001082576a@advapi32.dll\"\n \"140015002882576a@advapi32.dll\"\n \"0c000d007082576a@advapi32.dll\"\n \"0c000d008082576a@advapi32.dll\"\n \"0e000f009082576a@advapi32.dll\"\n \"0e000f00a082576a@advapi32.dll\"\n \"0b000c00b082576a@advapi32.dll\"\n \"18001900e884576a@RPCRT4.dll\"\n \"130014001485576a@RPCRT4.dll\"\n \"140015002885576a@RPCRT4.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" was detected as \"Borland Delphi\" and name: \"Compiler\"\n \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" was detected as \"Turbo Linker\" and name: \"Linker\"\n \"svchost015.exe\" was detected as \"Borland Delphi\" and name: \"Compiler\"\n \"svchost015.exe\" was detected as \"Turbo Linker\" and name: \"Linker\"\n \"svcF6C.tmp\" was detected as \"Borland Delphi\" and name: \"Compiler\"\n \"svcF6C.tmp\" was detected as \"Turbo Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"svchost015.exe\" touched \"WinInetBroker Class\" (Path: \"HKCU\\CLSID\\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\")\n \"svchost015.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\")\n \"svchost015.exe\" touched \"Network List Manager\" (Path: \"HKCU\\CLSID\\{A47979D2-C419-11D9-A5B4-001185AD2B89}\\LOCALSERVER32\")\n \"svchost015.exe\" touched \"NetworkListManager\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"svchost015.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"svcF6C.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" has an executable section named \"CODE\"\n \"svchost015.exe\" has an executable section named \".text\"\n \"svcF6C.tmp\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" has an writable section named \"DATA\"\n \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" has an writable section named \"BSS\"\n \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" has an writable section named \".idata\"\n \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" has an writable section named \".tls\"\n \"svchost015.exe\" has an writable section named \".data\"\n \"svcF6C.tmp\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$47","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".rsrc\" is \"0x453400\" greater than 0x100000\n Raw size of \".text\" is \"0x1df000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".rsrc\" is \"0x453400\" greater than 0x100000\n Virtual size of \".text\" is \"0x1de21e\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"svchost015.exe\" (UID: 00000000-00004780) was launched with new environment variables: \"USERDNSDOMAIN=\"HHVeuDiytO\"\"\n Process \"svchost015.exe\" (UID: 00000000-00004780) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"c.pki.goog\"\n \"drive.usercontent.google.com\"\n \"o.pki.goog\"\n \"ocsp.pki.goog\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"svchost015.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"svchost015.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"svchost015.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"svchost015.exe\" (UID: 00000000-00004780)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"svchost015.exe\" (UID: 00000000-00004780)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$48","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"svchost015.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"svcF6C.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\svchost015.exe\"\n \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\svcF6C.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"svchost015.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$4a","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"svcF6C.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 5 sections\" - Location: [%TEMP%\\svcF6C.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$4b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"\n \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\svchost015.exe\"\n \"svchost015.exe\" reads file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\57c8edb95df3f0ad4ee2dc2b8cfd4157\"\n \"svchost015.exe\" reads file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\24bd96d5497f70b3f510a6b53cd43f3e_3a89246fb90c5ee6620004f1ae0eb0ea\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to detect sandbox (imports API)\n Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Makes a code branch decision directly after an API that is environment aware\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to query volume size","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$4d","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\"\n \"svchost015.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat\"\n \"svchost015.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\"\n \"svchost015.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\"\n \"svchost015.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"svchost015.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat\"\n \"svchost015.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\"\n \"svchost015.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"svchost015.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$50","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D\"\n Found http requests in header \"GET /r/r1.crl\"\n Found http requests in header \"GET /wr2/9UVbN0w5E6Y.crl\"\n Found http requests in header \"GET /wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCF9JCsde%2FXjQrTM033%2FMEh\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00004780.00000001.304995.0041D000.00000002.mdmp\")\n Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00004780.00000001.304995.0041D000.00000002.mdmp\")\n Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00004780.00000001.304995.0041D000.00000002.mdmp\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"setsockopt(SO_RCVBUF)\" (Indicator: \"setsockopt\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"setsockopt(IPV6_PROTECTION_LEVEL)\" (Indicator: \"setsockopt\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"unable to setsockopt TCP_NODELAY: %d\" (Indicator: \"setsockopt\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00005104.00000000.301945.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00004780.00000001.304995.0041D000.00000002.mdmp\")\n Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004780.00000001.304995.0041D000.00000002.mdmp\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"www.mail.google.com0\" [Source: 00000000-00004780.00000000.303075.00B40000.00000004.mdmp\n 00000000-00004780.00000001.304995.00B40000.00000004.mdmp\n 00000000-00004780.00000002.306919.00B40000.00000004.mdmp\n 00000000-00004780.00000003.313232.00B40000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$56","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$57","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$58","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$59","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog\n\n GET /r/r1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog\n\n GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog\n\n GET /wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCF9JCsde%2FXjQrTM033%2FMEh HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: o.pki.goog\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"Contains base62 string in header \"MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V\" in header \"GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog\"\n Contains base62 string in header \"MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQ\" in header \"GET /wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCF9JCsde%2FXjQrTM033%2FMEh HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.pki.goog\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"drive.usercontent.google.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Network Related","name":"Imports network management related APIs","description":"Observed import api \"NetGetAnyDCName\" which can \"return the name of any domain controller (DC) for a domain that is directly trusted by the specified server.\" [Source: svchost015.exe]\n Observed import api \"NetUserGetGroups\" which can \"retrieve a list of global groups to which a specified user belongs.\" [Source: svchost015.exe]\n Observed import api \"NetUserGetInfo\" which can \"retrieve information about a particular user account on a server.\" [Source: svchost015.exe]\n Observed import api \"NetUserGetLocalGroups\" which can \"retrieve a list of local groups to which a specified user belongs.\" [Source: svchost015.exe]","origin":"Static Parser","mitre_attack_id":"T1087.001","relevance":1,"id":"static-85","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5182f54f9c6e99d117d9dde3fa2b4cff","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"drive.usercontent.google.com\" (83 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"142.251.35.161\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00005104\"\n YARA signature for RC4 encryption matched on process \"00000000-00004780\"\n YARA signature for RC4 encryption matched on file \"svcF6C.tmp\"\n YARA signature for RC4 encryption matched on file \"svchost015.exe\"\n YARA signature for RC4 encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00005104-00000C2B-3725933351\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00005104-00000C2B-3725934320\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$5c","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: 01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe)\n Found GetCursorPos() in an import section (Source: svchost015.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$61","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"LookupAccountName\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$62","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"$64","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve state data for the computer (API string)","description":"Found reference to API \"DsRoleGetPrimaryDomainInformation\" (Indicator: \"DsRoleGetPrimaryDomainInformation\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"DsRoleGetPrimaryDomainInformation\" (Indicator: \"DsRoleGetPrimaryDomainInformation\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-116","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$65","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00005104.00000000.301945.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00005104.00000000.301945.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005104.00000000.301945.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$66","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$67","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports DsRoleGetPrimaryDomainInformation API","description":"Observed import api \"DsRoleGetPrimaryDomainInformation\" which can \"retrieve state data for the computer\" [Source: svchost015.exe]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-89","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: svchost015.exe]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: svcF6C.tmp]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT ChassisTypes FROM Win32_SystemEnclosure\" (Indicator: \" Win32_SystemEnclosure\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigA\" (Indicator: \"changeserviceconfiga\"; Source: \"00000000-00005104-00000C2B-3726007928\")\n Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00005104-00000C2B-3726008644\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found string \"OpenProcess(%lu)\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: svchost015.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004780.00000000.303075.00300000.00000004.mdmp, 00000000-00004780.00000001.304995.00300000.00000004.mdmp, 00000000-00004780.00000002.306919.00300000.00000004.mdmp, 00000000-00004780.00000003.313232.00300000.00000004.mdmp\")\n Found string \"\\Device\\NetBT_Tcpip6_{90A066FE-591C-47F3-850D-9644B684FBA5}\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004780.00000001.304995.00B40000.00000004.mdmp, 00000000-00004780.00000002.306919.00300000.00000004.mdmp, 00000000-00004780.00000002.306919.00B40000.00000004.mdmp, 00000000-00004780.00000003.313232.00B40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004780.00000001.304995.0041D000.00000002.mdmp, 00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005104.00000000.301945.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.0046F000.00000004.mdmp, 00000000-00005104.00000001.302819.00980000.00000040.mdmp, 00000000-00005104.00000001.302819.009E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"System Security","name":"Contains reference to Hijacked CLSID(s)","description":"Observed string: \"CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\" (Indicator: \"{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\") in Source: 00000000-00004780.00000000.303075.00B40000.00000004.mdmp\n 00000000-00004780.00000001.304995.00B40000.00000004.mdmp\n 00000000-00004780.00000002.306919.00B40000.00000004.mdmp\n 00000000-00004780.00000003.313232.00B40000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":1,"id":"string-342","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"svchost015.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$6d","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" opened \"\\Device\\KsecDD\"\n \"svchost015.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$6e","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\")\n Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"svchost015.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\svchost015.exe]- [targetUID: 00000000-00005104]\n \"svcF6C.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\svcF6C.tmp]- [targetUID: 00000000-00005104]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA has high entropy\"\n \"05DDC6AA91765AACACDB0A5F96DF8199 has high entropy\"\n \"C02877841121CC45139CB51404116B25_79CC29E1F7D035B115276DC794FE8DD4 has high entropy\"","origin":"Binary File","mitre_attack_id":"T1027.013","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$6f","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found Delphi 4 - Delphi 2006 artifact","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" has a PE timestamp using the buggy magic timestamp 0x2A425E19.","origin":"Static Parser","relevance":10,"id":"static-19","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" was detected as \"BobSoft Mini Delphi -> BoB / BobSoft\"\n \"svchost015.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"svcF6C.tmp\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 47 calls to GetProcAddress@KERNEL32.DLL at 00000000-00005104-19463-1507-00428C20\n Found 11 calls to GetProcAddress@KERNEL32.DLL at 00000000-00005104-19463-1922-0043D09C\n Found 12 calls to GetProcAddress@KERNEL32.DLL at 00000000-00005104-19463-4290-004285F8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.007","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" has section name CODE with entropy \"6.5581477390684455\"\n \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" has section name .reloc with entropy \"6.665310452581819\"\n \"svchost015.exe\" has section name .text with entropy \"6.468037942904514\"\n \"svchost015.exe\" has section name .rsrc with entropy \"6.64041220474147\"\n \"svchost015.exe\" has section name .reloc with entropy \"6.606968809108304\"\n \"svcF6C.tmp\" has section name .text with entropy \"6.685497163959341\"\n \"svcF6C.tmp\" has section name .reloc with entropy \"6.492541903786824\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00000000-00005104-19463-1138-0041686C\n FindResourceA@KERNEL32.DLL at 00000000-00005104-19463-1151-00419254\n FindResourceA@KERNEL32.DLL at 00000000-00005104-19463-2591-00406081\n FreeResource@KERNEL32.DLL at 00000000-00005104-19463-4069-004192C0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"svchost015.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\svchost015.exe]- [targetUID: 00000000-00005104]\n \"svcF6C.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\svcF6C.tmp]- [targetUID: 00000000-00005104]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" wrote 37968 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\svchost015.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...\n \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" wrote 43008 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\svcF6C.tmp\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 142.251.35.161 on port 443 is sent without HTTP header\n TCP traffic to 142.251.40.131 on port 80 is sent without HTTP header\n TCP traffic to 185.156.73.98 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Public-private key pair","description":"YARA signature for public-private key pair used in process \"00000000-00004780\"\n YARA signature for public-private key pair used in file \"svchost015.exe\"","origin":"YARA Signature","mitre_attack_id":"T1573","relevance":2,"id":"yara-122","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"svchost015.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoA@USER32.DLL at 00000000-00005104-19463-1482-00427098\n SystemParametersInfoA@USER32.DLL at 00000000-00005104-19463-1483-0042716C\n SystemParametersInfoA@USER32.DLL at 00000000-00005104-19463-1484-00427240\n SystemParametersInfoA@USER32.DLL at 00000000-00005104-19463-1819-00439D38\n SystemParametersInfoA@USER32.DLL at 00000000-00005104-19463-1935-0044F708\n SystemParametersInfoA@USER32.DLL at 00000000-00005104-19463-1943-0043D038\n SystemParametersInfoA@USER32.DLL at 00000000-00005104-19463-1944-0043CFB8\n SystemParametersInfoA@USER32.DLL at 00000000-00005104-19463-2031-00443608\n SystemParametersInfoA@USER32.DLL at 00000000-00005104-19463-2235-0044FCC8\n SystemParametersInfoA@USER32.DLL at 00000000-00005104-19463-2252-0044FFA8\n SystemParametersInfoA@USER32.DLL at 00000000-00005104-19463-2253-0044FF78","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"4d0108f8\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"4e0109bf\"\n \"cx\": \"0\"\n \"cy\": \"25\"}\n \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"6501023d\"\n \"cx\": \"870\"\n \"cy\": \"30\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":5,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to read clipboard data","description":"GetClipboardData@USER32.DLL at 00000000-00005104-19463-1415-00423514","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1115","relevance":5,"id":"stream-74","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetKeyState@USER32.DLL at 00000000-00005104-19463-1629-0042FC4C\n MapVirtualKeyA@USER32.DLL at 00000000-00005104-19463-1666-00441094\n GetKeyboardState@USER32.DLL at 00000000-00005104-19463-1709-00433360\n GetKeyState@USER32.DLL at 00000000-00005104-19463-1734-004487F8\n GetKeyState@USER32.DLL at 00000000-00005104-19463-2047-00445150\n GetKeyState@USER32.DLL at 00000000-00005104-19463-2216-0044884C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056.001","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameA@KERNEL32.DLL at 00000000-00005104-19463-45-00405148\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00005104-19463-46-00405384\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00005104-19463-802-004011C4\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00005104-19463-924-0040B2F4\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00005104-19463-932-0040B9A0\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00005104-19463-1926-00450010","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\"login.skype.com0\" (Indicator: \"skype.com\")\n \"login.skype.com\" (Indicator: \"skype.com\")\n \"www.login.skype.com0\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"$70","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"svchost015.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"svchost015.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"svchost015.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"svchost015.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"svchost015.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"svchost015.exe\" claimed CRC 2738142 while the actual is CRC 5031579","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$71","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" called \"CreateProcessA\" with parameter \"%TEMP%\\svchost015.exe\" - (UID: 00000000-00005104)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"malicious","category":"Cryptographic Related","name":"Able to use RSA keys for encryption and decryption","description":"Found RSA private key marker \"-----BEGIN RSA PRIVATE KEY-----\" in \"-----BEGIN RSA PRIVATE KEY-----\" (Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")\n Found RSA private key marker \"-----END RSA PRIVATE KEY-----\" in \"-----END RSA PRIVATE KEY-----\" (Source: \"00000000-00004780.00000003.313232.01290000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.001","relevance":6,"id":"string-799","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" allocated memory in \"C:\\01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" wrote 32 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\svchost015.exe\" (Handle: 220)\n \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" wrote 52 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\svchost015.exe\" (Handle: 220)\n \"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe\" wrote 4 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\svchost015.exe\" (Handle: 220)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Contains ability to read clipboard data"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Contains ability to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Contains ability to terminate a process"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":79,"dropped_files_count":0,"extracted_files_count":7,"files_written_count":22,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":7,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":4,"contacted_urls_count":4,"http_requests_count":4},"behavior_tags":["mixloader","commodity","criminal","loader","downloader","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"686d28b17297df8b98074515","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["RUS","USA"],"submit_name":"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe","analysis_start_time":"2025-07-08T14:18:26+00:00","indicators_count":{"informative":221,"suspicious":56,"malicious":5},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"142.251.35.161","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"address":"142.251.40.131","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"address":"185.156.73.98","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]}],"dns_resolutions":[{"domain":"c.pki.goog","address":"142.251.40.131","ttl":137,"country":"United States","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"domain":"drive.usercontent.google.com","address":"142.251.35.161","ttl":300,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"ns1.google.com","registrar_creation_date":"1997-09-15T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"domain":"o.pki.goog","address":"142.251.40.131","ttl":84,"country":"United States","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"domain":"ocsp.pki.goog","address":"142.251.40.131","ttl":296,"country":"United States","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]}],"http_requests":[{"host":"ocsp.pki.goog","host_ip":"142.251.40.131:80","url":"/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"host":"c.pki.goog","host_ip":"142.251.40.131:80","url":"/r/r1.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /r/r1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"host":"c.pki.goog","host_ip":"142.251.40.131:80","url":"/wr2/9UVbN0w5E6Y.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"host":"o.pki.goog","host_ip":"142.251.40.131:80","url":"/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCF9JCsde%2FXjQrTM033%2FMEh","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQCF9JCsde%2FXjQrTM033%2FMEh HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: o.pki.goog","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}],"processes":[{"pid":5104,"ppid":0,"name":"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe","command_line":"","sha256":"01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231","normalized_path":"C:\\01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231.exe","uid":"00000000-00005104","icon":"$72"},{"pid":4780,"ppid":5104,"name":"svchost015.exe","command_line":"","sha256":"4e04e2fb20a9c6846b5d693ea67098214f77737f4f1f3df5f0c78594650e7f71","normalized_path":"%TEMP%\\svchost015.exe","parent_uid":"00000000-00005104","uid":"00000000-00004780"}],"all_imported_dlls":["dhcpcsvc.dll","npmproxy.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","rsaenh.dll","oleaut32.dll","shlwapi.dll","api-ms-win-downlevel-user32-l1-1-0.dll","clbcatq.dll","wintrust.dll","SensApi.dll","winhttp.dll","cryptbase.dll","ole32.dll","userenv.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","bcrypt.dll","netprofm.dll","api-ms-win-core-synch-l1-2-0.dll","normaliz.dll","profapi.dll","sspicli.dll","gdi32.dll","advapi32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","crypt32.dll","wship6.dll","Wldap32.dll","version.dll","ktmw32.dll","msasn1.dll","bcryptprimitives.dll","gpapi.dll","KernelBase.dll","uxtheme.dll","ws2_32.dll","RpcRtRemote.dll","user32.dll","rpcss.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","fltLib.dll","mswsock.dll","cryptnet.dll","winnsi.dll","wshqos.dll","cfgmgr32.dll","rpcrt4.dll","imm32.dll","secur32.dll","schannel.dll","lpk.dll","dwmapi.dll","VxSSL32.dll","IPHLPAPI.DLL","dnsapi.dll","dhcpcsvc6.dll","rasadhlp.dll","credssp.dll","kernel32.dll","comctl32.dll","ntdll.dll","msctf.dll","apphelp.dll","WSHTCPIP.DLL","urlmon.dll","webio.dll","msvcrt.dll","shell32.dll","FWPUCLNT.DLL","nlaapi.dll","sechost.dll","nsi.dll","wininet.dll","iertutil.dll","ncrypt.dll","usp10.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","cryptsp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"svcF6C.tmp","sha256":"c32655f66e93a4eee682ef78c7a1ec4601f22ab5d2e7f70fc4eb5644cee9be4a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"name":"svchost015.exe","sha256":"4e04e2fb20a9c6846b5d693ea67098214f77737f4f1f3df5f0c78594650e7f71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"name":"05DDC6AA91765AACACDB0A5F96DF8199","sha256":"eac173f6aa2de93aabf408b24c323e3ccdd20833aa1b29ffe6a03f9236aac0c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"name":"24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA","sha256":"8134e363330b86c191942f56a9191ba429db31fdab010a6ed5aebc1873dd3416","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"bf5e0eaa3ebd5e5e842756ad53e86960701da5b11c978687f643c317430bbe63","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"name":"9C69E496D546F49A980D7350EC49A180","sha256":"d45c3cb840bf0c2739e081fa9750eaa8da7395ef471ae1ce982b8445176a3a82","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"name":"C02877841121CC45139CB51404116B25_79CC29E1F7D035B115276DC794FE8DD4","sha256":"abb991cb97e22ab14fd78130eeed731c31d895ec9a39c4c450a7049ea34c1f03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"path":"%TEMP%\\svchost015.exe","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"path":"%TEMP%\\svcF6C.tmp","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{AC07BF4D-B150-47EB-A71E-488912826651}","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\05DDC6AA91765AACACDB0A5F96DF8199","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\05DDC6AA91765AACACDB0A5F96DF8199","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\C02877841121CC45139CB51404116B25_79CC29E1F7D035B115276DC794FE8DD4","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\C02877841121CC45139CB51404116B25_79CC29E1F7D035B115276DC794FE8DD4","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\9C69E496D546F49A980D7350EC49A180","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\9C69E496D546F49A980D7350EC49A180","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{04199AE7-D75D-454B-A7B9-D89AF232008D}\\","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-50-56-91-91-A8\\","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{04199AE7-D75D-454B-A7B9-D89AF232008D}\\00-50-56-91-91-A8\\","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{04199AE7-D75D-454B-A7B9-D89AF232008D}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-50-56-91-91-A8\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"686d28b17297df8b98074515"}]}]}},"report_ids":{"sandbox_job_ids":["686d28b17297df8b98074515"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 01c3b22efb07… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 01c3b22efb07…. Malware family: Trojan.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 5 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 01c3b22efb07… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 01c3b22efb07…. Malware family: Trojan.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 5 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/01c3b22efb07d44d2102650a3896e08c4cd5424b176a943fa7e7e93def3dc231"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 01c3b22efb07… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 01c3b22efb07…. Malware family: Trojan.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 5 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L73","11",{}]]