26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 49:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4bc,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Trojan.Win64.MSIL_Heur Sample 06eaa4756b6f… — Score 70/100 — Hybrid Analysis","description":"Suspicious verdict for sample 06eaa4756b6f…. Malware family: Trojan.Win64.MSIL_Heur. Threat score 70/100. 1/27 AV engines flagged this file. 1 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/06eaa4756b6f505d71fa66896a4270f95201794f47370a28e2f710fadf99cdd8","keywords":["Suspicious","Trojan.Win64.MSIL_Heur","malware analysis","sandbox report","threat intelligence","06eaa4756b6f505d71fa66896a4270f95201794f47370a28e2f710fadf99cdd8"],"about":{"@type":"SoftwareApplication","name":"MloCreator.exe","applicationCategory":["peexe","64bits","assembly","executable"],"identifier":"06eaa4756b6f505d71fa66896a4270f95201794f47370a28e2f710fadf99cdd8","additionalType":"Suspicious sample"},"threatScore":70,"malwareFamily":"Trojan.Win64.MSIL_Heur","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T97e,Found reference to API "AsyncVoidMethodBuilder" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "HttpListenerResponse" (Indicator: "listen"; Source: "sample.bin"), Found reference to API "ReadAllLines" (Indicator: "read"; Source: "sample.bin"), Found reference to API "EnsureCoreWebView2Async" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "CreateElement" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "CreateElement" (Indicator: "tee"; Source: "sample.bin"), Found reference to API "vanilla/status" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "PropEntityXml" (Indicator: "open"; Source: "sample.bin"), Found reference to API "MloCreator.exe" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "FlushThenClose" (Indicator: "close"; Source: "sample.bin"), Found reference to API "ReadBody" (Indicator: "read"; Source: "sample.bin"), Found reference to API "SetStateMachine" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "ReadFloats" (Indicator: "read"; Source: "sample.bin"), Found reference to API ". Doors are open doorways: add a door script/prop of your choice" (Indicator: "open"; Source: "sample.bin"), Found reference to API "WriteAllText" (Indicator: "write"; Source: "sample.bin"), Found reference to API "HttpListenerContext" (Indicator: "listen"; Source: "sample.bin"), Found reference to API " MLO Creator " (Indicator: "creat"; Source: "sample.bin"), Found reference to API " MLO Creator " (Indicator: "time"; Source: "sample.bin"), Found reference to API "WriteInterior" (Indicator: "write"; Source: "sample.bin"), Found reference to API "ThreadPool" (Indicator: "read"; Source: "sample.bin"), Found reference to API "ThreadStart" (Indicator: "read"; Source: "sample.bin"), Found reference to API "get_HasExited" (Indicator: "exit"; Source: "sample.bin"), Found reference to API "get_Ready" (Indicator: "read"; Source: "sample.bin"), Found reference to API "ReadAllBytes" (Indicator: "read"; Source: "sample.bin"), Found reference to API "MLO Creator" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "set_SelectedPath" (Indicator: "select"; Source: "sample.bin")28:T862,Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000000.301724.5ED04000.00000002.mdmp, 00000000-00004624.00000000.301724.642D5000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp, 00000000-00004624.00000001.302168.4C961000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000000.301724.5ED04000.00000002.mdmp, 00000000-00004624.00000000.301724.642D5000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp, 00000000-00004624.00000001.302168.4C961000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp, 00000000-00004624.00000001.302168.4C961000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp")29:T67a,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp")2a:T4e7,"identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.UI.SHELL.TASKBARMANAGER") "identity_helper.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.UI.SHELL.TASKBARMANAGER") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.UI.SHELL.TASKBARMANAGER\CUSTOMATTRIBUTES") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.APPLICATIONMODEL.TASKBARPINNABLESURFACE") "identity_helper.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.APPLICATIONMODEL.TASKBARPINNABLESURFACE") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.APPLICATIONMODEL.TASKBARPINNABLESURFACE") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.APPLICATIONMODEL.TASKBARPINNABLESURFACE\CUSTOMATTRIBUTES") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY")2b:T500,Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp, 00000000-00004624.00000001.302168.4C961000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp")2c:T9f5,"MloCreator.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008412) "identity_helper.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004624) "identity_helper.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004624) "identity_helper.exe" called "RtlGetVersion" with parameter 240100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004624)2d:Tc3c,"MloCreator.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00008412) "MloCreator.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00008412) "MloCreator.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00008412) "MloCreator.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00008412) "MloCreator.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008412) "MloCreator.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008412) "MloCreator.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00008412) "MloCreator.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00008412) "MloCreator.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008412) "MloCreator.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008412) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004624) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004624) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00004624) "identity_helper.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00004624) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004624) "identity_helper.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004624) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004624) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004624) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004624) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00004624) "identity_helper.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Microsoft\Edge\Application\145.0.3800.58\msedge.dll (UID: 00000000-00004624) "identity_helper.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004624) "identity_helper.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004624) "identity_helper.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004624) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004624) "identity_helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004624) "identity_helper.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004624)2e:T2f6c,"MloCreator.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter HttpCreateServerSession (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter HttpCreateUrlGroup (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter HttpCreateRequestQueue (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter HttpSetUrlGroupProperty (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter HttpAddUrlToUrlGroup (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter HttpReceiveHttpRequest (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter GetCurrentDirectory (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00008412) "MloCreator.exe" called "GetProcAddress" with a parameter HttpSendHttpResponse (UID: 00000000-00008412) "identity_helper.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter RtlGetDeviceFamilyInfoEnum (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter WerRegisterCustomMetadata (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter PrefetchVirtualMemory (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter GetHandleVerifier (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter ChromeMain (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter signal (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter LdrLockLoaderLock (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter LdrUnlockLoaderLock (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter PostThreadMessageW (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter NtQuerySection (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter GetThreadDescription (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter CoCreateFreeThreadedMarshaler (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00004624) "identity_helper.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004624)2f:T418,Found reference to API "CreateFile" (Indicator: "CreateFile"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp") Found reference to API "CreateFileFromAppW" (Indicator: "CreateFile"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp") Found reference to API "CreateFileVersionInfoWin" (Indicator: "CreateFile"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp, 00000000-00004624.00000001.302168.4C961000.00000002.mdmp")30:T8e7,Process MloCreator.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8412:304:WilStaging_02" Process MloCreator.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8412:304:WilStaging_02" Process MloCreator.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8412:120:WilError_03" Process MloCreator.exe created mutex with name "SM0:8412:120:WilError_03" Process MloCreator.exe created mutex with name "SM0:8412:304:WilStaging_02" Process MloCreator.exe created mutex with name "Local\SM0:8412:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:916:120:WilError_03" Process msedge.exe created mutex with name "3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD" Process msedge.exe created mutex with name "SM0:916:304:WilStaging_02" Process msedge.exe created mutex with name "Local\SM0:916:304:WilStaging_02" Process msedge.exe created mutex with name "Local\SM0:916:120:WilError_03" Process msedge.exe created mutex with name "__OMADM_NAMED_MUTEX__" Process msedge.exe created mutex with name "DBWinMutex" Process msedge.exe created mutex with name "ChromeProcessSingletonStartup!" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:916:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:916:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\DBWinMutex" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\ChromeProcessSingletonStartup!" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\__OMADM_NAMED_MUTEX__" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1804:304:WilStaging_02" Process msedge.exe created mutex with name "Local\SM0:1804:304:WilStaging_02" Process msedge.exe created mutex with name "SM0:1804:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1804:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3824:304:WilStaging_02"31:T3a1e,"\Machine\Software\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\cohort" in Source: 00000000-00004624.00000000.301724.00088000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp "SOFTWARE\Classes" in Source: 00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp "Microsoft\SOFTWARE\Microsoft\Shared Tools\MSInfo" in Source: 00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp "Software\" in Source: 00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp "Software\Microsoft\EdgeUpdate\Clients\" in Source: 00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp "Software\Microsoft\EdgeUpdate\ClientStateMedium\" in Source: 00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp "\Registry\Machine\Software\Classes\Interface\{0450CE77-AF0D-40AC-93FD-1E5D48C89419}" in Source: 00000000-00004624.00000000.301724.9227C000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{9ED07B24-36FD-543B-948E-B01FE5814B49}" in Source: 00000000-00004624.00000000.301724.9227C000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}" in Source: 00000000-00004624.00000000.301724.9227C000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{6D3BC882-23A4-4706-B8FA-FC7DE2FC325D}" in Source: 00000000-00004624.00000000.301724.9227C000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}" in Source: 00000000-00004624.00000000.301724.9227C000.00000004.mdmp "\Machine\Software\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\cohort" in Source: 00000000-00004624.00000001.302168.00088000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004624.00000001.302168.2A330000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00004624.00000001.302168.2A330000.00000002.mdmp "\Registry\Machine\Software\Classes\Interface\{0450CE77-AF0D-40AC-93FD-1E5D48C89419}" in Source: 00000000-00004624.00000001.302168.9227C000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{9ED07B24-36FD-543B-948E-B01FE5814B49}" in Source: 00000000-00004624.00000001.302168.9227C000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}" in Source: 00000000-00004624.00000001.302168.9227C000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{6D3BC882-23A4-4706-B8FA-FC7DE2FC325D}" in Source: 00000000-00004624.00000001.302168.9227C000.00000004.mdmp "\Registry\Machine\Software\Classes\Interface\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}" in Source: 00000000-00004624.00000001.302168.9227C000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005308.00000000.301399.2A330000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00005308.00000000.301399.2A330000.00000002.mdmp "KEY_CURRENT_USER\Software\Valve\Steam|SteamPath" in Source: 00000000-00008412.00000000.300733.00EB2000.00000002.mdmp "KEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Valve\Steam|InstallPath" in Source: 00000000-00008412.00000000.300733.00EB2000.00000002.mdmp "KEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Rockstar Games\Grand Theft Auto V" in Source: 00000000-00008412.00000000.300733.00EB2000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008412.00000000.300733.016D0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00008412.00000000.300733.016D0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008412.00000000.300733.016D0000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" in Source: 00000000-00008412.00000000.300733.016D0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00008412.00000000.300733.042D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00008412.00000000.300733.042D0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008412.00000000.300733.042D0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00008412.00000000.300733.042D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008412.00000000.300733.042D0000.00000004.mdmp "To enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008412.00000000.300733.042D0000.00000004.mdmp "To turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008412.00000000.300733.042D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00008412.00000000.300733.042D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00008412.00000000.300733.042D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DSTe=neutral, PublicKeyToken=2a8ab48044d26" in Source: 00000000-00008412.00000000.300733.042D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00008412.00000000.300733.042D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00008412.00000000.300733.042D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00008412.00000000.300733.042D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00008412.00000000.300733.042D0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008412.00000001.302652.016D0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00008412.00000001.302652.016D0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008412.00000001.302652.016D0000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" in Source: 00000000-00008412.00000001.302652.016D0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00008412.00000001.302652.042D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00008412.00000001.302652.042D0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008412.00000001.302652.042D0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00008412.00000001.302652.042D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008412.00000001.302652.042D0000.00000004.mdmp "To enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008412.00000001.302652.042D0000.00000004.mdmp "To turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008412.00000001.302652.042D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00008412.00000001.302652.042D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00008412.00000001.302652.042D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DSTe=neutral, PublicKeyToken=2a8ab48044d26" in Source: 00000000-00008412.00000001.302652.042D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00008412.00000001.302652.042D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00008412.00000001.302652.042D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00008412.00000001.302652.042D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00008412.00000001.302652.042D0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008412.00000002.304573.016D0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00008412.00000002.304573.016D0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008412.00000002.304573.016D0000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" in Source: 00000000-00008412.00000002.304573.016D0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00008412.00000002.304573.042D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00008412.00000002.304573.042D0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008412.00000002.304573.042D0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00008412.00000002.304573.042D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008412.00000002.304573.042D0000.00000004.mdmp "To enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008412.00000002.304573.042D0000.00000004.mdmp "To turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008412.00000002.304573.042D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00008412.00000002.304573.042D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00008412.00000002.304573.042D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DSTe=neutral, PublicKeyToken=2a8ab48044d26" in Source: 00000000-00008412.00000002.304573.042D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00008412.00000002.304573.042D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00008412.00000002.304573.042D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00008412.00000002.304573.042D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00008412.00000002.304573.042D0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008412.00000003.311351.016D0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00008412.00000003.311351.016D0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008412.00000003.311351.016D0000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" in Source: 00000000-00008412.00000003.311351.016D0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00008412.00000003.311351.042D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00008412.00000003.311351.042D0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008412.00000003.311351.042D0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00008412.00000003.311351.042D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008412.00000003.311351.042D0000.00000004.mdmp "To enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008412.00000003.311351.042D0000.00000004.mdmp "To turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008412.00000003.311351.042D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00008412.00000003.311351.042D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00008412.00000003.311351.042D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DSTe=neutral, PublicKeyToken=2a8ab48044d26" in Source: 00000000-00008412.00000003.311351.042D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00008412.00000003.311351.042D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00008412.00000003.311351.042D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00008412.00000003.311351.042D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00008412.00000003.311351.042D0000.00000004.mdmp32:T576,Launches browser "msedge.exe" (UID: 00000000-00000916) Launches browser "msedge.exe" (UID: 00000000-00001804) Launches browser "msedge.exe" (UID: 00000000-00003824) Launches browser "msedge.exe" (UID: 00000000-00003732) Launches browser "msedge.exe" (UID: 00000000-00002972) Launches browser "msedge.exe" (UID: 00000000-00002020) Launches browser "msedge.exe" (UID: 00000000-00002324) Launches browser "msedge.exe" (UID: 00000000-00003920) Launches browser "msedge.exe" (UID: 00000000-00007492) Launches browser "msedge.exe" (UID: 00000000-00000432) Launches browser "msedge.exe" (UID: 00000000-00007400) Launches browser "msedge.exe" (UID: 00000000-00006020) Launches browser "msedge.exe" (UID: 00000000-00005740) Launches browser "msedge.exe" (UID: 00000000-00005732) Launches browser "msedge.exe" (UID: 00000000-00008360) Launches browser "msedge.exe" (UID: 00000000-00007076) Launches browser "msedge.exe" (UID: 00000000-00004556) Launches browser "msedge.exe" (UID: 00000000-00003244) Launches browser "msedge.exe" (UID: 00000000-00006104) Launches browser "msedge.exe" (UID: 00000000-00000224) Launches browser "msedge.exe" (UID: 00000000-00001112) Launches browser "msedge.exe" (UID: 00000000-00006916) Launches browser "msedge.exe" (UID: 00000000-00008444) Launches browser "msedge.exe" (UID: 00000000-00006108) Launches browser "msedge.exe" (UID: 00000000-00006192)33:Tef6,"MloCreator.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fff50f30000 "MloCreator.exe" loaded module "SHELL32.DLL" at base 7fff78710000 "MloCreator.exe" loaded module "OLE32.DLL" at base 7fff79b60000 "MloCreator.exe" loaded module "USER32.DLL" at base 7fff79130000 "MloCreator.exe" loaded module "NTDLL.DLL" at base 7fff7a390000 "MloCreator.exe" loaded module "KERNEL32.DLL" at base 7fff78520000 "identity_helper.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fff50f30000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fff77f70000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fff77f70000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7fff77f70000 "identity_helper.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7fff78320000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fff77f70000 "identity_helper.exe" loaded module "KERNEL32" at base 7fff78520000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7fff77f70000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7fff77f70000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7fff77f70000 "identity_helper.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 20494400000 "identity_helper.exe" loaded module "%PROGRAMFILES%\(X86)\MICROSOFT\EDGE\APPLICATION\145.0.3800.58\MSEDGE.DLL" at base 7fff2f370000 "identity_helper.exe" loaded module "ADVAPI32.DLL" at base 7fff792e0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fff753a0000 "identity_helper.exe" loaded module "USER32.DLL" at base 7fff79130000 "identity_helper.exe" loaded module "SHELL32.DLL" at base 7fff78710000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7fff79e30000 "identity_helper.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 20498210000 "identity_helper.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7fff79e30000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.APPLICATIONMODEL.DLL" at base 7fff62b30000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7fff78320000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTOWINRT.DLL" at base 7fff50900000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\TWINAPI.APPCORE.DLL" at base 7fff71e20000 "identity_helper.exe" loaded module "RPCRT4.DLL" at base 7fff785f0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7fff73e60000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WPNAPPS.DLL" at base 7fff5ed10000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7fff79e30000 "identity_helper.exe" loaded module "OLE32.DLL" at base 7fff79b60000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\TILEDATAREPOSITORY.DLL" at base 7fff5f4f0000 "identity_helper.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 204982d0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\USERMGRPROXY.DLL" at base 7fff6ece0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7fff63e70000 "identity_helper.exe" loaded module "GDI32.DLL" at base 7fff793a0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.INTERNAL.SHELL.BROKER.DLL" at base 7fff596a0000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\ONECORECOMMONPROXYSTUB.DLL" at base 7fff64230000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\PCSHELLCOMMONPROXYSTUB.DLL" at base 7fff5e120000 "identity_helper.exe" loaded module "%WINDIR%\SYSTEM32\STARTTILEDATA.DLL" at base 7fff5e72000034:T295f,Process "msedge.exe" (UID: 00000000-00000916) was launched with new environment variables: "USERDNSDOMAIN="XhoqFssy8Ku2M5S"" Process "msedge.exe" (UID: 00000000-00000916) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "msedge.exe" (UID: 00000000-00001804) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_916_AIWGBXZJAOKOAAAN", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\MloCreator\window", EDGE_BROWSER_PID="916"" Process "msedge.exe" (UID: 00000000-00003824) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="0", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\MloCreator\window", EDGE_METRICS_CLIENT_ID_HASH="6984964005295986969"" Process "msedge.exe" (UID: 00000000-00002972) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), NODE_PATH, CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, DriverData, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00003244) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="XhoqFssy8Ku2M5S", LOGONSERVER="\\DESKTOP-FVVF82A", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="0", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\MloCreator\window", USERNAME="MmA3yBc", USERDNSDOMAIN="XhoqFssy8Ku2M5S", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", NODE_PATH="%PROGRAMFILES%\nodejs\node_modules", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", DriverData="%WINDIR%\System32\Drivers\DriverData", OS="Windows_NT", COMPUTERNAME="XhoqFssy8Ku2M5S", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\MmA3yBc", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\MmA3yBc", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="8", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="6984964005295986969"" Process "msedge.exe" (UID: 00000000-00006104) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), NODE_PATH, CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, DriverData, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "identity_helper.exe" (UID: 00000000-00005308) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="XhoqFssy8Ku2M5S", LOGONSERVER="\\DESKTOP-FVVF82A", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="0", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\MloCreator\window", USERNAME="MmA3yBc", USERDNSDOMAIN="XhoqFssy8Ku2M5S", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", NODE_PATH="%PROGRAMFILES%\nodejs\node_modules", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", DriverData="%WINDIR%\System32\Drivers\DriverData", OS="Windows_NT", COMPUTERNAME="XhoqFssy8Ku2M5S", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\MmA3yBc", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\MmA3yBc", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="8", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="6984964005295986969"" Process "msedge.exe" (UID: 00000000-00001112) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), NODE_PATH, CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, DriverData, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00006192) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="XhoqFssy8Ku2M5S", LOGONSERVER="\\DESKTOP-FVVF82A", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="0", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\MloCreator\window", USERNAME="MmA3yBc", USERDNSDOMAIN="XhoqFssy8Ku2M5S", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", NODE_PATH="%PROGRAMFILES%\nodejs\node_modules", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", DriverData="%WINDIR%\System32\Drivers\DriverData", OS="Windows_NT", COMPUTERNAME="XhoqFssy8Ku2M5S", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\MmA3yBc", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\MmA3yBc", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="8", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="6984964005295986969"" Process "msedge.exe" (UID: 00000000-00002192) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), NODE_PATH, CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, DriverData, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00002228) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="XhoqFssy8Ku2M5S", LOGONSERVER="\\DESKTOP-FVVF82A", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="0", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\MloCreator\window", USERNAME="MmA3yBc", USERDNSDOMAIN="XhoqFssy8Ku2M5S", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", NODE_PATH="%PROGRAMFILES%\nodejs\node_modules", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", DriverData="%WINDIR%\System32\Drivers\DriverData", OS="Windows_NT", COMPUTERNAME="XhoqFssy8Ku2M5S", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\MmA3yBc", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\MmA3yBc", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="8", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="6984964005295986969"" Process "msedge.exe" (UID: 00000000-00004580) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), NODE_PATH, CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, DriverData, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH"35:Tdfe,Spawned process "msedge.exe" with commandline "--app=http://127.0.0.1:47770/ --user-data-dir="%LOCALAPPDATA%\\M ..." (UID: 00000000-00000916), Spawned process "msedge.exe" with commandline "--type=crashpad-handler --user-data-dir=%LOCALAPPDATA%\\MloCreat ..." (UID: 00000000-00001804), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00003824), Spawned process "msedge.exe" with commandline "--type=gpu-process --user-data-dir="%LOCALAPPDATA%\\MloCreator\\ ..." (UID: 00000000-00003732) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00002972) Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%LOCALAPPDATA%\\MloCreator\\win ..." (UID: 00000000-00002020), Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%LOCALAPPDATA%\\MloCreator\\win ..." (UID: 00000000-00002324) Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%LOCALAPPDATA%\\MloCreator\\win ..." (UID: 00000000-00003920), Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%LOCALAPPDATA%\\MloCreator\\win ..." (UID: 00000000-00007492) Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%LOCALAPPDATA%\\MloCreator\\win ..." (UID: 00000000-00000432), Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%LOCALAPPDATA%\\MloCreator\\win ..." (UID: 00000000-00007400) Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%LOCALAPPDATA%\\MloCreator\\win ..." (UID: 00000000-00006020), Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%LOCALAPPDATA%\\MloCreator\\win ..." (UID: 00000000-00005740) Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%LOCALAPPDATA%\\MloCreator\\win ..." (UID: 00000000-00005732), Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%LOCALAPPDATA%\\MloCreator\\win ..." (UID: 00000000-00008360) Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%LOCALAPPDATA%\\MloCreator\\win ..." (UID: 00000000-00007076), Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%LOCALAPPDATA%\\MloCreator\\win ..." (UID: 00000000-00004556) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=PooledProcess2 --lang=en-US -- ..." (UID: 00000000-00003244) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00006104) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00000224) Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00005308) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00001112) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00006916) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00008444) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00006108)36:Tdfe,Spawned process "msedge.exe" with commandline "--app=http://127.0.0.1:47770/ --user-data-dir="%LOCALAPPDATA%\\M ..." (UID: 00000000-00000916), Spawned process "msedge.exe" with commandline "--type=crashpad-handler --user-data-dir=%LOCALAPPDATA%\\MloCreat ..." (UID: 00000000-00001804), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00003824), Spawned process "msedge.exe" with commandline "--type=gpu-process --user-data-dir="%LOCALAPPDATA%\\MloCreator\\ ..." (UID: 00000000-00003732) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00002972) Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%LOCALAPPDATA%\\MloCreator\\win ..." (UID: 00000000-00002020), Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%LOCALAPPDATA%\\MloCreator\\win ..." (UID: 00000000-00002324) Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%LOCALAPPDATA%\\MloCreator\\win ..." (UID: 00000000-00003920), Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%LOCALAPPDATA%\\MloCreator\\win ..." (UID: 00000000-00007492) Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%LOCALAPPDATA%\\MloCreator\\win ..." (UID: 00000000-00000432), Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%LOCALAPPDATA%\\MloCreator\\win ..." (UID: 00000000-00007400) Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%LOCALAPPDATA%\\MloCreator\\win ..." (UID: 00000000-00006020), Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%LOCALAPPDATA%\\MloCreator\\win ..." (UID: 00000000-00005740) Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%LOCALAPPDATA%\\MloCreator\\win ..." (UID: 00000000-00005732), Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%LOCALAPPDATA%\\MloCreator\\win ..." (UID: 00000000-00008360) Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%LOCALAPPDATA%\\MloCreator\\win ..." (UID: 00000000-00007076), Spawned process "msedge.exe" with commandline "--type=renderer --user-data-dir="%LOCALAPPDATA%\\MloCreator\\win ..." (UID: 00000000-00004556) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=PooledProcess2 --lang=en-US -- ..." (UID: 00000000-00003244) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00006104) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00000224) Spawned process "identity_helper.exe" with commandline "--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdS ..." (UID: 00000000-00005308) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00001112) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00006916) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00008444) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00006108)37:T788,The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: EA:BC:AB:CD:E0:C7:EA:5E:B3:51:4E:91:8E:95:E3:50:7D:C2:04:D4; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 4D:9A:CB:31:3D:73:DA:2E:9E:B4:51:A7:CF:63:09:AF:45:C9:93:C1; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: 76:7A:3B:FA:D0:F8:92:94:22:AC:46:9B:F5:92:44:E3:9B:62:43:32; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 ECC CA OCSP 06, O=Microsoft Corporation, C=US" (SHA1: EF:0D:BE:18:E6:CB:44:39:F7:17:83:17:1A:49:AA:88:74:F7:2D:2F; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS ECC Root G2, O=Microsoft Corporation, C=US" (SHA1: 9B:C5:75:46:AC:BD:B2:9E:38:8C:D1:79:1B:43:DE:4F:65:9B:84:4B; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7F:A0:5A:CF:9B:4A:AB:B0:DE:0C:FA:FA:29:7D:DF:92:FD:C5:F3:F5; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7E:04:DE:89:6A:3E:66:6D:00:E6:87:D3:3F:FA:D9:3B:E8:3D:34:9E; see report for more information) The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: 68:84:0F:DC:E9:7D:17:CB:CB:DE:D2:B9:0D:D8:CF:73:43:64:C7:8E; see report for more information)38:T602,"MloCreator.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "MloCreator.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "MloCreator.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "MloCreator.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "MloCreator.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "MloCreator.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "MloCreator.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "MloCreator.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "MloCreator.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "MloCreator.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "MloCreator.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\"; Key: ""; Value: "") "MloCreator.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\V4.0"; Key: ""; Value: "") "MloCreator.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "")39:T9be,"MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E36C4458-ED80-4AD7-A8BE-52DDA1EB5F1C"; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000603XX"; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F3A71A4B-6118-4257-8CCB-39A33BA059D4"; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "CA967C75-04BF-40B5-9A16-98B5F9332A92"; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B6FD710B-F783-4B1C-AB9C-C68099DCC0C7"; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "BF30465B-E93C-46FD-9CDF-F41C8904A01F"; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "C1376338-0984-48B8-B933-9C7D779FD84D"; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "319DC449-ADA5-50F7-428E-957DB6791668"; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "CLRLOADLOGDIR"; Value: "")3a:T479,"MloCreator.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "MloCreator.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll.aux" "MloCreator.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\fe3c9cf707273488c6c658d52d624640\system.ni.dll.aux" "MloCreator.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.windows.forms\061200dcb8937e1b9eb2641f2ce9d2ec\system.windows.forms.ni.dll.aux" "MloCreator.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.drawing\908b5c1debcfb784bc25157a8ebcdfbe\system.drawing.ni.dll.aux" "MloCreator.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.configuration\24206316825bb75ebfbdd31895df2f1f\system.configuration.ni.dll.aux" "MloCreator.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\21ff4ba4607b18a9b179ab90fd3b0bc1\system.core.ni.dll.aux" "MloCreator.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.xml\76ff225c5a523f0be2364b0fc02bf7f9\system.xml.ni.dll.aux"3b:T8d6,"MloCreator.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "MloCreator.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "MloCreator.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "MloCreator.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "MloCreator.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "MloCreator.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "MloCreator.exe" trying to access non-existent file "C:\CRYPTSP.dll" "MloCreator.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "MloCreator.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" "MloCreator.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System\808887ebadf1a37835b907c866cede3c\System.ni.dll" "MloCreator.exe" trying to access non-existent file "C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System\808887ebadf1a37835b907c866cede3c\System.ni.dll" "MloCreator.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System\808887ebadf1a37835b907c866cede3c\System.ni.exe" "MloCreator.exe" trying to access non-existent file "C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System\808887ebadf1a37835b907c866cede3c\System.ni.exe" "MloCreator.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" "MloCreator.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" "MloCreator.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\11723c46cea53a98c07435785eae2ca8\System.Core.ni.dll" "MloCreator.exe" trying to access non-existent file "C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Core\11723c46cea53a98c07435785eae2ca8\System.Core.ni.dll"3c:T4fc,"MloCreator.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.local" "MloCreator.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "MloCreator.exe" trying to access non-existent file "C:\MloCreator.exe.config" "MloCreator.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "MloCreator.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\MloCreator" "MloCreator.exe" trying to access non-existent file "C:\MloCreator.INI" "MloCreator.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PublisherPolicy.tme" "MloCreator.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.28b9ef5a#" "MloCreator.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.INI" "MloCreator.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.INI" "MloCreator.exe" trying to access non-existent file "C:\projects" "MloCreator.exe" trying to access non-existent file "C:\cache"3d:Tb0a,file/memory contains long string with (Indicator: " connect "; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found reference to API "=1 {This device will be saved for 1 day and you can connect without a code next time. This is set by your administrator.}" (Indicator: " connect "; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found reference to API "other {This device will be saved for {DAYS} days and you can connect without a code next time. This is set by your administrator.}}{HOURS, plural," (Indicator: " connect "; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found reference to API "=1 {This device will be saved for 1 hour and you can connect without a code next time. This is set by your administrator.}" (Indicator: " connect "; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found reference to API "other {This device will be saved for {HOURS} hours and you can connect without a code next time. This is set by your administrator.}}{MONTHS, plural," (Indicator: " connect "; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found reference to API "=1 {This device will be saved for 1 month and you can connect without a code next time. This is set by your administrator.}" (Indicator: " connect "; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found reference to API "other {This device will be saved for {MONTHS} months and you can connect without a code next time. This is set by your administrator.}}{YEARS, plural," (Indicator: " connect "; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found reference to API "=1 {This device will be saved for 1 year and you can connect without a code next time. This is set by your administrator.}" (Indicator: " connect "; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") file/memory contains long string with (Indicator: " bind "; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found reference to API "USB device from $2 (product $1)USB devices from $1USB device ($2:$1)USB devices from vendor $1Any serial port$1 wants to connect to a HID deviceUnknown Device ($1)Finding HID devices" (Indicator: " connect "; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found reference to API "your organization requires Microsoft Edge to connect to the Internet and" (Indicator: " connect "; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found reference to API "t use a secure connection this time. An attacker might be trying to eavesdrop or modify your network connection. $1You usually connect to sites securely, but Microsoft Edge couldn" (Indicator: " connect "; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp")3e:T84e,Observed Namespace "System.Net.HttpListener" and MemberReference ".ctor" in "MloCreator.exe" Observed Namespace "System.Net.HttpListener" and MemberReference "get_Prefixes" in "MloCreator.exe" Observed Namespace "System.Net.HttpListenerPrefixCollection" and MemberReference "Add" in "MloCreator.exe" Observed Namespace "System.Net.HttpListener" and MemberReference "Start" in "MloCreator.exe" Observed Namespace "System.Net.HttpListenerPrefixCollection" and MemberReference "GetEnumerator" in "MloCreator.exe" Observed Namespace "System.Net.HttpListener" and MemberReference "Stop" in "MloCreator.exe" Observed Namespace "System.Net.HttpListener" and MemberReference "GetContext" in "MloCreator.exe" Observed Namespace "System.Net.HttpListener" and MemberReference "get_IsListening" in "MloCreator.exe" Observed Namespace "System.Net.HttpListenerContext" and MemberReference "get_Response" in "MloCreator.exe" Observed Namespace "System.Net.HttpListenerResponse" and MemberReference "set_StatusCode" in "MloCreator.exe" Observed Namespace "System.Net.HttpListenerResponse" and MemberReference "set_ContentType" in "MloCreator.exe" Observed Namespace "System.Net.HttpListenerResponse" and MemberReference "set_ContentLength64" in "MloCreator.exe" Observed Namespace "System.Net.HttpListenerResponse" and MemberReference "get_Headers" in "MloCreator.exe" Observed Namespace "System.Net.HttpListenerResponse" and MemberReference "get_OutputStream" in "MloCreator.exe" Observed Namespace "System.Net.HttpListenerContext" and MemberReference "get_Request" in "MloCreator.exe" Observed Namespace "System.Net.HttpListenerRequest" and MemberReference "get_InputStream" in "MloCreator.exe" Observed Namespace "System.Net.HttpListenerRequest" and MemberReference "get_QueryString" in "MloCreator.exe" Observed Namespace "System.Net.HttpListenerRequest" and MemberReference "get_Url" in "MloCreator.exe" Observed Namespace "System.Net.HttpListenerRequest" and MemberReference "get_Headers" in "MloCreator.exe" Observed Namespace "System.Net.HttpListenerRequest" and MemberReference "get_HttpMethod" in "MloCreator.exe"3f:T2d05,Found URL "https://www.office.comthumbnail" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2093703https://go.microsoft.com/fwlink/?linkid=2348603sites" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://support.google.com/chromebook?p=app_intent" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2118167" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://privacy.microsoft.com/en-us/privacystatementyou're" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://aka.ms/edgepreviewhttps://aka.ms/enterprisepreviewuserto" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2149872an" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2165400to" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2165278https://go.microsoft.com/fwlink/?linkid=2348701https://go.microsoft.com/fwlink/?linkid=2165325https://go.microsoft.com/fwlink/?linkid=2348900use" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2239343https://go.microsoft.com/fwlink/?linkid=2288290show" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2301855allow" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2149000browsing" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2194724ai-powered" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/microsoft-edge/microsoft-edge-browsing-activity-for-personalized-advertising-and-experiences-37aa831e-6372-238e-f33f-7cd3f0e53679allow" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://www.microsoft.com/en-us/microsoft-365/family-safetyhttps://family.microsoft.com/?ref=edge://settings/familysafetyhttps://go.microsoft.com/fwlink/?linkid=2127630set" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/account-billing/view-device-and-app-use-with-family-safety-activity-reporting-b7b8501e-e35c-2224-bed8-115d5da4fbafto" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/account-billing/filter-websites-and-searches-using-microsoft-family-safety-3034d91e-5efa-9fbe-1384-46009f087ccfto" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://microsoftedgetips.microsoft.com/en-us/internet" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2211966writing" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://support.microsoft.com/office/microsoft-editor-checks-grammar-and-more-in-documents-mail-and-the-web-91ecbe1b-d021-4e9e-a82e-abc4cd7163d7are" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=521839microsoft" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2279846see" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2166676learn" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://easylist.to/easylist/easylist.txtthe" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://easylist.to/index.htmlallow" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2181135adds" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2161865alerts" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://aka.ms/techscam-detection-learn-moreblock" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=529732manage" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2105403this" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2114187https://go.microsoft.com/fwlink/?linkid=2077327edit" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2121003when" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://www.microsoft.com/en-us/servicesagreementmanage" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2101140change" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://aka.ms/accountsecuritylearn" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://aka.ms/synclearnmorelinkprofile" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://learn.microsoft.com/en-us/deployedge/edge-learnmore-reset-data-in-cloudreset" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2333202save" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2167671use" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://example.comsuper" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2257424keep" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://www.microsoft.com/en-us/edge/features/real-time-video-translation?form=ma13fj&ch=1show" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://microsoft.com/en-us/edge/ai-powered/copilot-mode?form=ma140nhttps://microsoft.com/en-us/edge/ai-powered/copilot-mode?form=ma140mcopilot" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2337798https://go.microsoft.com/fwlink/?linkid=2337885explore" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2337628https://go.microsoft.com/fwlink/?linkid=2345959explore" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2337721https://go.microsoft.com/fwlink/?linkid=2345869discover" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://microsoftedge.microsoft.com/addons" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://microsoftedge.microsoft.com/addonsno" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://aka.ms/edgeprintingtroubleshooting" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://aka.ms/printtroubleshootingneed" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2126235if" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://www.bing.com/new/termsofuseenhanceenhance" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://www.microsoft.com/edge/copilot-mode?form=mg0awropen" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://learn.microsoft.com/en-us/copilot/privacy-and-protections" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://learn.microsoft.com/en-us/microsoft-365-copilot/microsoft-365-copilot-privacy" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://aka.ms/whatisscarewarequick" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2107360&clcid=0x409hi," - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "http://force" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2164373" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2164373the" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://microsoftedge.microsoft.com/addons?hl=enhttps://www.whatsapp.comhttps://www.facebook.comhttps://www.youtube.comhttps://www.outlook.com/allow" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2151738learn" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "http://example.com" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://example.com.your" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://support.google.com/chrome/a/answer/9122284" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "http://.

" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "http://," - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "http://example.com." - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/p/?linkid=2114059" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/p/\?linkid=158334https://support.microsoft.com/en-us/windows/microsoft-edge-" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/topic/protect-your-online-accounts-using-password-monitor-6f660aae-65aa-476c-871a-7fe2bcb0c4c1let's" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2193240check" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://privacy.microsoft.com/en-us/privacystatement" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2189718protected" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://privacy.microsoft.com/privacystatementalways" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "https://m365.cloud.microsoft/chat?fromcode=cmm63o75lj0let's" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found URL "http://microsoft.com/edge/surfintroducing" - Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp")40:T763,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000000.301724.5ED04000.00000002.mdmp, 00000000-00004624.00000000.301724.642D5000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp, 00000000-00004624.00000001.302168.4C961000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000000.301724.5ED04000.00000002.mdmp, 00000000-00004624.00000000.301724.642D5000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp, 00000000-00004624.00000001.302168.4C961000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp, 00000000-00004624.00000001.302168.4C961000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000000.301724.5ED04000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp, 00000000-00004624.00000001.302168.4C961000.00000002.mdmp") Found reference to API "__vcrt_GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004624.00000000.301724.5ED04000.00000002.mdmp")41:T1345,Found string "password_manager.mojom.CSVPasswordParser" (Indicator: "password"; Source: "00000000-00004624.00000000.301724.00004000.00000004.mdmp") Found string "passwords" (Indicator: "password"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.00190000.00000004.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp") Found string "password_manager" (Indicator: "password"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.00190000.00000004.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp") Found string "passwords/manual_filling_controller/0x?" (Indicator: "password"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp") Found string "your password stays on your deviceAdding to Microsoft Edge" (Indicator: "password"; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found string "=1 {1 password is saved only to this device. To use it on your other devices, save it in your Google Account. This will also clean up any duplicates.}" (Indicator: "password"; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found string "other {{PASSWORD_COUNT} passwords are saved only to this device. To use them on your other devices, save them in your Google Account. This will also clean up any duplicates.}" (Indicator: "password"; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found string "=1 {1 password and other items are saved only to this device. To use them on your other devices, save them in your Google Account. This will also clean up any duplicates.}" (Indicator: "password"; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found string "other {{PASSWORD_COUNT} passwords and other items are saved only to this device. To use them on your other devices, save them in your Google Account. This will also clean up any duplicates.}" (Indicator: "password"; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found string "=1 {1 password is saved only to this device. To use it on your other devices, save it in your Google Account.}" (Indicator: "password"; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found string "other {{PASSWORD_COUNT} passwords are saved only to this device. To use them on your other devices, save them in your Google Account.}" (Indicator: "password"; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found string "=1 {1 password and other items are saved only to this device. To use them on your other devices, save them in your Google Account.}" (Indicator: "password"; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found string "other {{PASSWORD_COUNT} passwords and other items are saved only to this device. To use them on your other devices, save them in your Google Account.}" (Indicator: "password"; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found string "ve imported 1 password into Microsoft Password Manager on this device.Great! We" (Indicator: "password"; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found string "ve imported $1 passwords into Microsoft Password Manager on this device.We" (Indicator: "password"; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found string "ve imported your passwordsTo continue to save your passwords in Microsoft Edge, turn on" (Indicator: "password"; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found string "=1 {Found 1 compromised password}" (Indicator: "password"; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found string "other {Found {NUM_SITES} compromised passwords}}{NUM_SITES, plural," (Indicator: "password"; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found string "=0 {No compromised passwords}" (Indicator: "password"; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found string "=1 {{COUNT} compromised password}" (Indicator: "password"; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found string "other {{COUNT} compromised passwords}}{COUNT, plural," (Indicator: "password"; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found string "=0 {Your passwords are unique}" (Indicator: "password"; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found string "=1 {{COUNT} reused password}" (Indicator: "password"; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp") Found string "other {{COUNT} reused passwords}}Create unique passwords{COUNT, plural," (Indicator: "password"; Source: "00000000-00004624.00000000.301724.944F0000.00000002.mdmp")42:T4d5,Found reference to API "::InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp") Found reference to API "::UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size) succeeded, expected failure" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList (size)" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp") Found reference to API "InitializeProcThreadAttributeList" (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp") Found reference to API "UpdateProcThreadAttribute" (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp") Found reference to API "SetProcessMitigationPolicy" (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp")43:Tc8f,Found reference to API "BuildExplicitAccessWithNameW" (Indicator: "BuildExplicitAccessWithName"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp") Found reference to API "IsValidAcl" (Indicator: "IsValidAcl"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp")44:T9ea,"MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "MloCreator.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")45:T547,System.Net.HttpListener::get_Prefixes() at 508f73a1ce5cedac78af578585a54211-60000f6-Program~Main System.Net.HttpListener::get_IsListening() at 508f73a1ce5cedac78af578585a54211-60000fa-Program~AcceptLoop MloCreator.Program::Reply(System.Net.HttpListenerContext,System.Int32,System.Byte[],System.String) at 508f73a1ce5cedac78af578585a54211-60000fb-Program~Reply System.Net.HttpListenerContext::get_Response() at 508f73a1ce5cedac78af578585a54211-60000fc-Program~Reply System.Net.HttpListenerContext::get_Request() at 508f73a1ce5cedac78af578585a54211-60000fe-Program~ReadBody System.Net.HttpListenerContext::get_Request() at 508f73a1ce5cedac78af578585a54211-6000100-Program~ReadBytes MloCreator.Program::Reply(System.Net.HttpListenerContext,System.Int32,System.String,System.String) at 508f73a1ce5cedac78af578585a54211-6000101-Program~Json200 MloCreator.Program::Reply(System.Net.HttpListenerContext,System.Int32,System.String,System.String) at 508f73a1ce5cedac78af578585a54211-6000102-Program~HandleImport System.Net.HttpListenerContext::get_Request() at 508f73a1ce5cedac78af578585a54211-6000106-Program~Handle System.Net.HttpListenerContext::get_Request() at 508f73a1ce5cedac78af578585a54211-6000107-Program~HandleApi MloCreator.Program::Handle(System.Net.HttpListenerContext) at 508f73a1ce5cedac78af578585a54211-6000109-Program~AcceptLoopb__646:T547,System.Net.HttpListener::get_Prefixes() at 508f73a1ce5cedac78af578585a54211-60000f6-Program~Main System.Net.HttpListener::get_IsListening() at 508f73a1ce5cedac78af578585a54211-60000fa-Program~AcceptLoop MloCreator.Program::Reply(System.Net.HttpListenerContext,System.Int32,System.Byte[],System.String) at 508f73a1ce5cedac78af578585a54211-60000fb-Program~Reply System.Net.HttpListenerContext::get_Response() at 508f73a1ce5cedac78af578585a54211-60000fc-Program~Reply System.Net.HttpListenerContext::get_Request() at 508f73a1ce5cedac78af578585a54211-60000fe-Program~ReadBody System.Net.HttpListenerContext::get_Request() at 508f73a1ce5cedac78af578585a54211-6000100-Program~ReadBytes MloCreator.Program::Reply(System.Net.HttpListenerContext,System.Int32,System.String,System.String) at 508f73a1ce5cedac78af578585a54211-6000101-Program~Json200 MloCreator.Program::Reply(System.Net.HttpListenerContext,System.Int32,System.String,System.String) at 508f73a1ce5cedac78af578585a54211-6000102-Program~HandleImport System.Net.HttpListenerContext::get_Request() at 508f73a1ce5cedac78af578585a54211-6000106-Program~Handle System.Net.HttpListenerContext::get_Request() at 508f73a1ce5cedac78af578585a54211-6000107-Program~HandleApi MloCreator.Program::Handle(System.Net.HttpListenerContext) at 508f73a1ce5cedac78af578585a54211-6000109-Program~AcceptLoopb__647:T496,Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.28.11 on port 80 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 142.251.41.174 on port 443 (TCP); Domain: "clients2.google.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 142.250.72.1 on port 443 (TCP); Domain: "clients2.googleusercontent.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 199.232.210.172 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.22.17 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.28.11 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.27.11 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 172.217.117.4 on port 443 (TCP); Domain: "www.googleapis.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.110.7 on port 443 (TCP); Domain: "edge-consumer-static.azureedge.net"48:T6fc,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAFA0lEQVR4XsVXa1CUVRjmd6PsjzIgTJsMMRlhV64KctkZLi7iLi6yoAJJVJjUInGJCScCWZAFV7mICCqKQhEipVxiCMbQwXGaopQw6ULeZmpGHMUmrJync863u+zu97msm9SZeQb2vO953+e8l3O+4+AgMESLvSByJXB5QiC2nlrgC0s/vDHPxRvzncQQPTdX8IKjs0SYCBWKnLwEFs0BSFT+P+d6mEWCERBQsgZlug4fHDuH+Ixqnsw2kCgsDoGDPTvfUdmHD78BPrsFtF0GsqsGzeRPL/TD0vBiLI8pg1t4IW+9AfNdVxICtEoFhELwDE5CadtV9NwAanrv4k3NGVR3TaL3JlDe/hN8wtKYnv+r3dh0BNhQBWzcD0hUTTxbDLQWbCWgSK9A/cBd9BLnuz8ehyQ0mc2vCJRD0zKGnutAw9kpxG3T4Vn/PESX3UF8PRj803p49h6LQEZZFwt5+3dA1t5+4/zL0aXk7yr2v7q8B22XuJRklnfC0VWGkJxRJJ0A/EhELG3aRMAtQIldJ0bRTXbXOPQ7VOr9epk3gtUX2O7WFt3C86t3sHlamAcH77EUlbZchoc4Et5pffDb2sWzPSsBWUoJ6vpvs0LTdkwgIOINNr8oMBNRhdeZc0Ull2NF5R/w0udZHLIZZW3jrC7qByYRk/Iez/asBNKLOnD8S+DU90BOzRfGeU/lIcgrH2BTE+dYWc2R2LAPiKsFgt46Z9TN0n2Ok2NA69fAdk0nz4cggSWeMhQ2jeDMBHDk/DS2ZB8yyoIyhrCxDlhXeg8hWd8ilCBi503IKx4yMrE6ruAi3/8FC1dy0aIpo6nrvgYUN1+Cuzj20QQiEwtIa/3GQq779AaCYtRsnhqL2PkzVPXcrsNyR7EkONNoxE2aj7B3Rlg0aCSojrz8PlbEHmByv8jXoD01wezW9t2GLKlYmEDzReCTH4H8A8NwIkVG5zzktVivnWI7l1cQaDknFLKSX7E0oshozDOukehMc/IqLj2B2waM8ryaIXSOk5SMAOEJ7/IJaD4aQ2pBq36BNwJe72dGlFWcY0bAAJJ31UHaAZMQvcCRpVgWVQbFnmkCMNCUhBf8AGdxKpMn5zVhd/sY/KO4A4tXA6a7SWjkjJg5NgGNSmj2KG+tNOcKEhpm9BIPC+tZJSDZ3DoTdktoufDKK/6Cq88rvLX+qd2E+JReh3QHqQlp3lWennUCquNcMVk6p31PiMXufciiRHUXuMkgSTgM35QWLPLmQu3ioYQ0d4yRYARyr/B8WCeQyCdA24wajCq6Bg9FnZFoTPkkI7XlGLAqfeZWXJ1+ltn49wRIyGPpQVNDzvTU00YdseooK1BlDadHqz961x3WGT7JJ9lvekjZR8CQAtp2VTTkf7M5U511mvtG5waiBqd0jaGA7SNAI1CrL7Y9D+ARs89MHrT9PIsIr0Yq9I4rZ37bRyC+mbUP7Wn3tVozGa1ymnO6U0vnQrCLgG9KBwnjNPmcKjGb90nu5G4/K+eDJWZvQ4EP0uXrdXhJanJmU1JbT7Mbj3aDpZNHQsudmPTisvRB4egiFiZgimeWRWON+iJrM2qMht9WqBpoqv40uzPMQCNAxzwrryH3SA05Xr9C8NsXEJgxjDU2Ilg9TL4PBvFiSD7PJoOTyXNttijMCQy7NwyR839IgjqnjxLLQYvCnofK40Ei7NwwGAHamk8YjsQxfX1b+vsHy2FOOP28PQgAAAAASUVORK5CYII=1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"06eaa4756b6f505d71fa66896a4270f95201794f47370a28e2f710fadf99cdd8","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":70,"unified_at_epoch_ms":1793753070448,"unified_at":"2026-11-04T00:44:30.448Z","metadata":{"hashes":{"sha256":"06eaa4756b6f505d71fa66896a4270f95201794f47370a28e2f710fadf99cdd8","sha1":"5f2d9719cca8d11de3b510c31a9e9f4bbe38f7bc","md5":"508f73a1ce5cedac78af578585a54211","sha512":"87635386ac82cae984f6189df730bdfa0a6ddb3fb9a6206e5cf5259cbb7bfbf76596e102bef171f611621b61f66652899556646a5d80868fb5fec342d8063316","ssdeep":"6144:4U4/nL3uQftA6q9x3nxgimuXmArEQSFKYjJYSa27LE61tM:4U4/4sXuXmtQSFKYjJYSa2/EX","ssdeep_chunks":["6144:4U4/nL3","6144:U4/nL3u","6144:4/nL3uQ","6144:/nL3uQf","6144:nL3uQft","6144:L3uQftA","6144:3uQftA6","6144:uQftA6q","6144:QftA6q9","6144:ftA6q9x","6144:tA6q9x3","6144:A6q9x3n","6144:6q9x3nx","6144:q9x3nxg","6144:9x3nxgi","6144:x3nxgim","6144:3nxgimu","6144:nxgimuX","6144:xgimuXm","6144:gimuXmA","6144:imuXmAr","6144:muXmArE","6144:uXmArEQ","6144:XmArEQS","6144:mArEQSF","6144:ArEQSFK","6144:rEQSFKY","6144:EQSFKYj","6144:QSFKYjJ","6144:SFKYjJY","6144:FKYjJYS","6144:KYjJYSa","6144:YjJYSa2","6144:jJYSa27","6144:JYSa27L","6144:YSa27LE","6144:Sa27LE6","6144:a27LE61","6144:27LE61t","6144:7LE61tM","12288:4U4/nL3","12288:U4/nL3u","12288:4/nL3uQ","12288:/nL3uQf","12288:nL3uQft","12288:L3uQftA","12288:3uQftA6","12288:uQftA6q","12288:QftA6q9","12288:ftA6q9x","12288:tA6q9x3","12288:A6q9x3n","12288:6q9x3nx","12288:q9x3nxg","12288:9x3nxgi","12288:x3nxgim","12288:3nxgimu","12288:nxgimuX","12288:xgimuXm","12288:gimuXmA","12288:imuXmAr","12288:muXmArE","12288:uXmArEQ","12288:XmArEQS","12288:mArEQSF","12288:ArEQSFK","12288:rEQSFKY","12288:EQSFKYj","12288:QSFKYjJ","12288:SFKYjJY","12288:FKYjJYS","12288:KYjJYSa","12288:YjJYSa2","12288:jJYSa27","12288:JYSa27L","12288:YSa27LE","12288:Sa27LE6","12288:a27LE61","12288:27LE61t","12288:7LE61tM","6144:4U4/4sX","6144:U4/4sXu","6144:4/4sXuX","6144:/4sXuXm","6144:4sXuXmt","6144:sXuXmtQ","6144:XuXmtQS","6144:uXmtQSF","6144:XmtQSFK","6144:mtQSFKY","6144:tQSFKYj","6144:jJYSa2/","6144:JYSa2/E","6144:YSa2/EX"]},"file_info":{"file_name":"MloCreator.exe","file_type":["peexe","64bits","assembly","executable"],"file_type_id":"64-bit .NET exe","file_size":273408,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793752701000,"last_seen":1793752701000,"last_multi_scan":1793752701000}},"detections":{"summary":{"verdict":"suspicious","score":70,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":77},"sandbox_signatures":{"informative_count":190,"suspicious_count":12,"malicious_count":1,"total":203},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Win64.MSIL_Heur","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access recent files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Reference explorer.exe process"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":".NET source code contains suspicious native API"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Able to execute application (.NET)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Able to gather system file/directory information (.NET)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to gather system environment details"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Stealth","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Found registry key string for installed applications"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"},{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Able to decode string content at runtime (.NET)"},{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Able to access Steam setting"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies data"},{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","identifiers":[{"type":"suspicious","value":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Discovery","technique":"Cloud Service Dashboard","attack_id":"T1538","attack_id_wiki":"https://attack.mitre.org/techniques/T1538","identifiers":[{"type":"informative","value":"Able to retrieve cloud service dashboard"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen information (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"suspicious","value":"Contacts Google apis domains (possible C&C communication)"},{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"References URL in command line"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Able to download payload via Wget"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Dotnet code contains ability to establish a HTTP listener"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"},{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","identifiers":[{"type":"suspicious","value":"Shows ability to use external web service to exfiltrate data"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"},{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"MessageBox\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"ExtractAssociatedIcon\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"CreateDirectory\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"QueueUserWorkItem\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"FillRect\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetEnvironmentVariable\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"file/memory contains long string with (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"HKEY_CURRENT_USER\\Software\\Valve\\Steam|SteamPath\" in Source: sample.bin, \"HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Valve\\Steam|InstallPath\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1018","id":"string-417","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://schemas.microsoft.com/smi/2005/windowssettings\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"0.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"ToBase64String\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"ToBase64String\" (Indicator: \"ToBase64String\"; Source: \"sample.bin\"), Found string \"FromBase64String\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"sample.bin\"), Found string \"data:image/jpeg;base64,\" (Indicator: \"base64\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-107","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetLastWriteTimeUtc\" (Indicator: \"GetLastWriteTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"file/memory contains long string with (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to access Steam setting","description":"Found string \"HKEY_CURRENT_USER\\Software\\Valve\\Steam|SteamPath\" (Indicator: \"software\\valve\\steam\"; Source: \"sample.bin\"), Found string \"HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Valve\\Steam|InstallPath\" (Indicator: \"software\\wow6432node\\valve\\steam\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1518","id":"string-763","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-106","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-481","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"DecompressionStream\" (Source: \"00000000-00004624.00000000.301724.94430000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"MloCreator.exe\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"Copy\" in \"MloCreator.exe\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"MloCreator.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread failed\" (Indicator: \"ResumeThread\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$29","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00008412-00000BC0-2987264448\")\n Found reference to \"SHA512 block transform for x86_64, CRYPTOGAMS by \" (Indicator: \"SHA512\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.LoadFrom\" in \"MloCreator.exe\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 6CA50000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"MloCreator.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"MloCreator.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"MloCreator.exe\" queried SystemProcessInformation at 00000000-00008412-00000C15-2987763824 [PID: 8412]\n \"MloCreator.exe\" queried SystemProcessInformation at 00000000-00008412-00000C15-2987779233 [PID: 8412]\n \"MloCreator.exe\" queried SystemProcessInformation at 00000000-00008412-00000C15-2987924906 [PID: 8412]\n \"MloCreator.exe\" queried SystemProcessInformation at 00000000-00008412-00000C15-2987931928 [PID: 8412]\n \"identity_helper.exe\" queried SystemProcessInformation at 00000000-00004624-00000C15-3002689122 [PID: 4624]\n \"identity_helper.exe\" queried SystemProcessInformation at 00000000-00004624-00000C15-3002696935 [PID: 4624]\n \"identity_helper.exe\" queried SystemProcessInformation at 00000000-00004624-00000C15-3002875722 [PID: 4624]\n \"identity_helper.exe\" queried SystemProcessInformation at 00000000-00004624-00000C15-3002883708 [PID: 4624]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"MloCreator.exe\"\n Observed function \"ToBase64String\" in \"MloCreator.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"fromCharCodeU\" (Indicator: \"fromcharcode\"; Source: \"00000000-00004624.00000000.301724.94430000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"file/memory contains long string with (Indicator: \"public key\"; Source: \"00000000-00004624.00000000.301724.944F0000.00000002.mdmp\")\n Found string \"=0 {Checking public key and integrity block\" (Indicator: \"public key\"; Source: \"00000000-00004624.00000000.301724.944F0000.00000002.mdmp\")\n Found string \"=1 {Checking public key and integrity block\" (Indicator: \"public key\"; Source: \"00000000-00004624.00000000.301724.944F0000.00000002.mdmp\")\n Found string \"other {Checking public key and integrity block\" (Indicator: \"public key\"; Source: \"00000000-00004624.00000000.301724.944F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Able to decode string content at runtime (.NET)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 164039; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 110413; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 254039; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"youtube.com\"; Source: \"00000000-00004624.00000000.301724.944F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008412-00000C2C-2994219914\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetFiles\" in \"MloCreator.exe\"\n Observed dotnet function \"GetDirectories\" in \"MloCreator.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"::GetUserNameW\" (Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008412-00000C2C-2994219914\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"::WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"file/memory contains long string with (Indicator: \"/cookies\"; Source: \"00000000-00004624.00000000.301724.944F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\"\n Found system information discovery API: \"GetNativeSystemInfo\" in \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp, 00000000-00004624.00000001.302168.4C961000.00000002.mdmp\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"Mojo.Channel.WriteSendMessageProcessType\" (Indicator: \"sendmessage\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"findwindow\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"postMessage\" (Indicator: \"postmessage\"; Source: \"00000000-00004624.00000000.301724.94430000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"MloCreator.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00008412)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"MloCreator.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00008412)\n \"MloCreator.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00008412)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"MloCreator.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00008412)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"identity_helper.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004624)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system environment details","description":"Observed function \"GetEnvironmentVariable\" in \"MloCreator.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-119","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"GetAvailableBrowserVersionString\" in \"MloCreator.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"MloCreator.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"MloCreator.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"identity_helper.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set where the model stands (Import tab) to see the collision.\" (Indicator: \"set \"; File: \"MloCreator.exe\")\n Found string \"Set where the model stands (Import tab) first.\" (Indicator: \"set \"; File: \"MloCreator.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"MloCreator.exe\" queried token user identity (UID: 00000000-00008412)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"MloCreator.exe\" queries volume information of \"C:\\MloCreator.exe\" at 00000000-00008412-00000C17-2987268057\n \"MloCreator.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Web.Extensions\\v4.0_4.0.0.0__31bf3856ad364e35\\System.Web.Extensions.dll\" at 00000000-00008412-00000C17-2987329809","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"MloCreator.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"identity_helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"MloCreator.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"\"msedge.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":".NET source code contains suspicious native API","description":"Observed API \"LoadLibrary\" in \"MloCreator.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":5,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Able to execute application (.NET)","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"MloCreator.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":3,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"MloCreator.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\MloCreator (UID: 00000000-00008412)\n \"MloCreator.exe\" called \"CreateDirectoryW\" with parameter C:\\logs (UID: 00000000-00008412)\n \"MloCreator.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\MloCreator\\window (UID: 00000000-00008412)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"MloCreator.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --app=http://127.0.0.1:47770/ --user-data-dir=\"C:\\Users\\MmA3yBc\\App\" - (UID: 00000000-00008412)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2e","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"142.251.41.174:443\"\n \"142.250.72.1:443\"\n \"172.217.117.4:443\"\n \"150.171.110.7:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000000.301724.5ED04000.00000002.mdmp, 00000000-00004624.00000000.301724.642D5000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp, 00000000-00004624.00000001.302168.4C961000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000000.301724.5ED04000.00000002.mdmp, 00000000-00004624.00000000.301724.642D5000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"MloCreator.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$30","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"MloCreator.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\shell32.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"MloCreator.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"appro@openssl.org\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"LoadLibrary\" in \"MloCreator.exe\"\n Observed unmanaged function \"SetDllDirectory\" in \"MloCreator.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - EDGE_CRASHPAD_PIPE_NAME=\\\\.\\pipe\\crashpad_916_AIWGBXZJAOKOAAAN\n Found string - \\\\.\\pipe\\LOCAL\\mojo.\n Found string - \\\\.\\pipe\\mojo.\n Found string - \\\\.\\pipe\\\n Found string - \\\\.\\pipe\\crash","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$31","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"$32","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$33","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"MloCreator.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\6078762b90671c2ff9ba39318e2176d8\\mscorlib.ni.dll\" at 4DE40000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"MloCreator.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 77BC0000\n \"MloCreator.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 78320000\n \"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 77BC0000\n \"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 78320000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"MloCreator.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 4F4A0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"MloCreator.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 785F0000\n \"identity_helper.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 785F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000060a31578ff7f0000@ntdll.dll\"\n \"220023000000000038a31578ff7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"MloCreator.exe\" was detected as \".NET\" and name: \"Library\"\n \"MloCreator.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"MloCreator.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"MloCreator.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"MloCreator.exe\" file has an entrypoint instructions - \"pop\tr10,nop\t,add\tbyte ptr [rbx], al,add\tbyte ptr [rax], al,add\tbyte ptr [rax + rax], al,add\tbyte ptr [rax], al,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"MloCreator.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$34","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"clients2.google.com\"\n \"clients2.googleusercontent.com\"\n \"edge-consumer-static.azureedge.net\"\n \"www.googleapis.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"MloCreator.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"MloCreator.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"MloCreator.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")\n \"identity_helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"identity_helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\mscorrc.dll\" [Source: 00000000-00008412-00000C2B-2988917809]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\en\\mscorrc.dll\" [Source: 00000000-00008412-00000C2B-2988943317]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll\" [Source: 00000000-00008412-00000C2B-2988970802]\n Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\shell32.dll\" [Source: 00000000-00008412-00000C2B-2989069230]\n Observed system executable string:\"%WINDIR%\\system32\\en-US\\tzres.dll.mui\" [Source: 00000000-00008412-00000C2B-2989357474]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$35","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$36","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$37","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"file/memory contains long string(Source: \"00000000-00004624.00000000.301724.944F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"MloCreator.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"identity_helper.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"window.log\" has type \"ASCII text with very long lines (326) with CRLF line terminators\"- Location: [C:\\logs\\window.log]- [targetUID: 00000000-00008412]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$38","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"MloCreator.exe\" queries basic process information of the \"C:\\MloCreator.exe\" (UID: 8412)\n \"MloCreator.exe\" queries basic process information of the \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" (UID: 8412)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$39","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$3a","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"MloCreator.exe\" trying to touch file \"C:\\Windows\\System32\\mscoree.dll\"\n \"MloCreator.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\MSCOREE.DLL\"\n \"MloCreator.exe\" trying to touch file \"\\Device\\KsecDD\"\n \"MloCreator.exe\" trying to touch file \"C:\\Windows\\System32\\MSCOREE.DLL.local\"\n \"MloCreator.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\MSCOREE.DLL.local\"\n \"MloCreator.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\"\n \"MloCreator.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll\"\n \"MloCreator.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll\"\n \"MloCreator.exe\" trying to touch file \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\"\n \"MloCreator.exe\" trying to touch file \"C:\\MloCreator.exe.config\"\n \"MloCreator.exe\" trying to touch file \"C:\\MloCreator.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"MloCreator.exe\" writes file \"c:\\logs\\window.log\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"MloCreator.exe\" writes a file \"C:\\logs\\window.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Network Related","name":"Able to download payload via Wget","description":"file/memory contains long string(Source: \"00000000-00004624.00000000.301724.944F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-963","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve cloud service dashboard","description":"file/memory contains long string(Source: \"00000000-00004624.00000000.301724.944F0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1538","relevance":1,"id":"string-777","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipe\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"GetNamedPipeClientProcessId\" (Indicator: \"GetNamedPipe\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"GetNamedPipeServerProcessId\" (Indicator: \"GetNamedPipe\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"MloCreator.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Network Related","name":"Dotnet code contains ability to establish a HTTP listener","description":"$3e","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-147","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"www.googleapis.com\" (Indicator: \".googleapis.com\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3f","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"clients2.googleusercontent.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"edge-consumer-static.azureedge.net\" (7 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://127.0.0.1:47770\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"clients2.google.com\" (83 days old)\n Short term registered certificate: \"clients2.googleusercontent.com\" (83 days old)\n Short term registered certificate: \"www.googleapis.com\" (83 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"142.251.41.174\" on port \"443\"\n HTTPS traffic to \"142.250.72.1\" on port \"443\"\n HTTPS traffic to \"172.217.117.4\" on port \"443\"\n HTTPS traffic to \"150.171.110.7\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"::WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"B+ncalrpc:[OLE3E110A9D162910813B4C11196737]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004624.00000000.301724.9227C000.00000004.mdmp, 00000000-00004624.00000001.302168.9227C000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLE72C7EA2A1D8494EB6DC9662F613A]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004624.00000000.301724.9227C000.00000004.mdmp, 00000000-00004624.00000001.302168.9227C000.00000004.mdmp\")\n Found string \"F+ncalrpc:[OLE87B4871C1ED2EDE06E0D9160E7EA]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004624.00000000.301724.9227C000.00000004.mdmp, 00000000-00004624.00000001.302168.9227C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--user-data-dir=\\\"\" (Indicator: \"--user-data-dir\"; File: \"MloCreator.exe\"), Found string \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --app=http://127.0.0.1:47770/ --user-data-dir=\"C:\\Users\\MmA3yBc\\App\" (Indicator: \"--user-data-dir\"; Source: \"00000000-00008412-00000C47-4731346491\")\n Found string \"--app=http://127.0.0.1:47770/ --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --window-size=1600,960 --no-first-run --no-default-browser-check --disable-features=Translate\" (Indicator: \"--user-data-dir\"; File: \"msedge.exe\")\n file/memory contains long string with (Indicator: \"--user-data-dir\"; File: \"msedge.exe\")\n file/memory contains long string with (Indicator: \"--user-data-dir\"; File: \"identity_helper.exe\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegEnumKeyExW\" in \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\"\n Found registry query API: \"NtQueryValueKey\" in \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"::GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"::WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"NtQueryObject-type_info_length\" (Indicator: \"NtQueryObject\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")\n Found reference to API \"NtQueryObject\" (Indicator: \"NtQueryObject\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"MloCreator.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"identity_helper.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"identity_helper.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen information (Dotnet)","description":"Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_AllScreens\" in \"MloCreator.exe\"","origin":"Static Parser","mitre_attack_id":"T1113","relevance":1,"id":"static-164","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExFromAppW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"FindFirstFileEx\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp, 00000000-00004624.00000001.302168.4C961000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp, 00000000-00004624.00000001.302168.4C961000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp, 00000000-00004624.00000001.302168.4C961000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000000.301724.5ED04000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp, 00000000-00004624.00000001.302168.4C961000.00000002.mdmp\")\n Found reference to API \"__vcrt_GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004624.00000000.301724.5ED04000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000000.301724.5ED04000.00000002.mdmp, 00000000-00004624.00000000.301724.642D5000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp, 00000000-00004624.00000001.302168.4C961000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000000.301724.5ED04000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")\n Found reference to API \"__vcrt_GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004624.00000000.301724.5ED04000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$41","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Microsoft\\Windows\\CurrentVersion\\App Paths\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\"\n Found registry deletion API: \"NtDeleteKey\" in \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\"\n Found registry deletion API: \"NtDeleteValueKey\" in \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"DriverData=C:\\Windows\\System32\\Drivers\\DriverData\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00004624.00000000.301724.00050000.00000004.mdmp, 00000000-00004624.00000000.301724.00060000.00000004.mdmp, 00000000-00004624.00000000.301724.92300000.00000004.mdmp, 00000000-00004624.00000001.302168.00050000.00000004.mdmp, 00000000-00004624.00000001.302168.00060000.00000004.mdmp, 00000000-00004624.00000001.302168.92300000.00000004.mdmp\")\n Found string \"DriverData=C:\\Windows\\System32\\Drivers\\DriverData\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00004624.00000000.301724.00050000.00000004.mdmp, 00000000-00004624.00000000.301724.00060000.00000004.mdmp, 00000000-00004624.00000000.301724.92300000.00000004.mdmp, 00000000-00004624.00000001.302168.00050000.00000004.mdmp, 00000000-00004624.00000001.302168.00060000.00000004.mdmp, 00000000-00004624.00000001.302168.92300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcessWithToken\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileWithDispositionFlags\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"DoDeleteFile\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"DeleteFile\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"RemoveDirectory\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"NtSetInformationFile\" (Indicator: \"SetInformationFile\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"NtSetInformationFile\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.4C961000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00004624.00000000.301724.0018C000.00000004.mdmp\n 00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\n 00000000-00004624.00000001.302168.00190000.00000004.mdmp\n 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000000.301724.5ED04000.00000002.mdmp, 00000000-00004624.00000000.301724.642D5000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp, 00000000-00004624.00000001.302168.4C961000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp, 00000000-00004624.00000001.302168.2A330000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"MloCreator.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"MloCreator.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\PROGRAM FILES (X86)\\MICROSOFT\\EDGE\\APPLICATION\\MSEDGE.EXE\"; Value: \"26541A00F56BDD010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"MloCreator.exe\" opened \"\\Device\\KsecDD\"\n \"msedge.exe\" opened \"\\Device\\KsecDD\"\n \"identity_helper.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$44","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"MloCreator.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\PROGRAM FILES (X86)\\MICROSOFT\\EDGE\\APPLICATION\\MSEDGE.EXE\"; Value: \"26541A00F56BDD010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00004624.00000000.301724.4CCF1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"FillRect\" (Source: MloCreator.exe, API is part of module: USER32.DLL)\n Found string \"Rectangle\" (Source: MloCreator.exe, API is part of module: GDI32FULL.DLL)\n Found string \"SetPixel\" (Source: MloCreator.exe, API is part of module: GDI32FULL.DLL)\n Found string \"QueueUserWorkItem\" (Source: MloCreator.exe, API is part of module: KERNELBASE.DLL)\n Found string \"GetFileSize\" (Source: MloCreator.exe, API is part of module: KERNELBASE.DLL)\n Found string \"remove\" (Source: MloCreator.exe, API is part of module: UCRTBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"MloCreator.exe\" was detected as \"Microsoft Visual C++ vx.x DLL\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"MloCreator.exe\" has section name .rsrc with entropy \"7.776936703302457\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/26 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"MloCreator.exe\" has resource with unusual entropy \"RT_ICON:7.928166404756206\"\n \"MloCreator.exe\" has resource with unusual entropy \"RT_ICON:7.909094829341863\"\n \"MloCreator.exe\" has resource with unusual entropy \"RT_ICON:7.854600175806049\"\n \"MloCreator.exe\" has resource with unusual entropy \"RT_ICON:7.807338056715712\"\n \"MloCreator.exe\" has resource with unusual entropy \"RT_ICON:7.588691748963157\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"suspicious","category":"General","name":"PE file with no import directory","description":"\"MloCreator.exe\" has no \"IMAGE_DIRECTORY_ENTRY_IMPORT\"","origin":"Static Parser","relevance":5,"id":"static-90","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"suspicious","category":"General","name":"References URL in command line","description":"Process \"msedge.exe\" with commandline \"--app=http://127.0.0.1:47770/ --user-data-dir=\"%LOCALAPPDATA%\\\\MloCreator\\\\window\" --window-size=1600,960 --no-first-run --no-default-browser-check --disable-features=Translate\" (UID: 00000000-00000916)","origin":"Monitored Target","mitre_attack_id":"T1105","relevance":1,"id":"target-174","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"suspicious","category":"Network Related","name":"Contacts Google apis domains (possible C&C communication)","description":"\"www.googleapis.com\"","origin":"Network Traffic","mitre_attack_id":"T1102","relevance":5,"id":"network-49","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"$45","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1040","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"$46","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"suspicious","category":"Network Related","name":"Shows ability to use external web service to exfiltrate data","description":"The analysis shows possible data exfiltration using popular external web services. Matched sigs: Contacts Google apis domains (possible C&C communication)","origin":"Indicator Combinations","mitre_attack_id":"T1567","relevance":1,"id":"summary-37","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"$47","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"other {Some of these files are encrypted. Ask their owner to decrypt.}}Your administrator says: \"$1\"$1 has sensitive or dangerous data. Your administrator says: \"$2\"Discard filePlease enter a reason for uploading this data:Please enter a reason for pasting this data:Please enter a reason for printing this data:Please enter a reason for downloading this data:Save to cloud storage$1 has sensitive or dangerous data. Your organization will let you save it to cloud storage or discard itData SharingGet more protection against dangerous websites and downloadsClose tipEnhanced Safe Browsing is offYou have Microsoft Edge's strongest security against dangerous websites, downloads and extensionsYou're getting standard security protection. To get more protection against dangerous websites, downloads, and extensions, turn on Enhanced Safe Browsing in Microsoft Edge settings.Microsoft Edge settings{NUM_SUB_APPS, plural,\" (Source: 00000000-00004624.00000000.301724.944F0000.00000002.mdmp, Indicator: \"files are encrypted\")","origin":"File/Memory","mitre_attack_id":"T1491.001","relevance":5,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"MloCreator.exe\" wrote 000011C0 bytes to a remote process \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" (Handle: 1040)\n \"MloCreator.exe\" wrote 00000008 bytes to a remote process \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" (Handle: 1040)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]}],"intel_graph":{"map":{"Domain:clients2.google.com":{"type":"Domain","value":"clients2.google.com"},"Domain:clients2.googleusercontent.com":{"type":"Domain","value":"clients2.googleusercontent.com"},"Domain:edge-consumer-static.azureedge.net":{"type":"Domain","value":"edge-consumer-static.azureedge.net"},"Domain:www.googleapis.com":{"type":"Domain","value":"www.googleapis.com"},"File:06eaa4756b6f505d71fa66896a4270f95201794f47370a28e2f710fadf99cdd8":{"type":"File","value":"06eaa4756b6f505d71fa66896a4270f95201794f47370a28e2f710fadf99cdd8"},"File:9be7b0921650a31ac8babee40f0651947054bca19f8623971425aab21024a18f":{"type":"File","value":"9be7b0921650a31ac8babee40f0651947054bca19f8623971425aab21024a18f"},"Ip:142.250.72.1":{"type":"Ip","value":"142.250.72.1"},"Ip:142.251.41.174":{"type":"Ip","value":"142.251.41.174"},"Ip:150.171.110.7":{"type":"Ip","value":"150.171.110.7"},"Ip:172.217.117.4":{"type":"Ip","value":"172.217.117.4"}},"chains":[{"id":"sandbox_network","root":"File:06eaa4756b6f505d71fa66896a4270f95201794f47370a28e2f710fadf99cdd8","edges":[{"edge_kind":"contacted_ip","from_key":"File:06eaa4756b6f505d71fa66896a4270f95201794f47370a28e2f710fadf99cdd8","to_key":"Ip:142.251.41.174"},{"edge_kind":"contacted_ip","from_key":"File:06eaa4756b6f505d71fa66896a4270f95201794f47370a28e2f710fadf99cdd8","to_key":"Ip:142.250.72.1"},{"edge_kind":"contacted_ip","from_key":"File:06eaa4756b6f505d71fa66896a4270f95201794f47370a28e2f710fadf99cdd8","to_key":"Ip:172.217.117.4"},{"edge_kind":"contacted_ip","from_key":"File:06eaa4756b6f505d71fa66896a4270f95201794f47370a28e2f710fadf99cdd8","to_key":"Ip:150.171.110.7"},{"edge_kind":"contacted_domain","from_key":"File:06eaa4756b6f505d71fa66896a4270f95201794f47370a28e2f710fadf99cdd8","to_key":"Domain:clients2.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:clients2.google.com","to_key":"Ip:142.251.41.174"},{"edge_kind":"contacted_domain","from_key":"File:06eaa4756b6f505d71fa66896a4270f95201794f47370a28e2f710fadf99cdd8","to_key":"Domain:clients2.googleusercontent.com"},{"edge_kind":"resolves_to","from_key":"Domain:clients2.googleusercontent.com","to_key":"Ip:142.250.72.1"},{"edge_kind":"contacted_domain","from_key":"File:06eaa4756b6f505d71fa66896a4270f95201794f47370a28e2f710fadf99cdd8","to_key":"Domain:edge-consumer-static.azureedge.net"},{"edge_kind":"resolves_to","from_key":"Domain:edge-consumer-static.azureedge.net","to_key":"Ip:150.171.110.7"},{"edge_kind":"contacted_domain","from_key":"File:06eaa4756b6f505d71fa66896a4270f95201794f47370a28e2f710fadf99cdd8","to_key":"Domain:www.googleapis.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.googleapis.com","to_key":"Ip:172.217.117.4"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:06eaa4756b6f505d71fa66896a4270f95201794f47370a28e2f710fadf99cdd8","edges":[{"edge_kind":"extracted","from_key":"File:06eaa4756b6f505d71fa66896a4270f95201794f47370a28e2f710fadf99cdd8","to_key":"File:9be7b0921650a31ac8babee40f0651947054bca19f8623971425aab21024a18f"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":37,"spawned_processes_count":37,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":83,"imported_dlls_count":202,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":37,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":4,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6aea7e7d63b595a363013693","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":91,"malware_family":"Trojan.Win64.MSIL_Heur","contacted_countries":["USA"],"submit_name":"MloCreator.exe","analysis_start_time":"2026-11-04T00:38:22+00:00","indicators_count":{"informative":187,"suspicious":20,"malicious":1},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"142.251.41.174","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"address":"142.250.72.1","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"address":"172.217.117.4","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"address":"150.171.110.7","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]}],"dns_resolutions":[{"domain":"clients2.google.com","address":"142.251.41.174","ttl":34,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"domain":"clients2.googleusercontent.com","address":"142.250.72.1","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"domain":"edge-consumer-static.azureedge.net","address":"150.171.110.7","ttl":905,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"domain":"www.googleapis.com","address":"172.217.117.4","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}],"processes":[{"pid":8412,"ppid":0,"name":"MloCreator.exe","command_line":"","sha256":"06eaa4756b6f505d71fa66896a4270f95201794f47370a28e2f710fadf99cdd8","normalized_path":"C:\\MloCreator.exe","uid":"00000000-00008412","icon":"$48"},{"pid":916,"ppid":8412,"name":"msedge.exe","command_line":"--app=http://127.0.0.1:47770/ --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --window-size=1600,960 --no-first-run --no-default-browser-check --disable-features=Translate","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008412","uid":"00000000-00000916"},{"pid":1804,"ppid":916,"name":"msedge.exe","command_line":"--type=crashpad-handler --user-data-dir=%LOCALAPPDATA%\\MloCreator\\window /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=%LOCALAPPDATA%\\MloCreator\\window\\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x26c,0x270,0x274,0x268,0x298,0x7fff4cde0f18,0x7fff4cde0f24,0x7fff4cde0f30","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00001804"},{"pid":3824,"ppid":916,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --startup-read-main-dll --metrics-shmem-handle=2016,i,2755295707895734485,6893540112418397994,524288 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2596 /prefetch:3","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00003824"},{"pid":3732,"ppid":916,"name":"msedge.exe","command_line":"--type=gpu-process --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1816,i,1756029313602488419,2603619875133586188,262144 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2548 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00003732"},{"pid":2972,"ppid":916,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --startup-read-main-dll --metrics-shmem-handle=2268,i,2881408788119435504,15385249801772134613,524288 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3168 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00002972"},{"pid":2020,"ppid":916,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1793748093564010 --launch-time-ticks=4698876399 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3384,i,16209834589910585414,15948471841379804842,2097152 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3432 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00002020"},{"pid":2324,"ppid":916,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1793748093564010 --launch-time-ticks=4698900488 --skip-read-main-dll --metrics-shmem-handle=3392,i,7010095032954143597,1752264085961967928,2097152 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3472 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00002324"},{"pid":3920,"ppid":916,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1793748093564010 --launch-time-ticks=4698978123 --skip-read-main-dll --metrics-shmem-handle=3964,i,2711236971705977760,8383386620773856454,2097152 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4000 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00003920"},{"pid":7492,"ppid":916,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1793748093564010 --launch-time-ticks=4698979262 --skip-read-main-dll --metrics-shmem-handle=3980,i,14631397099401705585,4792427909093417919,2097152 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4072 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00007492"},{"pid":432,"ppid":916,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --time-ticks-at-unix-epoch=-1793748093564010 --launch-time-ticks=4698979977 --skip-read-main-dll --metrics-shmem-handle=4064,i,16032488173544371299,14743963971851879144,2097152 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4076 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00000432"},{"pid":7400,"ppid":916,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1793748093564010 --launch-time-ticks=4698992557 --skip-read-main-dll --metrics-shmem-handle=4156,i,1657463751464781787,17278121211334143857,2097152 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4256 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00007400"},{"pid":6020,"ppid":916,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --time-ticks-at-unix-epoch=-1793748093564010 --launch-time-ticks=4698993190 --skip-read-main-dll --metrics-shmem-handle=4192,i,3482324009449137389,5262017238509373013,2097152 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4116 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00006020"},{"pid":5740,"ppid":916,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --time-ticks-at-unix-epoch=-1793748093564010 --launch-time-ticks=4699000189 --skip-read-main-dll --metrics-shmem-handle=4212,i,16196678346657634637,9620292654832082265,2097152 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4176 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00005740"},{"pid":5732,"ppid":916,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --time-ticks-at-unix-epoch=-1793748093564010 --launch-time-ticks=4699000776 --skip-read-main-dll --metrics-shmem-handle=4228,i,11859999928662067944,10421064538374445284,2097152 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4304 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00005732"},{"pid":8360,"ppid":916,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --time-ticks-at-unix-epoch=-1793748093564010 --launch-time-ticks=4699001970 --skip-read-main-dll --metrics-shmem-handle=4292,i,4085022161766038233,10521639874376942697,2097152 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=4316 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00008360"},{"pid":7076,"ppid":916,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --time-ticks-at-unix-epoch=-1793748093564010 --launch-time-ticks=4699002583 --skip-read-main-dll --metrics-shmem-handle=4268,i,1686593812956493614,8814051307481463022,2097152 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=4360 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00007076"},{"pid":4556,"ppid":916,"name":"msedge.exe","command_line":"--type=renderer --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1793748093564010 --launch-time-ticks=4698990156 --skip-read-main-dll --metrics-shmem-handle=4092,i,8294150294134948565,8945755176987250432,2097152 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4056 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00004556"},{"pid":3244,"ppid":916,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --skip-read-main-dll --metrics-shmem-handle=2012,i,11341133618891538325,8943750755341870763,524288 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=4004 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00003244"},{"pid":6104,"ppid":916,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --skip-read-main-dll --metrics-shmem-handle=6416,i,2102357500946906914,10895324119750268120,524288 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6480 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00006104"},{"pid":224,"ppid":916,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --skip-read-main-dll --metrics-shmem-handle=3960,i,6162784037948095250,8347841090716782662,524288 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=5348 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00000224"},{"pid":5308,"ppid":916,"name":"identity_helper.exe","command_line":"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --skip-read-main-dll --metrics-shmem-handle=7072,i,3450141372876583420,7344547882519925318,524288 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=7092 /prefetch:8","sha256":"21d79cfc88bb39468d68331fb85f9e2c1bfbae2f16192acd0e773709daf534f6","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe","parent_uid":"00000000-00000916","uid":"00000000-00005308"},{"pid":1112,"ppid":916,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --skip-read-main-dll --metrics-shmem-handle=7184,i,1463397344983255310,1078912118354648610,524288 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=7104 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00001112"},{"pid":6916,"ppid":916,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --skip-read-main-dll --metrics-shmem-handle=7332,i,4279568707909103912,10842756074364048450,524288 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=7324 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00006916"},{"pid":8444,"ppid":916,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --skip-read-main-dll --metrics-shmem-handle=7492,i,14533702304449623427,11608705372209848270,524288 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=7500 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00008444"},{"pid":6108,"ppid":916,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --skip-read-main-dll --metrics-shmem-handle=7328,i,13920883897264039995,1389264766248920476,524288 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=7332 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00006108"},{"pid":6192,"ppid":916,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --skip-read-main-dll --metrics-shmem-handle=7320,i,16624382996433331351,18211204211656250202,524288 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=7636 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00006192"},{"pid":4624,"ppid":916,"name":"identity_helper.exe","command_line":"--type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --skip-read-main-dll --metrics-shmem-handle=7072,i,3450141372876583420,7344547882519925318,524288 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=7092 /prefetch:8","sha256":"21d79cfc88bb39468d68331fb85f9e2c1bfbae2f16192acd0e773709daf534f6","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\145.0.3800.58\\identity_helper.exe","parent_uid":"00000000-00000916","uid":"00000000-00004624"},{"pid":8088,"ppid":916,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --skip-read-main-dll --metrics-shmem-handle=6372,i,17623248167741101743,9952627280688544264,524288 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=4064 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00008088"},{"pid":8552,"ppid":916,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --ssd-no-pressure-read-main-dll --metrics-shmem-handle=2728,i,4944785012836545477,1961618745196446124,524288 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=4676 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00008552"},{"pid":2192,"ppid":916,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --skip-read-main-dll --metrics-shmem-handle=4380,i,849819348015637451,7761201859268826822,524288 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=5844 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00002192"},{"pid":9192,"ppid":916,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --skip-read-main-dll --metrics-shmem-handle=4272,i,10630495501751661160,239764462277204107,524288 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=5852 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00009192"},{"pid":2824,"ppid":916,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --skip-read-main-dll --metrics-shmem-handle=3136,i,4678953113493254426,14761738302362314087,524288 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=6632 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00002824"},{"pid":4476,"ppid":916,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --ssd-no-pressure-read-main-dll --metrics-shmem-handle=6736,i,9972922910965104420,10785188242496188298,524288 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=6640 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00004476"},{"pid":2228,"ppid":916,"name":"msedge.exe","command_line":"--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.5794 --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --skip-read-main-dll --metrics-shmem-handle=4060,i,2954348454413312461,1380078441679481425,262144 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=4164 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00002228"},{"pid":4580,"ppid":916,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --skip-read-main-dll --metrics-shmem-handle=4060,i,4066997923289081866,12875785293652106285,524288 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=4416 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00004580"},{"pid":9040,"ppid":916,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir=\"%LOCALAPPDATA%\\MloCreator\\window\" --ssd-no-pressure-read-main-dll --metrics-shmem-handle=5776,i,6464186515005153623,16107682929099282854,524288 --field-trial-handle=2552,i,8745558068489726274,4691191638291571153,262144 --disable-features=Translate --variations-seed-version --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=5400 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000916","uid":"00000000-00009040"}],"all_imported_dlls":["oneds.dll","dwmapi.dll","Windows.StateRepositoryPS.dll","TileDataRepository.dll","ucrtbase.dll","propsys.dll","telclient.dll","Windows.Security.Authentication.Web.Core.dll","cscapi.dll","rmclient.dll","UserMgrProxy.dll","Windows.Internal.Shell.Broker.dll","bcryptprimitives.dll","aadWamExtension.dll","CloudExperienceHostCommon.dll","D3D12.dll","rasadhlp.dll","msvcp140.dll","wkscli.dll","msctf.dll","CoreUIComponents.dll","dxgi.dll","RTWorkQ.dll","shlwapi.dll","mdmregistration.dll","dbghelp.dll","libGLESv2.dll","vk_swiftshader.dll","win32u.dll","MicrosoftAccountWAMExtension.dll","netapi32.dll","urlmon.dll","srvcli.dll","winhttp.dll","msasn1.dll","D3DSCache.dll","advapi32.dll","windows.storage.dll","nlaapi.dll","twinapi.dll","sspicli.dll","coloradapterclient.dll","dcomp.dll","tbs.dll","ntdll.dll","clr.dll","SHCore.dll","httpapi.dll","twinapi.appcore.dll","policymanager.dll","user32.dll","mscorlib.ni.dll","System.Drawing.ni.dll","CoreMessaging.dll","dsreg.dll","ResourcePolicyClient.dll","wscapi.dll","rpcrt4.dll","mscoreei.dll","cryptsp.dll","d3d11.dll","StructuredQuery.dll","TaskFlowDataEngine.dll","msvcrt.dll","dnsapi.dll","oneauth.dll","StartTileData.dll","BCP47Langs.dll","FWPUCLNT.DLL","SystemSettings.DataModel.dll","wininet.dll","msvcp_win.dll","ole32.dll","cryptbase.dll","winmm.dll","WindowManagementAPI.dll","slc.dll","AppXDeploymentClient.dll","Windows.System.UserProfile.DiagnosticsSettings.dll","clrjit.dll","dhcpcsvc.dll","atlthunk.dll","TenantRestrictionsPlugin.dll","D3D12Core.dll","shell32.dll","oleaut32.dll","mscms.dll","netprofm.dll","npmproxy.dll","PCPKsp.dll","mf.dll","mswsock.dll","msedge_elf.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","powrprof.dll","comctl32.dll","IPHLPAPI.DLL","kernel.appcore.dll","ucrtbase_clr0400.dll","uxtheme.dll","rsaenh.dll","DataExchange.dll","oleacc.dll","ffmpeg.dll","KernelBase.dll","bcrypt.dll","winsta.dll","vaultcli.dll","Windows.Web.dll","ntshrui.dll","directml.dll","vcruntime140_clr0400.dll","combase.dll","dmcmnutils.dll","crypt32.dll","InputHost.dll","slwga.dll","Windows.StateRepository.dll","mscoree.dll","netutils.dll","umpdc.dll","WinTypes.dll","cfgmgr32.dll","Windows.System.Profile.RetailInfo.dll","edputil.dll","libEGL.dll","System.Core.ni.dll","TextInputFramework.dll","AssignedAccessRuntime.dll","linkinfo.dll","fwbase.dll","ncryptprov.dll","gdi32.dll","System.Windows.Forms.ni.dll","KBDUS.DLL","clbcatq.dll","userenv.dll","gpapi.dll","Windows.UI.Immersive.dll","wintrust.dll","Windows.UI.dll","OneCoreUAPCommonProxyStub.dll","msvcp110_win.dll","onnxruntime.dll","xmllite.dll","StateRepository.Core.dll","System.Configuration.ni.dll","System.Xml.ni.dll","DWrite.dll","webauthn.dll","wlanapi.dll","PCShellCommonProxyStub.dll","gdi32full.dll","sppc.dll","usermgrcli.dll","ncrypt.dll","mfplat.dll","cabinet.dll","fltLib.dll","psapi.dll","ws2_32.dll","vcruntime140_1.dll","OneCoreCommonProxyStub.dll","Windows.ApplicationModel.dll","imagehlp.dll","DXCore.dll","ntmarta.dll","dhcpcsvc6.dll","secur32.dll","Windows.StateRepositoryCore.dll","Windows.System.Diagnostics.Telemetry.PlatformTelemetryClient.dll","FirewallAPI.dll","microsoft_shell_integration.dll","CryptoWinRT.dll","imm32.dll","nsi.dll","msedge.dll","wtsapi32.dll","directmanipulation.dll","iertutil.dll","wevtapi.dll","d3dcompiler_47.dll","version.dll","System.ni.dll","wldp.dll","profapi.dll","omadmapi.dll","dpapi.dll","Windows.Internal.UI.Shell.WindowTabManager.dll","devobj.dll","VxSSL64.dll","Windows.Storage.Search.dll","cdp.dll","ntasn1.dll","capauthz.dll","BitsProxy.dll","d3d10warp.dll","wpnapps.dll","kernel32.dll","sechost.dll","vcruntime140.dll","setupapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"window.log","sha256":"9be7b0921650a31ac8babee40f0651947054bca19f8623971425aab21024a18f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]}],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"C:\\logs\\window.log","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\crashpad_916_AIWGBXZJAOKOAAAN","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\LOCAL\\mojo.916.3544.11852138139988214956","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\LOCAL\\mojo.916.3544.14765575785860862972","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\LOCAL\\mojo.916.3544.5737417231993356935","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\LOCAL\\mojo.916.8320.3613766356039509394","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\LOCAL\\mojo.916.3544.3333746118364543243","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\LOCAL\\mojo.916.8320.6744136667174249358","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\LOCAL\\mojo.916.8320.9128243450634643252","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\LOCAL\\mojo.916.3544.3012833019320601136","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\LOCAL\\mojo.916.3544.17884227045061404629","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\LOCAL\\mojo.916.8320.5068295557735150539","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\LOCAL\\mojo.916.8320.6768337118740660669","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\LOCAL\\mojo.916.3116.11638788665893352052","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\LOCAL\\mojo.916.3544.13563752766105494544","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\LOCAL\\mojo.916.3544.10454847261698446611","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\LOCAL\\mojo.916.3544.16597721641609057719","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\LOCAL\\mojo.916.3544.10713465990859352591","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\LOCAL\\mojo.916.3544.11805059335398016499","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\LOCAL\\mojo.916.3544.14155291155469847421","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\LOCAL\\mojo.916.3544.12284330080208043281","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\LOCAL\\mojo.916.3544.1214096238176656236","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\LOCAL\\mojo.916.3544.9202439163615397599","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\LOCAL\\mojo.916.3544.16003789637545939405","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\LOCAL\\mojo.916.3544.5919158398307541331","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\LOCAL\\mojo.916.3544.6272481397015187267","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\LOCAL\\mojo.916.3544.348714041213564073","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\LOCAL\\mojo.916.3544.7115920746658130294","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\LOCAL\\mojo.8360.7956.520931335146763457","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"path":"pipe\\LOCAL\\mojo.7076.6564.12381672119046272003","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8412:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8412:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8412:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"SM0:8412:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"SM0:8412:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"Local\\SM0:8412:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:916:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"SM0:916:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"Local\\SM0:916:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"Local\\SM0:916:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"__OMADM_NAMED_MUTEX__","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:916:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\3C98A163-8D7E-41B1-B10A-97B5BD62B79FUD","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:916:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__OMADM_NAMED_MUTEX__","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"Local\\SM0:1804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"SM0:1804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3824:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"Local\\SM0:3824:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3732:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"SM0:3732:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\AppContainerNamedObjects\\S-1-15-2-3251537155-1984446955-2931258699-841473695-1938553385-924012159-129201922\\SM0:8360:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3244:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"SM0:3244:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6104:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"SM0:6104:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1112:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"SM0:1112:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6916:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"SM0:6916:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8444:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"SM0:8444:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6108:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"SM0:6108:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6192:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"SM0:6192:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4624:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4624:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"Local\\SM0:4624:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"SM0:4624:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"SM0:4624:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"Local\\SM0:4624:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4624:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4624:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8088:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8088:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"SM0:8088:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"Local\\SM0:8088:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8552:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8552:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8552:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"SM0:8552:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"SM0:8552:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"Local\\SM0:8552:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2192:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"SM0:2192:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:9192:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"SM0:9192:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2824:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"SM0:2824:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4476:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"SM0:4476:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2228:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2228:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2228:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2228:120:WilError_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"SM0:2228:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"Local\\SM0:2228:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"SM0:2228:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"SM0:2228:120:WilError_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4580:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"SM0:4580:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:9040:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]},{"name":"SM0:9040:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea7e7d63b595a363013693"}]}]}},"report_ids":{"sandbox_job_ids":["6aea7e7d63b595a363013693"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Suspicious Trojan.Win64.MSIL_Heur Sample 06eaa4756b6f… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 06eaa4756b6f…. Malware family: Trojan.Win64.MSIL_Heur. Threat score 70/100. 1/27 AV engines flagged this file. 1 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/06eaa4756b6f505d71fa66896a4270f95201794f47370a28e2f710fadf99cdd8"}],["$","meta","4",{"property":"og:title","content":"Suspicious Trojan.Win64.MSIL_Heur Sample 06eaa4756b6f… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 06eaa4756b6f…. Malware family: Trojan.Win64.MSIL_Heur. Threat score 70/100. 1/27 AV engines flagged this file. 1 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/06eaa4756b6f505d71fa66896a4270f95201794f47370a28e2f710fadf99cdd8"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Trojan.Win64.MSIL_Heur Sample 06eaa4756b6f… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 06eaa4756b6f…. Malware family: Trojan.Win64.MSIL_Heur. Threat score 70/100. 1/27 AV engines flagged this file. 1 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L49","11",{}]]