24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 77:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 09b478546bc4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 09b478546bc4…. Malware family: Trojan.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 5 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e"],"about":{"@type":"SoftwareApplication","name":"bounty-46176411429432981","applicationCategory":["peexe","autoit","executable"],"identifier":"09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":12,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tc0a,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000556.00000000.141985.00408000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00004884.00000002.146899.00806000.00000004.mdmp, 00000000-00004884.00000002.146899.00940000.00000002.mdmp, 00000000-00004884.00000002.146899.036F0000.00000004.mdmp, 00000000-00004884.00000002.146899.038F1000.00000040.mdmp, 00000000-00004884.00000003.149230.00806000.00000004.mdmp, 00000000-00004884.00000003.149230.036F0000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00004884.00000002.146899.00806000.00000004.mdmp, 00000000-00004884.00000002.146899.00940000.00000002.mdmp, 00000000-00004884.00000002.146899.036F0000.00000004.mdmp, 00000000-00004884.00000002.146899.038F1000.00000040.mdmp, 00000000-00004884.00000003.149230.00806000.00000004.mdmp, 00000000-00004884.00000003.149230.036F0000.00000004.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00004884.00000002.146899.00806000.00000004.mdmp, 00000000-00004884.00000002.146899.00940000.00000002.mdmp, 00000000-00004884.00000002.146899.036F0000.00000004.mdmp, 00000000-00004884.00000002.146899.038F1000.00000040.mdmp, 00000000-00004884.00000003.149230.00806000.00000004.mdmp, 00000000-00004884.00000003.149230.036F0000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004884.00000002.146899.00806000.00000004.mdmp, 00000000-00004884.00000002.146899.00940000.00000002.mdmp, 00000000-00004884.00000002.146899.036F0000.00000004.mdmp, 00000000-00004884.00000002.146899.038F1000.00000040.mdmp, 00000000-00004884.00000003.149230.00806000.00000004.mdmp, 00000000-00004884.00000003.149230.036F0000.00000004.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004884.00000002.146899.00940000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004884.00000002.146899.00940000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00004884.00000002.146899.00940000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004884.00000002.146899.00940000.00000002.mdmp, 00000000-00004884.00000003.149230.00AD0000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004884.00000002.146899.00940000.00000002.mdmp, 00000000-00004884.00000003.149230.00AD0000.00000004.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; Source: "00000000-00004884.00000003.149230.00AD0000.00000004.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; Source: "00000000-00004884.00000003.149230.00AD0000.00000004.mdmp")26:T51d,Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004884.00000002.146899.00806000.00000004.mdmp, 00000000-00004884.00000002.146899.036F0000.00000004.mdmp, 00000000-00004884.00000002.146899.038F1000.00000040.mdmp, 00000000-00004884.00000003.149230.00806000.00000004.mdmp, 00000000-00004884.00000003.149230.036F0000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004884.00000002.146899.00806000.00000004.mdmp, 00000000-00004884.00000002.146899.00940000.00000002.mdmp, 00000000-00004884.00000002.146899.036F0000.00000004.mdmp, 00000000-00004884.00000002.146899.038F1000.00000040.mdmp, 00000000-00004884.00000003.149230.00806000.00000004.mdmp, 00000000-00004884.00000003.149230.036F0000.00000004.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004884.00000002.146899.00806000.00000004.mdmp, 00000000-00004884.00000002.146899.036F0000.00000004.mdmp, 00000000-00004884.00000002.146899.038F1000.00000040.mdmp, 00000000-00004884.00000003.149230.00806000.00000004.mdmp, 00000000-00004884.00000003.149230.036F0000.00000004.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00004884.00000002.146899.00940000.00000002.mdmp")27:T869,"09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4477392'}" (UID: 00000000-00000556) "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4477312'}" (UID: 00000000-00000556) "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4477344'}" (UID: 00000000-00000556) "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e.exe" called "LoadResource with parameter {'hModule': '1996881920', 'hResInfo': '20907504'}" (UID: 00000000-00000556) "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4477328'}" (UID: 00000000-00000556) "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4477360'}" (UID: 00000000-00000556) "Joe.pif" called "LoadResource with parameter {'hModule': '9109504', 'hResInfo': '9930136'}" (UID: 00000000-00004884) "Joe.pif" called "LoadResource with parameter {'hModule': '9109504', 'hResInfo': '9929912'}" (UID: 00000000-00004884) "Joe.pif" called "LoadResource with parameter {'hModule': '9109504', 'hResInfo': '9930168'}" (UID: 00000000-00004884) "Joe.pif" called "LoadResource with parameter {'hModule': '9109504', 'hResInfo': '9929976'}" (UID: 00000000-00004884) "Joe.pif" called "LoadResource with parameter {'hModule': '9109504', 'hResInfo': '9930152'}" (UID: 00000000-00004884) "Joe.pif" called "LoadResource with parameter {'hModule': '9109504', 'hResInfo': '9929960'}" (UID: 00000000-00004884) "Joe.pif" called "LoadResource with parameter {'hModule': '9109504', 'hResInfo': '9929928'}" (UID: 00000000-00004884) "Joe.pif" called "LoadResource with parameter {'hModule': '9109504', 'hResInfo': '9930184'}" (UID: 00000000-00004884) "Joe.pif" called "LoadResource with parameter {'hModule': '9109504', 'hResInfo': '9929944'}" (UID: 00000000-00004884)28:T8b7,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00000556.00000000.141985.00408000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000556.00000000.141985.00408000.00000002.mdmp") Found reference to API "NTYrStay Davidson Paperback Sleep Garcia Gem Monroe Oe Grenada" (Indicator: " Sleep "; Source: "00000000-00000556.00000000.141985.0040A000.00000004.mdmp, 00000000-00000556.00000000.141985.0041E000.00000004.mdmp, 00000000-00000556.00000001.142885.0040A000.00000004.mdmp, 00000000-00000556.00000001.142885.0041E000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004884.00000002.146899.00806000.00000004.mdmp, 00000000-00004884.00000002.146899.00940000.00000002.mdmp, 00000000-00004884.00000002.146899.036F0000.00000004.mdmp, 00000000-00004884.00000002.146899.038F1000.00000040.mdmp, 00000000-00004884.00000003.149230.00806000.00000004.mdmp, 00000000-00004884.00000003.149230.036F0000.00000004.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00004884.00000002.146899.00940000.00000002.mdmp") Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; Source: "00000000-00004884.00000002.146899.00940000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004884.00000002.146899.00940000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004884.00000002.146899.00940000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00004884.00000002.146899.00940000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004884.00000002.146899.00940000.00000002.mdmp")29:T753,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000556.00000000.141985.00408000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000556.00000000.141985.00408000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004884.00000002.146899.00806000.00000004.mdmp, 00000000-00004884.00000002.146899.00940000.00000002.mdmp, 00000000-00004884.00000002.146899.036F0000.00000004.mdmp, 00000000-00004884.00000002.146899.038F1000.00000040.mdmp, 00000000-00004884.00000003.149230.00806000.00000004.mdmp, 00000000-00004884.00000003.149230.00AD0000.00000004.mdmp, 00000000-00004884.00000003.149230.036F0000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004884.00000002.146899.00806000.00000004.mdmp, 00000000-00004884.00000002.146899.00940000.00000002.mdmp, 00000000-00004884.00000002.146899.036F0000.00000004.mdmp, 00000000-00004884.00000002.146899.038F1000.00000040.mdmp, 00000000-00004884.00000003.149230.00806000.00000004.mdmp, 00000000-00004884.00000003.149230.036F0000.00000004.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00004884.00000002.146899.00940000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004884.00000002.146899.00940000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004884.00000002.146899.00940000.00000002.mdmp")2a:T734,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004884.00000002.146899.00806000.00000004.mdmp, 00000000-00004884.00000002.146899.036F0000.00000004.mdmp, 00000000-00004884.00000002.146899.038F1000.00000040.mdmp, 00000000-00004884.00000003.149230.00806000.00000004.mdmp, 00000000-00004884.00000003.149230.036F0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004884.00000002.146899.00806000.00000004.mdmp, 00000000-00004884.00000002.146899.036F0000.00000004.mdmp, 00000000-00004884.00000002.146899.038F1000.00000040.mdmp, 00000000-00004884.00000003.149230.00806000.00000004.mdmp, 00000000-00004884.00000003.149230.036F0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00004884.00000002.146899.00806000.00000004.mdmp, 00000000-00004884.00000002.146899.036F0000.00000004.mdmp, 00000000-00004884.00000002.146899.038F1000.00000040.mdmp, 00000000-00004884.00000003.149230.00806000.00000004.mdmp, 00000000-00004884.00000003.149230.036F0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00004884.00000002.146899.00806000.00000004.mdmp, 00000000-00004884.00000002.146899.036F0000.00000004.mdmp, 00000000-00004884.00000002.146899.038F1000.00000040.mdmp, 00000000-00004884.00000003.149230.00806000.00000004.mdmp, 00000000-00004884.00000003.149230.036F0000.00000004.mdmp")2b:T986,Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; File: "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; File: "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0>" (Indicator: "SHA384"; File: "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; File: "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; File: "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00004884-00000CC3-1328841334") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00004884.00000003.149230.00780000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00004884.00000003.149230.00780000.00000004.mdmp") Found reference to "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P384" (Indicator: "SHA384"; Source: "00000000-00004884.00000003.149230.00780000.00000004.mdmp") Found reference to "*DigiCert Global G3 TLS ECC SHA384 2020 CA10" (Indicator: "SHA384"; Source: "00000000-00004884.00000003.149230.00780000.00000004.mdmp") Found reference to "Bhttp://crl3.digicert.com/DigiCertGlobalG3TLSECCSHA3842020CA1-2.crl0H" (Indicator: "SHA384"; Source: "00000000-00004884.00000003.149230.00780000.00000004.mdmp") Found reference to "Bhttp://crl4.digicert.com/DigiCertGlobalG3TLSECCSHA3842020CA1-2.crl0" (Indicator: "SHA384"; Source: "00000000-00004884.00000003.149230.00780000.00000004.mdmp") Found reference to "Ehttp://cacerts.digicert.com/DigiCertGlobalG3TLSECCSHA3842020CA1-2.crt0" (Indicator: "SHA384"; Source: "00000000-00004884.00000003.149230.00780000.00000004.mdmp") Found reference to "*DigiCert Global G3 TLS ECC SHA384 2020 CA10v0" (Indicator: "SHA384"; Source: "00000000-00004884.00000003.149230.00780000.00000004.mdmp") Found reference to "CryptCNGInitHMAC" (Indicator: "HMAC"; Source: "00000000-00004884.00000003.149230.036F0000.00000004.mdmp")2c:Tac1,"09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN") "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN") "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER\MAIN") "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER\MAIN") "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER\MAIN") "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\") "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\") "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\") "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\") "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610") "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610") "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN") "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN") "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN") "09b478546bc4ae0d040069e275324a0a6b1d7b08b0ccd66ddf95d9e233c8618e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN")2d:T1209,Found string "avghookx.dll" (Indicator: "avghookx.dll"; Source: "00000000-00004884.00000002.146899.00806000.00000004.mdmp, 00000000-00004884.00000002.146899.036F0000.00000004.mdmp, 00000000-00004884.00000002.146899.038F1000.00000040.mdmp, 00000000-00004884.00000003.149230.00806000.00000004.mdmp, 00000000-00004884.00000003.149230.036F0000.00000004.mdmp") Found string "avghooka.dll" (Indicator: "avghooka.dll"; Source: "00000000-00004884.00000002.146899.00806000.00000004.mdmp, 00000000-00004884.00000002.146899.036F0000.00000004.mdmp, 00000000-00004884.00000002.146899.038F1000.00000040.mdmp, 00000000-00004884.00000003.149230.00806000.00000004.mdmp, 00000000-00004884.00000003.149230.036F0000.00000004.mdmp") Found string "snxhk.dll" (Indicator: "snxhk.dll"; Source: "00000000-00004884.00000002.146899.00806000.00000004.mdmp, 00000000-00004884.00000002.146899.036F0000.00000004.mdmp, 00000000-00004884.00000002.146899.038F1000.00000040.mdmp, 00000000-00004884.00000003.149230.00806000.00000004.mdmp, 00000000-00004884.00000003.149230.036F0000.00000004.mdmp") Found string "sbiedll.dll" (Indicator: "sbiedll.dll"; Source: "00000000-00004884.00000002.146899.00806000.00000004.mdmp, 00000000-00004884.00000002.146899.036F0000.00000004.mdmp, 00000000-00004884.00000002.146899.038F1000.00000040.mdmp, 00000000-00004884.00000003.149230.00806000.00000004.mdmp, 00000000-00004884.00000003.149230.036F0000.00000004.mdmp") Found string "api_log.dll" (Indicator: "api_log.dll"; Source: "00000000-00004884.00000002.146899.00806000.00000004.mdmp, 00000000-00004884.00000002.146899.036F0000.00000004.mdmp, 00000000-00004884.00000002.146899.038F1000.00000040.mdmp, 00000000-00004884.00000003.149230.00806000.00000004.mdmp, 00000000-00004884.00000003.149230.036F0000.00000004.mdmp") Found string "dir_watch.dll" (Indicator: "dir_watch.dll"; Source: "00000000-00004884.00000002.146899.00806000.00000004.mdmp, 00000000-00004884.00000002.146899.036F0000.00000004.mdmp, 00000000-00004884.00000002.146899.038F1000.00000040.mdmp, 00000000-00004884.00000003.149230.00806000.00000004.mdmp, 00000000-00004884.00000003.149230.036F0000.00000004.mdmp") Found string "pstorec.dll" (Indicator: "pstorec.dll"; Source: "00000000-00004884.00000002.146899.00806000.00000004.mdmp, 00000000-00004884.00000002.146899.036F0000.00000004.mdmp, 00000000-00004884.00000002.146899.038F1000.00000040.mdmp, 00000000-00004884.00000003.149230.00806000.00000004.mdmp, 00000000-00004884.00000003.149230.036F0000.00000004.mdmp") Found string "vmcheck.dll" (Indicator: "vmcheck.dll"; Source: "00000000-00004884.00000002.146899.00806000.00000004.mdmp, 00000000-00004884.00000002.146899.036F0000.00000004.mdmp, 00000000-00004884.00000002.146899.038F1000.00000040.mdmp, 00000000-00004884.00000003.149230.00806000.00000004.mdmp, 00000000-00004884.00000003.149230.036F0000.00000004.mdmp") Found string "wpespy.dll" (Indicator: "wpespy.dll"; Source: "00000000-00004884.00000002.146899.00806000.00000004.mdmp, 00000000-00004884.00000002.146899.036F0000.00000004.mdmp, 00000000-00004884.00000002.146899.038F1000.00000040.mdmp, 00000000-00004884.00000003.149230.00806000.00000004.mdmp, 00000000-00004884.00000003.149230.036F0000.00000004.mdmp") Found string "cmdvrt32.dll" (Indicator: "cmdvrt32"; Source: "00000000-00004884.00000002.146899.00806000.00000004.mdmp, 00000000-00004884.00000002.146899.036F0000.00000004.mdmp, 00000000-00004884.00000002.146899.038F1000.00000040.mdmp, 00000000-00004884.00000003.149230.00806000.00000004.mdmp, 00000000-00004884.00000003.149230.036F0000.00000004.mdmp") Found string "cmdvrt32.dll" (Indicator: "cmdvrt32.dll"; Source: "00000000-00004884.00000002.146899.00806000.00000004.mdmp, 00000000-00004884.00000002.146899.036F0000.00000004.mdmp, 00000000-00004884.00000002.146899.038F1000.00000040.mdmp, 00000000-00004884.00000003.149230.00806000.00000004.mdmp, 00000000-00004884.00000003.149230.036F0000.00000004.mdmp") Found string "cmdvrt64.dll" (Indicator: "cmdvrt64.dll"; Source: "00000000-00004884.00000002.146899.00806000.00000004.mdmp, 00000000-00004884.00000002.146899.036F0000.00000004.mdmp, 00000000-00004884.00000002.146899.038F1000.00000040.mdmp, 00000000-00004884.00000003.149230.00806000.00000004.mdmp, 00000000-00004884.00000003.149230.036F0000.00000004.mdmp") Found string "dbghelp.dll" (Indicator: "dbghelp.dll"; Source: "00000000-00004884.00000002.146899.00806000.00000004.mdmp, 00000000-00004884.00000002.146899.036F0000.00000004.mdmp, 00000000-00004884.00000002.146899.038F1000.00000040.mdmp, 00000000-00004884.00000003.149230.00806000.00000004.mdmp, 00000000-00004884.00000003.149230.036F0000.00000004.mdmp")2e:T10bb,"Joe.pif" called "CryptStringToBinaryA" with parameters {"pszString": "YMqCwskx1+vRgCZyxdY=" "cchString": "20" "dwFlags": "1" "pcbBinary": "0e000000"} "Joe.pif" called "CryptStringToBinaryA" with parameters {"pszString": "YMqCwskx1+vRgCZyxdY=" "cchString": "20" "dwFlags": "1" "pbBinary": "60ca82c2c931d7ebd1802672c5d6" "pcbBinary": "0e000000"} "Joe.pif" called "CryptStringToBinaryA" with parameters {"pszString": "a8CX9vc31tjUli1W" "cchString": "16" "dwFlags": "1" "pcbBinary": "0c000000"} "Joe.pif" called "CryptStringToBinaryA" with parameters {"pszString": "a8CX9vc31tjUli1W" "cchString": "16" "dwFlags": "1" "pbBinary": "6bc097f6f737d6d8d4962d56" "pcbBinary": "0c000000"} "Joe.pif" called "CryptStringToBinaryA" with parameters {"pszString": "S9yC4Ng/wOs=" "cchString": "12" "dwFlags": "1" "pcbBinary": "08000000"} "Joe.pif" called "CryptStringToBinaryA" with parameters {"pszString": "S9yC4Ng/wOs=" "cchString": "12" "dwFlags": "1" "pbBinary": "4bdc82e0d83fc0eb" "pcbBinary": "08000000"} "Joe.pif" called "CryptStringToBinaryA" with parameters {"pszString": "aN+T/P4o0cTBpQ==" "cchString": "16" "dwFlags": "1" "pcbBinary": "0a000000"} "Joe.pif" called "CryptStringToBinaryA" with parameters {"pszString": "aN+T/P4o0cTBpQ==" "cchString": "16" "dwFlags": "1" "pbBinary": "68df93fcfe28d1c4c1a5" "pcbBinary": "0a000000"} "Joe.pif" called "CryptStringToBinaryA" with parameters {"pszString": "ZN2T88878dzQiiBW" "cchString": "16" "dwFlags": "1" "pcbBinary": "0c000000"} "Joe.pif" called "CryptStringToBinaryA" with parameters {"pszString": "ZN2T88878dzQiiBW" "cchString": "16" "dwFlags": "1" "pbBinary": "64dd93f3cf3bf1dcd08a2056" "pcbBinary": "0c000000"} "Joe.pif" called "CryptStringToBinaryA" with parameters {"pszString": "ZMOZ4d4W1cTRiDE=" "cchString": "16" "dwFlags": "1" "pcbBinary": "0b000000"} "Joe.pif" called "CryptStringToBinaryA" with parameters {"pszString": "ZMOZ4d4W1cTRiDE=" "cchString": "16" "dwFlags": "1" "pbBinary": "64c399e1de16d5c4d18831" "pcbBinary": "0b000000"} "Joe.pif" called "CryptStringToBinaryA" with parameters {"pszString": "dMOT98s=" "cchString": "8" "dwFlags": "1" "pcbBinary": "05000000"} "Joe.pif" called "CryptStringToBinaryA" with parameters {"pszString": "dMOT98s=" "cchString": "8" "dwFlags": "1" "pbBinary": "74c393f7cb" "pcbBinary": "05000000"} "Joe.pif" called "CryptStringToBinaryA" with parameters {"pszString": "YMqCx8g7xu7QgjVi2tFHDdFoKBM=" "cchString": "28" "dwFlags": "1" "pcbBinary": "14000000"} "Joe.pif" called "CryptStringToBinaryA" with parameters {"pszString": "YMqCx8g7xu7QgjVi2tFHDdFoKBM=" "cchString": "28" "dwFlags": "1" "pbBinary": "60ca82c7c83bc6eed0823562dad1470dd1682813" "pcbBinary": "14000000"} "Joe.pif" called "CryptStringToBinaryA" with parameters {"pszString": "ccaE5s4/2OvZiDt0891FGdJu" "cchString": "24" "dwFlags": "1" "pcbBinary": "12000000"} "Joe.pif" called "CryptStringToBinaryA" with parameters {"pszString": "ccaE5s4/2OvZiDt0891FGdJu" "cchString": "24" "dwFlags": "1" "pbBinary": "71c684e6ce3fd8ebd9883b74f3dd4519d26e" "pcbBinary": "12000000"} "Joe.pif" called "CryptStringToBinaryA" with parameters {"pszString": "ccaE5s4/2OzHgTE=" "cchString": "16" "dwFlags": "1" "pcbBinary": "0b000000"} "Joe.pif" called "CryptStringToBinaryA" with parameters {"pszString": "ccaE5s4/2OzHgTE=" "cchString": "16" "dwFlags": "1" "pbBinary": "71c684e6ce3fd8ecc78131" "pcbBinary": "0b000000"} "Joe.pif" called "CryptStringToBinaryA" with parameters {"pszString": "YMqCwcItwM/YrTpx2Q==" "cchString": "20" "dwFlags": "1" "pcbBinary": "0d000000"} "Joe.pif" called "CryptStringToBinaryA" with parameters {"pszString": "YMqCwcItwM/YrTpx2Q==" "cchString": "20" "dwFlags": "1" "pbBinary": "60ca82c1c22dc0cfd8ad3a71d9" "pcbBinary": "0d000000"} "Joe.pif" called "CryptStringToBinaryA" with parameters {"pszString": "ccaE5s4/2OvZiDt0" "cchString": "16" "dwFlags": "1" "pcbBinary": "0c000000"} "Joe.pif" called "CryptStringToBinaryA" with parameters {"pszString": "ccaE5s4/2OvZiDt0" "cchString": "16" "dwFlags": "1" "pbBinary": "71c684e6ce3fd8ebd9883b74" "pcbBinary": "0c000000"} "Joe.pif" called "CryptStringToBinaryA" with parameters {"pszString": "b8qX4voy2MXW" "cchString": "12" "dwFlags": "1" "pcbBinary": "09000000"}2f:T4c9,"Joe.pif" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKServer: nginx/1.30.1Date: Mon, 10 Aug 2026 23:05:14 GMTContent-Type: text/html; charset=utf-8Content-Length: 9561Connection: keep-aliveSet-Cookie: stel_ssid=48feb6316248d98483_10554456384760991333; expires=Tue, 11 Aug 2026 23:05:14 G"} "Joe.pif" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKServer: nginxContent-Type: text/html; charset=UTF-8X-Frame-Options: SAMEORIGINContent-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai"} "Joe.pif" called "BCryptDecrypt" with parameters {"$dataout": "enuitem supernav supernav_active\" href=\"https://steamcommunity.com/\" data-tooltip-type=\"selector\" data-tooltip-content=\".submenu_Community\">COMMUNITY

"}, "Joe.pif" called "BCryptDecrypt" with parameters {"$dataout": ".com/profiles/76561199698764354/badges\">

Level