21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 74:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T471,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample 0e8dfb4c4b15… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0e8dfb4c4b15…. Malware family: Malware. Threat score 100/100. 4/27 AV engines flagged this file. 18 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0e8dfb4c4b15bffe7df07f0a9240c2287e23c149b465991da96b73eff7b8f903","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","0e8dfb4c4b15bffe7df07f0a9240c2287e23c149b465991da96b73eff7b8f903"],"about":{"@type":"SoftwareApplication","name":"RFQ110623.pdf .exe","applicationCategory":["peexe","executable"],"identifier":"0e8dfb4c4b15bffe7df07f0a9240c2287e23c149b465991da96b73eff7b8f903","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":4,"total":27},"behavioralIndicators":{"malicious":18,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==23:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==24:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==25:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==26:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==27:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==28:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==29:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==2a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==2b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==2c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==2d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==2e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==2f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==30:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==31:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==32:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==33:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==34:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==35:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==36:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==37:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==38:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==39:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==3a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==3b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==3c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==3d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==3e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==3f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==40:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==41:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==42:T416,Found reference to API "ZwUnmapViewOfSection" (Indicator: "UnmapViewOfSection"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "NtUnmapViewOfSection" (Indicator: "UnmapViewOfSection"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "ZwUnmapViewOfSection" (Indicator: "UnmapViewOfSection"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "NtUnmapViewOfSection" (Indicator: "UnmapViewOfSection"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp")43:T406,Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp")44:T2ab1,"Software\Qualcomm\Eudora\CommandLine" in Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp "Software\Classes\Software\Qualcomm\Eudora\CommandLine\current" in Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp "Software\Mozilla\Mozilla Thunderbird" in Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp "Software\Microsoft\Internet Account Manager\Accounts" in Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp "Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts" in Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp "Software\IncrediMail\Identities" in Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp "Software\Group Mail" in Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles" in Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles" in Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles" in Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles" in Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp "Software\Google\Google Desktop\Mailboxes" in Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp "Software\Google\Google Talk\Accounts" in Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp "Software\Microsoft\MSNMessenger" in Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp "Software\Microsoft\MessengerService" in Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp "Software\Microsoft\IdentityCRL" in Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp "Software\Microsoft\Windows Mail" in Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp "Software\Microsoft\Windows Live Mail" in Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp "Software\Yahoo\Pager" in Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp "\Opera Software\Opera Stable\" in Source: 00000000-00007804.00000000.66766.00400000.00000040.mdmp 00000000-00007804.00000000.66766.05000000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00007804.00000000.66766.00400000.00000040.mdmp 00000000-00007804.00000000.66766.05000000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\" in Source: 00000000-00007804.00000000.66766.00400000.00000040.mdmp 00000000-00007804.00000000.66766.05000000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007804.00000000.66766.00400000.00000040.mdmp 00000000-00007804.00000000.66766.05000000.00000040.mdmp "/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f" in Source: 00000000-00007804.00000000.66766.00400000.00000040.mdmp 00000000-00007804.00000000.66766.05000000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00007804.00000000.66766.00400000.00000040.mdmp 00000000-00007804.00000000.66766.05000000.00000040.mdmp "Software\" in Source: 00000000-00007804.00000000.66766.00400000.00000040.mdmp 00000000-00007804.00000000.66766.05000000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007804.00000000.66766.00400000.00000040.mdmp 00000000-00007804.00000000.66766.05000000.00000040.mdmp "SOFTWARE\Mi" in Source: 00000000-00007804.00000000.66766.03550000.00000040.mdmp "ADD HKLM\8" in Source: 00000000-00007804.00000000.66766.03550000.00000040.mdmp "\Opera Software\Opera Stable\" in Source: 00000000-00008080.00000000.67269.00400000.00000040.mdmp 00000000-00008080.00000001.69190.00400000.00000040.mdmp 00000000-00008080.00000002.71107.00400000.00000040.mdmp 00000000-00008080.00000002.71107.04E80000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00008080.00000000.67269.00400000.00000040.mdmp 00000000-00008080.00000001.69190.00400000.00000040.mdmp 00000000-00008080.00000002.71107.00400000.00000040.mdmp 00000000-00008080.00000002.71107.04E80000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\" in Source: 00000000-00008080.00000000.67269.00400000.00000040.mdmp 00000000-00008080.00000001.69190.00400000.00000040.mdmp 00000000-00008080.00000002.71107.00400000.00000040.mdmp 00000000-00008080.00000002.71107.04E80000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008080.00000000.67269.00400000.00000040.mdmp 00000000-00008080.00000001.69190.00400000.00000040.mdmp 00000000-00008080.00000002.71107.00400000.00000040.mdmp 00000000-00008080.00000002.71107.04E80000.00000040.mdmp "/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f" in Source: 00000000-00008080.00000000.67269.00400000.00000040.mdmp 00000000-00008080.00000001.69190.00400000.00000040.mdmp 00000000-00008080.00000002.71107.00400000.00000040.mdmp 00000000-00008080.00000002.71107.04E80000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00008080.00000000.67269.00400000.00000040.mdmp 00000000-00008080.00000001.69190.00400000.00000040.mdmp 00000000-00008080.00000002.71107.00400000.00000040.mdmp 00000000-00008080.00000002.71107.04E80000.00000040.mdmp "Software\" in Source: 00000000-00008080.00000000.67269.00400000.00000040.mdmp 00000000-00008080.00000001.69190.00400000.00000040.mdmp 00000000-00008080.00000002.71107.00400000.00000040.mdmp 00000000-00008080.00000002.71107.04E80000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00008080.00000000.67269.00400000.00000040.mdmp 00000000-00008080.00000001.69190.00400000.00000040.mdmp 00000000-00008080.00000002.71107.00400000.00000040.mdmp 00000000-00008080.00000002.71107.04E80000.00000040.mdmp "SOFTWARE\Mi" in Source: 00000000-00008080.00000000.67269.03381000.00000040.mdmp 00000000-00008080.00000002.71107.03381000.00000040.mdmp "ADD HKLM\8" in Source: 00000000-00008080.00000000.67269.03381000.00000040.mdmp 00000000-00008080.00000002.71107.03381000.00000040.mdmp "Software\Rmc-74HSI3\" in Source: 00000000-00008080.00000001.69190.03360000.00000004.mdmp 00000000-00008080.00000002.71107.03360000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00008080.00000001.69190.03411000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00008080.00000001.69190.03411000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00008080.00000002.71107.06400000.00000040.mdmp 00000000-00008080.00000002.71107.06480000.00000040.mdmp 00000000-00008080.00000002.71107.064E0000.00000040.mdmp "Software\Qualcomm\Eudora\CommandLine" in Source: 00000000-00008080.00000002.71107.06480000.00000040.mdmp "Software\Classes\Software\Qualcomm\Eudora\CommandLine\current" in Source: 00000000-00008080.00000002.71107.06480000.00000040.mdmp "Software\Mozilla\Mozilla Thunderbird" in Source: 00000000-00008080.00000002.71107.06480000.00000040.mdmp "Software\Microsoft\Internet Account Manager\Accounts" in Source: 00000000-00008080.00000002.71107.06480000.00000040.mdmp "Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts" in Source: 00000000-00008080.00000002.71107.06480000.00000040.mdmp "Software\IncrediMail\Identities" in Source: 00000000-00008080.00000002.71107.06480000.00000040.mdmp "Software\Group Mail" in Source: 00000000-00008080.00000002.71107.06480000.00000040.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles" in Source: 00000000-00008080.00000002.71107.06480000.00000040.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles" in Source: 00000000-00008080.00000002.71107.06480000.00000040.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles" in Source: 00000000-00008080.00000002.71107.06480000.00000040.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles" in Source: 00000000-00008080.00000002.71107.06480000.00000040.mdmp "Software\Google\Google Desktop\Mailboxes" in Source: 00000000-00008080.00000002.71107.06480000.00000040.mdmp 00000000-00008080.00000002.71107.064E0000.00000040.mdmp "Software\Google\Google Talk\Accounts" in Source: 00000000-00008080.00000002.71107.06480000.00000040.mdmp 00000000-00008080.00000002.71107.064E0000.00000040.mdmp "Software\Microsoft\MSNMessenger" in Source: 00000000-00008080.00000002.71107.06480000.00000040.mdmp 00000000-00008080.00000002.71107.064E0000.00000040.mdmp "Software\Microsoft\MessengerService" in Source: 00000000-00008080.00000002.71107.06480000.00000040.mdmp 00000000-00008080.00000002.71107.064E0000.00000040.mdmp "Software\Microsoft\IdentityCRL" in Source: 00000000-00008080.00000002.71107.06480000.00000040.mdmp 00000000-00008080.00000002.71107.064E0000.00000040.mdmp "Software\Microsoft\Windows Mail" in Source: 00000000-00008080.00000002.71107.06480000.00000040.mdmp "Software\Microsoft\Windows Live Mail" in Source: 00000000-00008080.00000002.71107.06480000.00000040.mdmp "Software\Yahoo\Pager" in Source: 00000000-00008080.00000002.71107.06480000.00000040.mdmp 00000000-00008080.00000002.71107.064E0000.00000040.mdmp "Software\America Online\AIM6\Passwords" in Source: 00000000-00008080.00000002.71107.064E0000.00000040.mdmp "Software\AIM\AIMPRO" in Source: 00000000-00008080.00000002.71107.064E0000.00000040.mdmp "SOFTWARE\Mozilla" in Source: 00000000-00008080.00000002.71107.064E0000.00000040.mdmp "Software\Microsoft\Internet Explorer\IntelliForms\Storage2" in Source: 00000000-00008080.00000002.71107.064E0000.00000040.mdmp "Software\NirSoft\MessenPass" in Source: 00000000-00008080.00000002.71107.064E0000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Trillian" in Source: 00000000-00008080.00000002.71107.064E0000.00000040.mdmp "Software\Miranda" in Source: 00000000-00008080.00000002.71107.064E0000.00000040.mdmp "Software\Mirabilis\ICQ\NewOwners" in Source: 00000000-00008080.00000002.71107.064E0000.00000040.mdmp "Software\America Online\AOL Instant Messenger (TM)\CurrentVersion\Users" in Source: 00000000-00008080.00000002.71107.064E0000.00000040.mdmp "Software\Paltalk" in Source: 00000000-00008080.00000002.71107.064E0000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00008080.00000002.71107.064E0000.00000040.mdmp45:T5d8,Found reference to API "SHDeleteKeyW" (Indicator: "SHDeleteKey"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "RegDeleteKeyA" (Indicator: "RegDeleteKey"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "SHDeleteKeyW" (Indicator: "SHDeleteKey"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "RegDeleteKeyA" (Indicator: "RegDeleteKey"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp")46:T1689,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "[+] NtAllocateVirtualMemory Success" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "[-] NtAllocateVirtualMemory Error" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "[+] NtAllocateVirtualMemory Success" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "[-] NtAllocateVirtualMemory Error" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp, 00000000-00008080.00000002.71107.064E0000.00000040.mdmp")47:T4f8,"RFQ110623.pdf.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000e776aafdf276a8291f009c011f0000001f00e214336f550500000000ffff05000000f5f6e7768efdf276d013336f80e425002c14336fbefdf27660d11200a8291f000000fa760000336f10000000e0000000e000fa7600000000ccd01200d06b1f0098d1120095e1e376a8291f00fc01000000000000fefdf2760000fa76000000005815336fe000fa76bcd01200e800000098d1120095e1e3765e240700fefffffff5f6e776634de876a8291f006615336f2c143300b2f4e7763afdf276e4d112000000336f0000336f804de8761efdf276e8000000e800336f00000000b0d21200 (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003672)48:T2dbf,Found reference to API (Indicator: "FlsFree"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "FlsSetValue"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "FlsGetValue"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "FlsAlloc"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetProcessWindowStation"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetLastActivePopup"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetActiveWindow"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "MessageBoxW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "WriteConsoleInputW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "lstrlenA"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetStringTypeA"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetConsoleAliasA"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "WaitNamedPipeA"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "WriteConsoleInputA"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "AddConsoleAliasW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "FlushConsoleInputBuffer"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "SetTapeParameters"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "MoveFileWithProgressA"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "FindNextVolumeMountPointA"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetConsoleAliasesA"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "ConvertFiberToThread"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetPrivateProfileStringW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "ReadConsoleW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetCompressedFileSizeW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetConsoleAliasExesW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetUserDefaultLangID"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "CreateActCtxW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "LoadLibraryW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "SetCommConfig"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "FatalAppExitW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetSystemPowerStatus"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "HeapDestroy"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "ReplaceFileW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "EnumSystemLocalesA"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetStartupInfoA"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "FindFirstFileA"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetLastError"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "SetLastError"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetProcAddress"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "CopyFileA"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GlobalGetAtomNameA"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "SetFileApisToOEM"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "LoadLibraryA"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "LocalAlloc"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "CreateEventW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "WriteProfileSectionW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "VirtualLock"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "OpenJobObjectW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "FoldStringA"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GlobalFindAtomW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "SetLocaleInfoW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "FindNextFileW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "VirtualProtect"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "CompareStringA"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetShortPathNameW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "OpenSemaphoreW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "ReadConsoleInputW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "FindFirstVolumeW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "MoveFileWithProgressW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "ReadConsoleOutputCharacterW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "DeleteFileA"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "CharUpperA"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "InterlockedIncrement"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "InterlockedDecrement"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "EncodePointer"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "DecodePointer"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "Sleep"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "HeapFree"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetCommandLineW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "HeapSetInformation"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "RaiseException"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "RtlUnwind"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "HeapAlloc"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "LCMapStringW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetCPInfo"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetACP"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetOEMCP"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "IsValidCodePage"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "TlsAlloc"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "TlsGetValue"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "TlsSetValue"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "TlsFree"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "TerminateProcess"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "HeapCreate"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "HeapSize"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "ExitProcess"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "SetFilePointer"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "WriteFile"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetStdHandle"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "SetHandleCount"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetFileType"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetTickCount"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetLocaleInfoA"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "IsValidLocale"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetStringTypeW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "HeapReAlloc"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "SetStdHandle"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetConsoleCP"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "GetConsoleMode"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "WriteConsoleW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "CreateFileW"; File: "RFQ110623.pdf .exe") Found reference to API (Indicator: "CloseHandle"; File: "RFQ110623.pdf .exe")49:T7db,"RFQ110623.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "RFQ110623.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "RFQ110623.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "RFQ110623.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "RFQ110623.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "RFQ110623.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "RFQ110623.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "RFQ110623.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "RFQ110623.PDF"; Value: "") "RFQ110623.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "RFQ110623.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "RFQ110623.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "RFQ110623.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "RFQ110623.pdf.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "RFQ110623.pdf.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "")4a:Tc14,"RFQ110623.pdf.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4690216'}" (UID: 00000000-00007804) "RFQ110623.pdf.exe" called "LoadResource with parameter {'hModule': '104660992', 'hResInfo': '104669312'}" (UID: 00000000-00007804) "Adobereaderxi.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4690216'}" (UID: 00000000-00008080) "Adobereaderxi.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4681824'}" (UID: 00000000-00004928) "Adobereaderxi.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4681960'}" (UID: 00000000-00004928) "Adobereaderxi.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4682000'}" (UID: 00000000-00004928) "Adobereaderxi.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4682040'}" (UID: 00000000-00004928) "Adobereaderxi.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4682080'}" (UID: 00000000-00004928) "Adobereaderxi.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4682120'}" (UID: 00000000-00004928) "Adobereaderxi.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4682160'}" (UID: 00000000-00004928) "Adobereaderxi.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4682200'}" (UID: 00000000-00004928) "Adobereaderxi.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4682240'}" (UID: 00000000-00004928) "Adobereaderxi.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4682280'}" (UID: 00000000-00004928) "Adobereaderxi.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4682320'}" (UID: 00000000-00004928) "Adobereaderxi.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4682384'}" (UID: 00000000-00004928) "Adobereaderxi.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '4681824'}" (UID: 00000000-00004928) "Adobereaderxi.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4546712'}" (UID: 00000000-00006484) "Adobereaderxi.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4546792'}" (UID: 00000000-00006484) "Adobereaderxi.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4546832'}" (UID: 00000000-00006484) "Adobereaderxi.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4546872'}" (UID: 00000000-00006484) "Adobereaderxi.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4546952'}" (UID: 00000000-00006484) "Adobereaderxi.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4547736'}" (UID: 00000000-00006484) "Adobereaderxi.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4548072'}" (UID: 00000000-00006484) "Adobereaderxi.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4548440'}" (UID: 00000000-00006484)4b:T7da,"RFQ110623.pdf.exe" called "FindResourceA" with parameter "4639252" - (UID: 00000000-00007804) "RFQ110623.pdf.exe" called "FindResourceW" with parameter "789" - (UID: 00000000-00007804) "Adobereaderxi.exe" called "FindResourceA" with parameter "4639252" - (UID: 00000000-00008080) "Adobereaderxi.exe" called "FindResourceW" with parameter "50" - (UID: 00000000-00004928) "Adobereaderxi.exe" called "FindResourceW" with parameter "1" - (UID: 00000000-00004928) "Adobereaderxi.exe" called "FindResourceW" with parameter "32" - (UID: 00000000-00004928) "Adobereaderxi.exe" called "FindResourceW" with parameter "35" - (UID: 00000000-00004928) "Adobereaderxi.exe" called "FindResourceW" with parameter "38" - (UID: 00000000-00004928) "Adobereaderxi.exe" called "FindResourceW" with parameter "39" - (UID: 00000000-00004928) "Adobereaderxi.exe" called "FindResourceW" with parameter "47" - (UID: 00000000-00004928) "Adobereaderxi.exe" called "FindResourceW" with parameter "48" - (UID: 00000000-00004928) "Adobereaderxi.exe" called "FindResourceW" with parameter "63" - (UID: 00000000-00004928) "Adobereaderxi.exe" called "FindResourceW" with parameter "64" - (UID: 00000000-00004928) "Adobereaderxi.exe" called "FindResourceW" with parameter "82" - (UID: 00000000-00004928) "Adobereaderxi.exe" called "FindResourceA" with parameter "1" - (UID: 00000000-00006484) "Adobereaderxi.exe" called "FindResourceA" with parameter "104" - (UID: 00000000-00006484) "Adobereaderxi.exe" called "FindResourceA" with parameter "133" - (UID: 00000000-00006484) "Adobereaderxi.exe" called "FindResourceA" with parameter "134" - (UID: 00000000-00006484) "Adobereaderxi.exe" called "FindResourceA" with parameter "2" - (UID: 00000000-00006484) "Adobereaderxi.exe" called "FindResourceA" with parameter "3" - (UID: 00000000-00006484) "Adobereaderxi.exe" called "FindResourceA" with parameter "4" - (UID: 00000000-00006484) "Adobereaderxi.exe" called "FindResourceA" with parameter "102" - (UID: 00000000-00006484)4c:T496,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006484.00000000.67864.00640000.00000004.mdmp, 00000000-00006484.00000001.69785.00640000.00000004.mdmp") Found string "m32\drivers\SandboxFltr.sys" (Indicator: "\drivers\"; Source: "00000000-00006484.00000000.67864.03490000.00000002.mdmp, 00000000-00006484.00000001.69785.03490000.00000002.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007804.00000000.66766.03530000.00000004.mdmp") Found string "m32\drivers\SandboxFltr.sys" (Indicator: "\drivers\"; Source: "00000000-00007804.00000000.66766.03AD0000.00000002.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00008080.00000000.67269.03360000.00000004.mdmp, 00000000-00008080.00000001.69190.03360000.00000004.mdmp, 00000000-00008080.00000002.71107.03360000.00000004.mdmp") Found string "m32\drivers\SandboxFltr.sys" (Indicator: "\drivers\"; Source: "00000000-00008080.00000000.67269.03900000.00000002.mdmp, 00000000-00008080.00000001.69190.03900000.00000002.mdmp, 00000000-00008080.00000002.71107.03900000.00000002.mdmp")4d:Tde0,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp")4e:T4dc,Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00006484.00000000.67864.00400000.00000040.mdmp") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "OpenMutexA" (Indicator: "OpenMutex"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "OpenMutexA" (Indicator: "OpenMutex"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00008080.00000002.71107.06480000.00000040.mdmp")4f:T1514,Spawned process "RFQ110623.pdf.exe" (UID: 00000000-00007804) Spawned process "WerFault.exe" with commandline "-pss -s 440 -p 7804 -ip 7804" (UID: 00000000-00007880) Spawned process "WerFault.exe" with commandline "-u -p 7804 -s 552" (UID: 00000000-00007420) Spawned process "WerFault.exe" with commandline "-pss -s 496 -p 7804 -ip 7804" (UID: 00000000-00006552) Spawned process "WerFault.exe" with commandline "-u -p 7804 -s 868" (UID: 00000000-00001288) Spawned process "WerFault.exe" with commandline "-pss -s 516 -p 7804 -ip 7804" (UID: 00000000-00005352) Spawned process "WerFault.exe" with commandline "-u -p 7804 -s 984" (UID: 00000000-00001412) Spawned process "WerFault.exe" with commandline "-pss -s 536 -p 7804 -ip 7804" (UID: 00000000-00007816) Spawned process "WerFault.exe" with commandline "-u -p 7804 -s 1012" (UID: 00000000-00001492) Spawned process "WerFault.exe" with commandline "-pss -s 544 -p 7804 -ip 7804" (UID: 00000000-00004596) Spawned process "WerFault.exe" with commandline "-u -p 7804 -s 1032" (UID: 00000000-00003292) Spawned process "WerFault.exe" with commandline "-pss -s 512 -p 7804 -ip 7804" (UID: 00000000-00007240) Spawned process "WerFault.exe" with commandline "-u -p 7804 -s 1008" (UID: 00000000-00000368) Spawned process "Adobereaderxi.exe" (UID: 00000000-00008080) Spawned process "WerFault.exe" with commandline "-pss -s 536 -p 8080 -ip 8080" (UID: 00000000-00005324) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 556" (UID: 00000000-00004640) Spawned process "WerFault.exe" with commandline "-pss -s 552 -p 8080 -ip 8080" (UID: 00000000-00002600) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 700" (UID: 00000000-00007952) Spawned process "WerFault.exe" with commandline "-pss -s 568 -p 8080 -ip 8080" (UID: 00000000-00006384) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 720" (UID: 00000000-00006092) Spawned process "WerFault.exe" with commandline "-pss -s 552 -p 8080 -ip 8080" (UID: 00000000-00008112) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 836" (UID: 00000000-00008180) Spawned process "WerFault.exe" with commandline "-pss -s 552 -p 8080 -ip 8080" (UID: 00000000-00007444) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 836" (UID: 00000000-00000420) Spawned process "WerFault.exe" with commandline "-pss -s 536 -p 8080 -ip 8080" (UID: 00000000-00006684) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 852" (UID: 00000000-00006524) Spawned process "WerFault.exe" with commandline "-pss -s 536 -p 8080 -ip 8080" (UID: 00000000-00007248) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 856" (UID: 00000000-00005900) Spawned process "WerFault.exe" with commandline "-pss -s 532 -p 8080 -ip 8080" (UID: 00000000-00006340) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 1016" (UID: 00000000-00006352) Spawned process "WerFault.exe" with commandline "-pss -s 532 -p 8080 -ip 8080" (UID: 00000000-00006328) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 1032" (UID: 00000000-00000964) Spawned process "WerFault.exe" with commandline "-pss -s 532 -p 8080 -ip 8080" (UID: 00000000-00006664) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 1032" (UID: 00000000-00003784) Spawned process "WerFault.exe" with commandline "-pss -s 508 -p 8080 -ip 8080" (UID: 00000000-00001996) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 1084" (UID: 00000000-00004528) Spawned process "WerFault.exe" with commandline "-pss -s 536 -p 8080 -ip 8080" (UID: 00000000-00005356) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 836" (UID: 00000000-00008152) Spawned process "Adobereaderxi.exe" with commandline "/stext "%TEMP%\\updnsrjfeencnoktwtogyhnwp"" (UID: 00000000-00004928) Spawned process "Adobereaderxi.exe" with commandline "/stext "%TEMP%\\erixtjchsmfgxuyxfwbhjuifypnc"" (UID: 00000000-00006484) Spawned process "Adobereaderxi.exe" with commandline "/stext "%TEMP%\\plnqucnaguxtaiujxgwbmhcvheelwhdd"" (UID: 00000000-00001052) Spawned process "WerFault.exe" with commandline "-pss -s 548 -p 8080 -ip 8080" (UID: 00000000-00002412) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 860" (UID: 00000000-00000408) Spawned process "WerFault.exe" with commandline "-pss -s 552 -p 8080 -ip 8080" (UID: 00000000-00007488) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 1112" (UID: 00000000-00004012) Spawned process "WerFault.exe" with commandline "-pss -s 552 -p 8080 -ip 8080" (UID: 00000000-00001376) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 1112" (UID: 00000000-00003940) Spawned process "WerFault.exe" with commandline "-pss -s 516 -p 8080 -ip 8080" (UID: 00000000-00005468) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 1248" (UID: 00000000-00002724) Spawned process "WerFault.exe" with commandline "-pss -s 540 -p 8080 -ip 8080" (UID: 00000000-00007500) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 1248" (UID: 00000000-00007468) Spawned process "WerFault.exe" with commandline "-pss -s 540 -p 8080 -ip 8080" (UID: 00000000-00000952) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 760" (UID: 00000000-00002604) Spawned process "WerFault.exe" with commandline "-pss -s 520 -p 8080 -ip 8080" (UID: 00000000-00007792)50:T404,Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp")51:T6e6,Found string "password-check" (Indicator: "password"; Source: "00000000-00006484.00000000.67864.00400000.00000040.mdmp") Found string "SELECT item1,item2 FROM metadata WHERE id = 'password'" (Indicator: "password"; Source: "00000000-00006484.00000000.67864.00400000.00000040.mdmp") Found string "passwordField" (Indicator: "password"; Source: "00000000-00006484.00000000.67864.00400000.00000040.mdmp") Found string "ps:password" (Indicator: "password"; Source: "00000000-00006484.00000000.67864.00400000.00000040.mdmp") Found string "Web Browser Passwords%Choose another Firefox profile folder)Choose the installation folder of Firefox,Choose another profile of Chrome Web browser,Choose the password file of Opera (wand.dat)" (Indicator: "password"; Source: "00000000-00008080.00000002.71107.06400000.00000040.mdmp") Found string "password-check" (Indicator: "password"; Source: "00000000-00008080.00000002.71107.06480000.00000040.mdmp") Found string "SELECT item1,item2 FROM metadata WHERE id = 'password'" (Indicator: "password"; Source: "00000000-00008080.00000002.71107.06480000.00000040.mdmp") Found string "passwordField" (Indicator: "password"; Source: "00000000-00008080.00000002.71107.06480000.00000040.mdmp") Found string "ps:password" (Indicator: "password"; Source: "00000000-00008080.00000002.71107.06480000.00000040.mdmp, 00000000-00008080.00000002.71107.064E0000.00000040.mdmp") Found string "S'password'" (Indicator: "password"; Source: "00000000-00008080.00000002.71107.064E0000.00000040.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00008080.00000002.71107.064E0000.00000040.mdmp") Found string ".aim.session.password" (Indicator: "password"; Source: "00000000-00008080.00000002.71107.064E0000.00000040.mdmp")52:T17d2,Found string "-----BEGIN RSA PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found string "-----END RSA PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found string "-----BEGIN PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found string "-----END PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found string "-----BEGIN ENCRYPTED PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found string "-----END ENCRYPTED PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found string "-----BEGIN EC PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found string "-----END EC PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found string "-----BEGIN DSA PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found string "-----END DSA PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found string "-----BEGIN PUBLIC KEY-----" (Indicator: "public key"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found string "-----END PUBLIC KEY-----" (Indicator: "public key"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found string "-----BEGIN RSA PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found string "-----END RSA PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found string "-----BEGIN PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found string "-----END PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found string "-----BEGIN ENCRYPTED PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found string "-----END ENCRYPTED PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found string "-----BEGIN EC PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found string "-----END EC PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found string "-----BEGIN DSA PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found string "-----END DSA PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found string "-----BEGIN PUBLIC KEY-----" (Indicator: "public key"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found string "-----END PUBLIC KEY-----" (Indicator: "public key"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp")53:T730,Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp, 00000000-00008080.00000002.71107.064E0000.00000040.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp, 00000000-00008080.00000002.71107.064E0000.00000040.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00008080.00000002.71107.064E0000.00000040.mdmp")54:T5b6,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00006484.00000000.67864.00400000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006484.00000000.67864.00400000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp, 00000000-00008080.00000002.71107.06480000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp, 00000000-00008080.00000002.71107.06480000.00000040.mdmp")55:Tfff,"Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\GOOGLE\GOOGLE TALK\ACCOUNTS") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\GOOGLE\GOOGLE DESKTOP\MAILBOXES") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET ACCOUNT MANAGER\ACCOUNTS") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\OUTLOOK\OMI ACCOUNT MANAGER\ACCOUNTS") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\0A0D020000000000C000000000000046") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\13DBB0C8AA05101A9BB000AA002FC45A") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\145F94E17C1BEF4EA0C7C0FFE0281209") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\164D954C8067624AB95745E6AACABBAA") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\3575129E50E947419FDF5A56D374D888") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\5430004994B7FC4E9FA8C66DEEDA72DE") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\69B842504530E04082E028C5E66D7DDF") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\80E3043E13E8B745803E446559A6D0E6") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\8503020000000000C000000000000046") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9207F3E0A3B11019908B08002B2A56C2") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "POP3 USER") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "IMAP USER") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "HTTP USER") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "SMTP USER") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "POP3 USER") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "IMAP USER") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "HTTP USER") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "SMTP USER") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\F86ED2903A4A11CFB57E524153480001") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\INCREDIMAIL\IDENTITIES") "Adobereaderxi.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\INCREDIMAIL\IDENTITIES") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\MSNMESSENGER") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\MESSENGERSERVICE") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\YAHOO\PAGER") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\IDENTITYCRL\DYNAMIC SALT") "Adobereaderxi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS LIVE MAIL")56:T56d,Found string "system" (Source: RFQ110623.pdf .exe, API is part of module: MSVCRT.DLL) Found string "FlsFree" (Source: RFQ110623.pdf .exe, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: RFQ110623.pdf .exe, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: RFQ110623.pdf .exe, API is part of module: KERNELBASE.DLL) Found string "FlsAlloc" (Source: RFQ110623.pdf .exe, API is part of module: KERNELBASE.DLL) Found string "floor" (Source: RFQ110623.pdf .exe, API is part of module: MSVCRT.DLL) Found string "log10" (Source: RFQ110623.pdf .exe, API is part of module: MSVCRT.DLL) Found string "frexp" (Source: RFQ110623.pdf .exe, API is part of module: MSVCRT.DLL) Found string "ldexp" (Source: RFQ110623.pdf .exe, API is part of module: MSVCRT.DLL) Found string "atan2" (Source: RFQ110623.pdf .exe, API is part of module: MSVCRT.DLL) Found string "GetProcessWindowStation" (Source: RFQ110623.pdf .exe, API is part of module: USER32.DLL) Found string "GetUserObjectInformationW" (Source: RFQ110623.pdf .exe, API is part of module: USER32.DLL) Found string "GetLastActivePopup" (Source: RFQ110623.pdf .exe, API is part of module: USER32.DLL) Found string "GetActiveWindow" (Source: RFQ110623.pdf .exe, API is part of module: USER32.DLL) Found string "MessageBoxW" (Source: RFQ110623.pdf .exe, API is part of module: USER32.DLL)57:T7c8,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp")58:T4be,"RFQ110623.pdf.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\") "RFQ110623.pdf.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "RMC-74HSI3"; Value: ""%ALLUSERSPROFILE%\AdobereaderXI\Adobereaderxi.exe"") "RFQ110623.pdf.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\") "RFQ110623.pdf.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "RMC-74HSI3"; Value: ""%ALLUSERSPROFILE%\AdobereaderXI\Adobereaderxi.exe"") "Adobereaderxi.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\") "Adobereaderxi.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "RMC-74HSI3"; Value: ""%ALLUSERSPROFILE%\AdobereaderXI\Adobereaderxi.exe"") "Adobereaderxi.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\") "Adobereaderxi.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "RMC-74HSI3"; Value: ""%ALLUSERSPROFILE%\AdobereaderXI\Adobereaderxi.exe"")59:T515,"RFQ110623.pdf.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003672)5a:T7fc,Found reference to API "EnumServicesStatusW" (Indicator: "EnumServicesStatus"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "OpenSCManagerA" (Indicator: "OpenSCManager"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "EnumServicesStatusW" (Indicator: "EnumServicesStatus"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "OpenSCManagerA" (Indicator: "OpenSCManager"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp")5b:Tb55,"RFQ110623.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SANDBOXFLTR"; Key: "SUPPORTEDFEATURES"; Value: "") "RFQ110623.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WCIFS"; Key: "SUPPORTEDFEATURES"; Value: "") "RFQ110623.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WOF"; Key: "SUPPORTEDFEATURES"; Value: "") "RFQ110623.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FILEINFO"; Key: "SUPPORTEDFEATURES"; Value: "") "RFQ110623.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "RFQ110623.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAMDATA\ADOBEREADERXI\ADOBEREADERXI.EXE"; Value: "") "Adobereaderxi.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAMDATA\ADOBEREADERXI\ADOBEREADERXI.EXE"; Value: "") "Adobereaderxi.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "Adobereaderxi.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "Adobereaderxi.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "Adobereaderxi.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "Adobereaderxi.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "Adobereaderxi.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "Adobereaderxi.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "Adobereaderxi.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "Adobereaderxi.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "Adobereaderxi.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "")5c:T6ef9,"RFQ110623.pdf.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter FindNextFileA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetLongPathNameW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetLocaleInfoA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter IsBadReadPtr (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter OpenMutexA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter lstrcatW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetTempFileNameW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GlobalUnlock (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter MulDiv (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter SizeofResource (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter QueryDosDeviceW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter FindFirstVolumeW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter FindResourceA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter LockResource (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter LoadResource (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter FindVolumeClose (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetVolumePathNamesForVolumeNameW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter lstrcpyW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter FindFirstFileA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter FormatMessageA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter FindNextVolumeW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter AllocConsole (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter lstrcmpW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter lstrcpynA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter HeapSize (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter SetStdHandle (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter IsValidCodePage (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter FindFirstFileExA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter ReadConsoleW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter EnumSystemLocalesW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetUserDefaultLCID (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter IsValidLocale (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetTimeFormatW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetDateFormatW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter MoveFileExW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetCPInfo (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetStringTypeW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetLocaleInfoW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter LCMapStringW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CompareStringW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter TlsFree (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter TlsSetValue (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter TerminateThread (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter RemoveDirectoryW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter MoveFileW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetLogicalDriveStringsA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetDriveTypeA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CreateMutexA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter PeekNamedPipe (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CreatePipe (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter HeapCreate (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter ExitThread (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter SetConsoleOutputCP (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter WaitForSingleObjectEx (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter SetEndOfFile (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter RegEnumKeyExA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter OpenSCManagerA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter ControlService (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter StartServiceW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter QueryServiceConfigW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter ChangeServiceConfigW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter EnumServicesStatusW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter RegCreateKeyA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter RegSetValueExA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter RegCreateKeyW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter RegDeleteKeyA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter StretchBlt (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CreateDCA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GetObjectA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GdipSaveImageToStream (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GdipGetImageEncodersSize (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GdipFree (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GdipAlloc (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GdipCloneImage (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GdipGetImageEncoders (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter GdipLoadImageFromStream (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter CoGetObject (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter ShellExecuteExA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter Shell_NotifyIconA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter ExtractIconA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter ShellExecuteW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter PathFileExistsW (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter PathFileExistsA (UID: 00000000-00003672) "RFQ110623.pdf.exe" called "GetProcAddress" with a parameter StrToIntA (UID: 00000000-00003672)5d:T1296,"Adobereaderxi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\HISTORY.DAT" "Adobereaderxi.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\places.sqlite" "Adobereaderxi.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\profiles.ini" "Adobereaderxi.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\key4.db" "Adobereaderxi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\KEY4.DB-JOURNAL" "Adobereaderxi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\KEY4.DB-WAL" "Adobereaderxi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\KEY3.DB" "Adobereaderxi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\KEY4.DB" "Adobereaderxi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\KEY3.DB" "Adobereaderxi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\SEAMONKEY\PROFILES" "Adobereaderxi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Mozilla\SEAMONKEY\PROFILES" "Adobereaderxi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\SEAMONKEY\PROFILES.INI" "Adobereaderxi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\WATERFOX\PROFILES.INI" "Adobereaderxi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA\DEFAULT\LOGIN DATA" "Adobereaderxi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA\DEFAULT\LOGIN DATA" "Adobereaderxi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\WEB DATA" "Adobereaderxi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\LOGIN DATA" "Adobereaderxi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Autofill\WEB DATA" "Adobereaderxi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Autofill\LOGIN DATA" "Adobereaderxi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\WEB DATA" "Adobereaderxi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\LOGIN DATA" "Adobereaderxi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\WEB DATA" "Adobereaderxi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\LOGIN DATA" "Adobereaderxi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\WEB DATA" "Adobereaderxi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\LOGIN DATA" "Adobereaderxi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Crashpad\WEB DATA" "Adobereaderxi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Crashpad\LOGIN DATA" "Adobereaderxi.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" "Adobereaderxi.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" "Adobereaderxi.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal" "Adobereaderxi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\WEB DATA-WAL" "Adobereaderxi.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "Adobereaderxi.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal" "Adobereaderxi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\LOGIN DATA-WAL"5e:T74b,Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00007804-00000C26-41837405") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00007804-00000C26-41837459") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00007804-00000C26-41837545") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp")5f:T854,"RFQ110623.pdf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "RFQ110623.pdf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "RFQ110623.pdf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "RFQ110623.pdf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "RFQ110623.pdf.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "RFQ110623.pdf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "RFQ110623.pdf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "RFQ110623.pdf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "RFQ110623.pdf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "RFQ110623.pdf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "RFQ110623.pdf.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "RFQ110623.pdf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: ""; Value: "") "RFQ110623.pdf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "RFQ110623.pdf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "RFQ110623.pdf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") "RFQ110623.pdf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "RFQ110623.pdf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING"; Key: ""; Value: "")60:T993,Spawned process "WerFault.exe" with commandline "-pss -s 440 -p 7804 -ip 7804" (UID: 00000000-00007880) Spawned process "WerFault.exe" with commandline "-u -p 7804 -s 552" (UID: 00000000-00007420) Spawned process "WerFault.exe" with commandline "-pss -s 496 -p 7804 -ip 7804" (UID: 00000000-00006552) Spawned process "WerFault.exe" with commandline "-u -p 7804 -s 868" (UID: 00000000-00001288) Spawned process "WerFault.exe" with commandline "-pss -s 516 -p 7804 -ip 7804" (UID: 00000000-00005352) Spawned process "WerFault.exe" with commandline "-u -p 7804 -s 984" (UID: 00000000-00001412) Spawned process "WerFault.exe" with commandline "-pss -s 536 -p 7804 -ip 7804" (UID: 00000000-00007816) Spawned process "WerFault.exe" with commandline "-u -p 7804 -s 1012" (UID: 00000000-00001492) Spawned process "WerFault.exe" with commandline "-pss -s 544 -p 7804 -ip 7804" (UID: 00000000-00004596) Spawned process "WerFault.exe" with commandline "-u -p 7804 -s 1032" (UID: 00000000-00003292) Spawned process "WerFault.exe" with commandline "-pss -s 512 -p 7804 -ip 7804" (UID: 00000000-00007240) Spawned process "WerFault.exe" with commandline "-u -p 7804 -s 1008" (UID: 00000000-00000368) Spawned process "Adobereaderxi.exe" (UID: 00000000-00008080) Spawned process "WerFault.exe" with commandline "-pss -s 536 -p 8080 -ip 8080" (UID: 00000000-00005324) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 556" (UID: 00000000-00004640) Spawned process "WerFault.exe" with commandline "-pss -s 552 -p 8080 -ip 8080" (UID: 00000000-00002600) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 700" (UID: 00000000-00007952) Spawned process "WerFault.exe" with commandline "-pss -s 568 -p 8080 -ip 8080" (UID: 00000000-00006384) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 720" (UID: 00000000-00006092) Spawned process "WerFault.exe" with commandline "-pss -s 552 -p 8080 -ip 8080" (UID: 00000000-00008112) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 836" (UID: 00000000-00008180) Spawned process "WerFault.exe" with commandline "-pss -s 552 -p 8080 -ip 8080" (UID: 00000000-00007444) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 836" (UID: 00000000-00000420) Spawned process "WerFault.exe" with commandline "-pss -s 536 -p 8080 -ip 8080" (UID: 00000000-00006684) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 852" (UID: 00000000-00006524)61:T13f5,Found URL "http://www.nirsoft.net/" - Source: "00000000-00006484.00000000.67864.00400000.00000040.mdmp") Found URL "http://www.nirsoft.netw" - Source: "00000000-00006484.00000000.67864.01324000.00000004.mdmp") Found URL "http://www.nirsoft.netw" - Source: "00000000-00006484.00000001.69785.01324000.00000004.mdmp") Found URL "http://geoplugin.net/json.gpcmd.exe\sysinfo.txttempdxdiagimage/jpegimage/pngwnd_%04i%02i%02i_%02i%02i%02itime_%04i%02i%02i_%02i%02i%02i" - Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007804.00000000.66766.03530000.00000004.mdmp") Found URL "http://geoplugin.net/json.gpcmd.exe\sysinfo.txttempdxdiagimage/jpegimage/pngwnd_%04i%02i%02i_%02i%02i%02itime_%04i%02i%02i_%02i%02i%02i" - Source: "00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found URL "http://geoplugin.net/json.gpcmd.exe\sysinfo.txttempdxdiagimage/jpegimage/pngwnd_%04i%02i%02i_%02i%02i%02itime_%04i%02i%02i_%02i%02i%02i" - Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00008080.00000000.67269.03360000.00000004.mdmp") Found URL "http://geoplugin.net/json.gpcmd.exe\sysinfo.txttempdxdiagimage/jpegimage/pngwnd_%04i%02i%02i_%02i%02i%02itime_%04i%02i%02i_%02i%02i%02i" - Source: "00000000-00008080.00000001.69190.00400000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00008080.00000001.69190.03360000.00000004.mdmp") Found URL "http://geoplugin.net/json.gphttp://geoplugin.net/json.gpc:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\4ekoowyy\json[1].jsoneoplugin.netummy://url/eoplugin.neteoplugin.netgeoplugin.neteoplugin.neteoplugin.netgeoplugin.neteoplugin.neteoplugin.netet-sacfwgdobntppdata\localet-sacfwgdobntocal" - Source: "00000000-00008080.00000001.69190.033C5000.00000004.mdmp") Found URL "http://geoplugin.net/json.gp*spthttp://geoplugin.net/json.gphttp://geoplugin.net/json.gphttp://geoplugin.net/json.gphttp://geoplugin.net/json.gp" - Source: "00000000-00008080.00000001.69190.033C5000.00000004.mdmp") Found URL "http://geoplugin.net/json.gpgeoplugin.net/json.gp4ekoowyybloom_section_" - Source: "00000000-00008080.00000001.69190.033F8000.00000004.mdmp") Found URL "http://geoplugin.net/json.gpcmd.exe\sysinfo.txttempdxdiagimage/jpegimage/pngwnd_%04i%02i%02i_%02i%02i%02itime_%04i%02i%02i_%02i%02i%02i" - Source: "00000000-00008080.00000002.71107.00400000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00008080.00000002.71107.03360000.00000004.mdmp") Found URL "http://geoplugin.net/json.gphttp://geoplugin.net/json.gpc:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\4ekoowyy\json[1].jsoneoplugin.netummy://url/eoplugin.neteoplugin.netgeoplugin.neteoplugin.neteoplugin.netgeoplugin.neteoplugin.neteoplugin.netet-sacfwgdobntppdata\localet-sacfwgdobntocal" - Source: "00000000-00008080.00000002.71107.033C5000.00000004.mdmp") Found URL "http://geoplugin.net/json.gp*spthttp://geoplugin.net/json.gphttp://geoplugin.net/json.gphttp://geoplugin.net/json.gphttp://geoplugin.net/json.gp" - Source: "00000000-00008080.00000002.71107.033C5000.00000004.mdmp") Found URL "http://geoplugin.net/json.gpgeoplugin.net/json.gp4ekoowyybloom_section_" - Source: "00000000-00008080.00000002.71107.033F8000.00000004.mdmp") Found URL "http://geoplugin.net/json.gpcmd.exe\sysinfo.txttempdxdiagimage/jpegimage/pngwnd_%04i%02i%02i_%02i%02i%02itime_%04i%02i%02i_%02i%02i%02i" - Source: "00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found URL "https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/loginhttp://https://:stringdataftp://captionmenu_%ddialog_%dstringsgeneralsysdatetimepick32charsettranslatornametranslatorurlversion_lng.inidllhost.exetaskhost.exetaskhostex.execontainerscontaineridnamehistorycontainer_%i64daccesscountcreationtimeexpirytimeaccessedtimemodifiedtimeentryidmicrosoft\windows\webcache\webcachev01.datmicrosoft\windows\webcache\webcachev24.dat%-18s:" - Source: "00000000-00008080.00000002.71107.06400000.00000040.mdmp") Found URL "http://www.nirsoft.net/" - Source: "00000000-00008080.00000002.71107.06400000.00000040.mdmp") Found URL "http://www.nirsoft.net/" - Source: "00000000-00008080.00000002.71107.06480000.00000040.mdmp") Found URL "http://www.imvu.compassport.net\*windowslive:name=*windowslive:name=%gkp$^%^&ll(%^$^o&tr$^%^gv6;lxzd82bd0e67-9fea-4748-8672-d5efe5b779b0abe2869f-9b47-4cd9-a358-c22904dba7f782bd0e67-9fea-4748-8672-d5efe5b779b0&fileelect" - Source: "00000000-00008080.00000002.71107.064E0000.00000040.mdmp") Found URL "http://www.nirsoft.net/" - Source: "00000000-00008080.00000002.71107.064E0000.00000040.mdmp") Found URL "http://www.imvu.comsoftware\america" - Source: "00000000-00008080.00000002.71107.064E0000.00000040.mdmp") Found URL "http://www.ebuddy.comhttps://www.google.come-mailloginnameyahoo_idmiranda" - Source: "00000000-00008080.00000002.71107.064E0000.00000040.mdmp")62:T993,Spawned process "WerFault.exe" with commandline "-pss -s 440 -p 7804 -ip 7804" (UID: 00000000-00007880) Spawned process "WerFault.exe" with commandline "-u -p 7804 -s 552" (UID: 00000000-00007420) Spawned process "WerFault.exe" with commandline "-pss -s 496 -p 7804 -ip 7804" (UID: 00000000-00006552) Spawned process "WerFault.exe" with commandline "-u -p 7804 -s 868" (UID: 00000000-00001288) Spawned process "WerFault.exe" with commandline "-pss -s 516 -p 7804 -ip 7804" (UID: 00000000-00005352) Spawned process "WerFault.exe" with commandline "-u -p 7804 -s 984" (UID: 00000000-00001412) Spawned process "WerFault.exe" with commandline "-pss -s 536 -p 7804 -ip 7804" (UID: 00000000-00007816) Spawned process "WerFault.exe" with commandline "-u -p 7804 -s 1012" (UID: 00000000-00001492) Spawned process "WerFault.exe" with commandline "-pss -s 544 -p 7804 -ip 7804" (UID: 00000000-00004596) Spawned process "WerFault.exe" with commandline "-u -p 7804 -s 1032" (UID: 00000000-00003292) Spawned process "WerFault.exe" with commandline "-pss -s 512 -p 7804 -ip 7804" (UID: 00000000-00007240) Spawned process "WerFault.exe" with commandline "-u -p 7804 -s 1008" (UID: 00000000-00000368) Spawned process "Adobereaderxi.exe" (UID: 00000000-00008080) Spawned process "WerFault.exe" with commandline "-pss -s 536 -p 8080 -ip 8080" (UID: 00000000-00005324) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 556" (UID: 00000000-00004640) Spawned process "WerFault.exe" with commandline "-pss -s 552 -p 8080 -ip 8080" (UID: 00000000-00002600) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 700" (UID: 00000000-00007952) Spawned process "WerFault.exe" with commandline "-pss -s 568 -p 8080 -ip 8080" (UID: 00000000-00006384) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 720" (UID: 00000000-00006092) Spawned process "WerFault.exe" with commandline "-pss -s 552 -p 8080 -ip 8080" (UID: 00000000-00008112) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 836" (UID: 00000000-00008180) Spawned process "WerFault.exe" with commandline "-pss -s 552 -p 8080 -ip 8080" (UID: 00000000-00007444) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 836" (UID: 00000000-00000420) Spawned process "WerFault.exe" with commandline "-pss -s 536 -p 8080 -ip 8080" (UID: 00000000-00006684) Spawned process "WerFault.exe" with commandline "-u -p 8080 -s 852" (UID: 00000000-00006524)63:T56b,"RFQ110623.pdf.exe" reads file "c:\rfq110623.pdf.exe" "RFQ110623.pdf.exe" reads file "c:\rfq110623.pdf.exe:zone.identifier" "RFQ110623.pdf.exe" reads file "c:\users\%osuser%\desktop\desktop.ini" "RFQ110623.pdf.exe" reads file "c:\users\%osuser%\documents\desktop.ini" "RFQ110623.pdf.exe" reads file "c:\users\%osuser%\music\desktop.ini" "RFQ110623.pdf.exe" reads file "c:\users\%osuser%\pictures\desktop.ini" "RFQ110623.pdf.exe" reads file "c:\users\%osuser%\videos\desktop.ini" "RFQ110623.pdf.exe" reads file "c:\users\%osuser%\downloads\desktop.ini" "RFQ110623.pdf.exe" reads file "c:\users\%osuser%\onedrive\desktop.ini" "RFQ110623.pdf.exe" reads file "c:\users\desktop.ini" "RFQ110623.pdf.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\internet explorer\quick launch\desktop.ini" "RFQ110623.pdf.exe" reads file "c:\windows\fonts\staticcache.dat" "RFQ110623.pdf.exe" reads file "c:\programdata\adobereaderxi\adobereaderxi.exe:zone.identifier" "Adobereaderxi.exe" reads file "c:\users\%osuser%\appdata\local\temp\plnqucnaguxtaiujxgwbmhcvheelwhdd" "Adobereaderxi.exe" reads file "c:\users\%osuser%\appdata\local\temp\updnsrjfeencnoktwtogyhnwp" "Adobereaderxi.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles.ini" "Adobereaderxi.exe" reads file "c:\users\%osuser%\appdata\roaming\mozilla\firefox\profiles\ywzu7870.default\key4.db"64:T432,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00006484.00000000.67864.00400000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00006484.00000000.67864.00400000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00006484.00000000.67864.00400000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00006484.00000000.67864.00400000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00008080.00000002.71107.06480000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00008080.00000002.71107.06480000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00008080.00000002.71107.06480000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00008080.00000002.71107.06480000.00000040.mdmp")65:T446,Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00006484.00000000.67864.00400000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00006484.00000000.67864.00400000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00008080.00000002.71107.06480000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00008080.00000002.71107.06480000.00000040.mdmp")66:T1622,Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00006484.00000000.67864.00400000.00000040.mdmp") Found reference to API "CreateDCA" (Indicator: "CreateDC"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007804.00000000.66766.03530000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007804.00000000.66766.03530000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007804.00000000.66766.03530000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007804.00000000.66766.03530000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007804.00000000.66766.03530000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007804.00000000.66766.03530000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007804.00000000.66766.03530000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007804.00000000.66766.03530000.00000004.mdmp") Found reference to API "CreateDCA" (Indicator: "CreateDC"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008080.00000000.67269.03360000.00000004.mdmp, 00000000-00008080.00000001.69190.03360000.00000004.mdmp, 00000000-00008080.00000002.71107.03360000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008080.00000000.67269.03360000.00000004.mdmp, 00000000-00008080.00000001.69190.03360000.00000004.mdmp, 00000000-00008080.00000002.71107.03360000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00008080.00000000.67269.03360000.00000004.mdmp, 00000000-00008080.00000001.69190.03360000.00000004.mdmp, 00000000-00008080.00000002.71107.03360000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008080.00000000.67269.03360000.00000004.mdmp, 00000000-00008080.00000001.69190.03360000.00000004.mdmp, 00000000-00008080.00000002.71107.03360000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008080.00000000.67269.03360000.00000004.mdmp, 00000000-00008080.00000001.69190.03360000.00000004.mdmp, 00000000-00008080.00000002.71107.03360000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008080.00000000.67269.03360000.00000004.mdmp, 00000000-00008080.00000001.69190.03360000.00000004.mdmp, 00000000-00008080.00000002.71107.03360000.00000004.mdmp")67:T7e6,Found reference to API "[+] CoGetObject" (Indicator: "CoGetObject"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "[+] CoGetObject SUCCESS" (Indicator: "CoGetObject"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "[-] CoGetObject FAILURE" (Indicator: "CoGetObject"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "CoGetObject" (Indicator: "CoGetObject"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "[+] CoGetObject" (Indicator: "CoGetObject"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "[+] CoGetObject SUCCESS" (Indicator: "CoGetObject"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "[-] CoGetObject FAILURE" (Indicator: "CoGetObject"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "CoGetObject" (Indicator: "CoGetObject"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp")68:T10d9,Found reference to API "RegEnumKeyA" (Indicator: "RegEnumKey"; Source: "00000000-00006484.00000000.67864.00400000.00000040.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "RegEnumKeyExA" (Indicator: "RegEnumKey"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "RegEnumKeyExA" (Indicator: "RegEnumKey"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "RegEnumKeyA" (Indicator: "RegEnumKey"; Source: "00000000-00008080.00000002.71107.06480000.00000040.mdmp, 00000000-00008080.00000002.71107.064E0000.00000040.mdmp")69:T416,Found reference to API "GetExtendedTcpTable" (Indicator: "GetExtendedTcpTable"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "GetExtendedUdpTable" (Indicator: "GetExtendedUdpTable"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "GetExtendedTcpTable" (Indicator: "GetExtendedTcpTable"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "GetExtendedUdpTable" (Indicator: "GetExtendedUdpTable"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp")6a:T1079,"RFQ110623.pdf.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "RFQ110623.pdf.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "RFQ110623.pdf.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "RFQ110623.pdf.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "RFQ110623.pdf.exe" touched "Previous Versions Property Page" (Path: "HKCU\WOW6432NODE\CLSID\{596AB062-B4D2-4215-9F74-E9109B0A8153}\SHELLEX\NOADDTORECENT") "RFQ110623.pdf.exe" touched "Microsoft SendTo Service" (Path: "HKCU\WOW6432NODE\CLSID\{7BA4C740-9E81-11CF-99D3-00AA004AE837}\SHELLEX\NOADDTORECENT") "RFQ110623.pdf.exe" touched "Copy as Path Menu" (Path: "HKCU\WOW6432NODE\CLSID\{F3D06E7C-1E45-4A26-847E-F9FCDEE59BE0}\SHELLEX\NOADDTORECENT") "RFQ110623.pdf.exe" touched "Start Menu Pin" (Path: "HKCU\WOW6432NODE\CLSID\{A2A9545D-A0C2-42B4-9708-A0B2BADD77C8}\SHELLEX\NOADDTORECENT") "RFQ110623.pdf.exe" touched "Start Menu Cache" (Path: "HKCU\WOW6432NODE\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "RFQ110623.pdf.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "RFQ110623.pdf.exe" touched "Query file associations" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A07034FD-6CAA-4954-AC3F-97A27216F98A}\INPROCSERVER32") "RFQ110623.pdf.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "RFQ110623.pdf.exe" touched "Taskband Pin" (Path: "HKCU\WOW6432NODE\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\SHELLEX\NOADDTORECENT") "RFQ110623.pdf.exe" touched "User Pinned" (Path: "HKCU\WOW6432NODE\CLSID\{1F3427C8-5C10-4210-AA03-2EE45287D668}\SHELLFOLDER") "RFQ110623.pdf.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "RFQ110623.pdf.exe" touched "Applications" (Path: "HKCU\WOW6432NODE\CLSID\{4234D49B-0245-4DF3-B780-3893943456E1}\SHELLFOLDER") "RFQ110623.pdf.exe" touched "Groove GFS Context Menu Handler" (Path: "HKCU\WOW6432NODE\CLSID\{6C467336-8281-4E60-8204-430CED96822D}\SHELLEX\NOADDTORECENT") "RFQ110623.pdf.exe" touched "Shell extensions for sharing" (Path: "HKCU\WOW6432NODE\CLSID\{F81E9010-6EA4-11CE-A7FF-00AA003CA9F6}\SHELLEX\NOADDTORECENT") "RFQ110623.pdf.exe" touched "Registry Data Driven Command" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{02DF6DB6-9405-4812-B3F6-500E8615B7AF}\INPROCSERVER32") "RFQ110623.pdf.exe" touched "Share With Verb" (Path: "HKCU\WOW6432NODE\CLSID\{99D353BC-C813-41EC-8F28-EAE61E702E57}\INSTANCE") "RFQ110623.pdf.exe" touched "Sharing Configuration Manager" (Path: "HKCU\WOW6432NODE\CLSID\{49F371E1-8C5C-4D9C-9A3B-54A6827F513C}\TREATAS") "RFQ110623.pdf.exe" touched "Open With Context Menu Handler" (Path: "HKCU\WOW6432NODE\CLSID\{09799AFB-AD67-11D1-ABCD-00C04FC30936}\SHELLEX\NOADDTORECENT") "RFQ110623.pdf.exe" touched "Ribbon Modern Share Verb" (Path: "HKCU\WOW6432NODE\CLSID\{E2BF9676-5F8F-435C-97EB-11607A5BEDF7}\SHELLEX\NOADDTORECENT") "RFQ110623.pdf.exe" touched "Pin To Start Screen verb handler" (Path: "HKCU\WOW6432NODE\CLSID\{470C0EBD-5D73-4D58-9CED-E91E22E23282}\SHELLEX\NOADDTORECENT") "RFQ110623.pdf.exe" touched "CompatContextMenu Class" (Path: "HKCU\WOW6432NODE\CLSID\{1D27F844-3A1F-4410-85AC-14651078412D}\SHELLEX\NOADDTORECENT") "RFQ110623.pdf.exe" touched "File Property Page Extension" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{21B22460-3AEA-1069-A2DC-08002B30309D}\INPROCSERVER32") "RFQ110623.pdf.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "RFQ110623.pdf.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "RFQ110623.pdf.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS")6b:T822,Assembly shows XOR instruction xor eax ebp in Stream UID: 11154-659-00413421 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11154-659-00413421 Assembly shows XOR instruction xor eax ebp in Stream UID: 11154-657-0040CF61 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11154-657-0040CF61 Assembly shows XOR instruction xor eax ecx in Stream UID: 11154-2639-0045AE82 Assembly shows XOR instruction xor eax dword ptr [esp+18h] in Stream UID: 11154-2639-0045AE82 Assembly shows XOR instruction xor esi ebp in Stream UID: 11154-2639-0045AE82 Assembly shows XOR instruction xor eax esi in Stream UID: 11154-2639-0045AE82 Assembly shows XOR instruction xor eax ebp in Stream UID: 11154-656-00409C59 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11154-656-00409C59 Assembly shows XOR instruction xor eax ebp in Stream UID: 11154-692-0040F811 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11154-692-0040F811 Assembly shows XOR instruction xor eax ebp in Stream UID: 11154-661-0040A325 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11154-661-0040A325 Assembly shows XOR instruction xor eax ebp in Stream UID: 11154-663-0040A5D5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11154-663-0040A5D5 Assembly shows XOR instruction xor eax ebp in Stream UID: 11154-696-0040F9E2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11154-696-0040F9E2 Assembly shows XOR instruction xor eax ebp in Stream UID: 11154-91-00412770 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11154-91-00412770 Assembly shows XOR instruction xor eax ebp in Stream UID: 11154-689-0040F70F Assembly shows XOR instruction xor ecx ebp in Stream UID: 11154-689-0040F70F Assembly shows XOR instruction xor ecx edx in Stream UID: 11154-48-0045AFC0 Assembly shows XOR instruction xor eax dword ptr [esp+1Ch] in Stream UID: 11154-48-0045AFC0 Assembly shows XOR instruction xor esi ebp in Stream UID: 11154-48-0045AFC0 Assembly shows XOR instruction xor eax esi in Stream UID: 11154-48-0045AFC06c:Tab6,""geoplugin_request":"67.218.111.202", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite data created by MaxMind available from http:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"Concord", "geoplugin_region":"California", "geoplugin_regionCode":"CA", "geoplugin_regionName":"California", "geoplugin_areaCode":"", "geoplugin_dmaCode":"807", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"37.9834", "geoplugin_longitude":"-122.0312", "geoplugin_locationAccuracyRadius":"500", "geoplugin_timezone":"America\/Los_Angeles", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0" (Indicator: "maxmind.com"; File: "json_1_.json") "geoplugin.net" (Indicator: "geoplugin.net"; File: "PCAP") "GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache" (Indicator: "geoplugin.net"; File: "PCAP") "http://geoplugin.net/json.gp" (Indicator: "geoplugin.net"; File: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") "http://geoplugin.net/json.gp" (Indicator: "geoplugin.net"; File: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.033C5000.00000004.mdmp, 00000000-00008080.00000001.69190.033F8000.00000004.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.033C5000.00000004.mdmp, 00000000-00008080.00000002.71107.033F8000.00000004.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") "ttp://geoplugin.net/" (Indicator: "geoplugin.net"; File: "00000000-00008080.00000001.69190.033C5000.00000004.mdmp, 00000000-00008080.00000002.71107.033C5000.00000004.mdmp") "ttp://geoplugin.net/json.gp" (Indicator: "geoplugin.net"; File: "00000000-00008080.00000001.69190.033C5000.00000004.mdmp, 00000000-00008080.00000002.71107.033C5000.00000004.mdmp") "geoplugin.net/json.gp" (Indicator: "geoplugin.net"; File: "00000000-00008080.00000001.69190.033C5000.00000004.mdmp, 00000000-00008080.00000002.71107.033C5000.00000004.mdmp") "geoplugin.net" (Indicator: "geoplugin.net"; File: "00000000-00008080.00000001.69190.033C5000.00000004.mdmp, 00000000-00008080.00000001.69190.033F8000.00000004.mdmp, 00000000-00008080.00000001.69190.03411000.00000004.mdmp, 00000000-00008080.00000002.71107.033C5000.00000004.mdmp, 00000000-00008080.00000002.71107.033F8000.00000004.mdmp")6d:T5d8,Found reference to API "RegCreateKeyW" (Indicator: "RegCreateKey"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "RegCreateKeyExW" (Indicator: "RegCreateKey"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "RegCreateKeyA" (Indicator: "RegCreateKey"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "RegCreateKeyW" (Indicator: "RegCreateKey"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "RegCreateKeyExW" (Indicator: "RegCreateKey"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "RegCreateKeyA" (Indicator: "RegCreateKey"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp")6e:T5fe,Found reference to API "URLDownloadToFileW" (Indicator: "URLDownloadToFile"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "URLDownloadToFileW" (Indicator: "URLDownload"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "URLDownloadToFileW" (Indicator: "URLDownloadToFile"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "URLDownloadToFileW" (Indicator: "URLDownload"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp")6f:T7ca,"RFQ110623.pdf.exe" called "FindFirstFileW" with parameter %ALLUSERSPROFILE%\AdobereaderXI\Adobereaderxi.exe (UID: 00000000-00007804) "Adobereaderxi.exe" called "FindFirstFileW" with parameter C:\* (UID: 00000000-00008080) "Adobereaderxi.exe" called "FindNextFileW" with parameter $WINDOWS.~BT (UID: 00000000-00008080) "Adobereaderxi.exe" called "FindNextFileW" with parameter 0F78B956-909D-45B2-8B8D-2E5E1D522649 (UID: 00000000-00008080) "Adobereaderxi.exe" called "FindNextFileW" with parameter 1699288677763$MAPFAILURE (UID: 00000000-00008080) "Adobereaderxi.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\(x86)\* (UID: 00000000-00008080) "Adobereaderxi.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00008080) "Adobereaderxi.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\* (UID: 00000000-00008080) "Adobereaderxi.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History\*.* (UID: 00000000-00004928) "Adobereaderxi.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004928) "Adobereaderxi.exe" called "FindNextFileW" with parameter desktop.ini (UID: 00000000-00004928) "Adobereaderxi.exe" called "FindNextFileW" with parameter History.IE5 (UID: 00000000-00004928) "Adobereaderxi.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History\History.IE5\*.* (UID: 00000000-00004928) "Adobereaderxi.exe" called "FindNextFileW" with parameter container.dat (UID: 00000000-00004928) "Adobereaderxi.exe" called "FindNextFileW" with parameter MSHist012023082320230824 (UID: 00000000-00004928) "Adobereaderxi.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History\History.IE5\MSHist012023082320230824\*.* (UID: 00000000-00004928) "Adobereaderxi.exe" called "FindNextFileW" with parameter Low (UID: 00000000-00004928) "Adobereaderxi.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History\Low\*.* (UID: 00000000-00004928)70:T15db,"SELECT item1,item2 FROM metadata WHERE id = 'password'" (Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp, Indicator: "select item1,item2 from metadata where id = 'password'") "SELECT a11,a102 FROM nssPrivate" (Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp, Indicator: "select a11,a102 from nssprivate") "CREATE TABLE sqlite_master(" (Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp, Indicator: "create table sqlite_master(") "SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid" (Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp, Indicator: "select name, rootpage, sql from '%q'.%s where %s order by rowid") "CREATE TABLE" (Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp, Indicator: "create table") "UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d" (Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp, Indicator: "update %q.%s set type='%s', name=%q, tbl_name=%q, rootpage=#%d, sql=%q where rowid=#%d") "DELETE FROM %Q.%s WHERE %s=%Q" (Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp, Indicator: "delete from %q.%s where %s=%q") "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'") "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "DELETE FROM %Q.%s WHERE name=%Q AND type='index'" (Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp, Indicator: "delete from %q.%s where name=%q and type='index'"), "SELECT name rootpage sql FROM '%q'.%s ORDER BY rowid" (Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp, Indicator: "select name rootpage sql from '%q'.%s order by rowid"), "CREATE TABLE sqlite_master(" (Source: 00000000-00008080.00000002.71107.06400000.00000040.mdmp, 00000000-00008080.00000002.71107.06480000.00000040.mdmp, Indicator: "create table sqlite_master(") "SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid" (Source: 00000000-00008080.00000002.71107.06400000.00000040.mdmp, 00000000-00008080.00000002.71107.06480000.00000040.mdmp, Indicator: "select name, rootpage, sql from '%q'.%s where %s order by rowid") "UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;" (Source: 00000000-00008080.00000002.71107.06400000.00000040.mdmp, Indicator: "update "%w".%s set sql = sqlite_rename_parent(sql, %q, %q) where %s;"), "UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END tbl_name = %Q name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');" (Source: 00000000-00008080.00000002.71107.06400000.00000040.mdmp, Indicator: "update %q.%s set sql = case when type = 'trigger' then sqlite_rename_trigger(sql, %q)else sqlite_rename_table(sql, %q) end tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='table' or type='index' or type='trigger');"), "UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q) tbl_name = %Q WHERE %s;" (Source: 00000000-00008080.00000002.71107.06400000.00000040.mdmp, Indicator: "update sqlite_temp_master set sql = sqlite_rename_trigger(sql, %q) tbl_name = %q where %s;"), "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 00000000-00008080.00000002.71107.06400000.00000040.mdmp, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "CREATE TABLE %Q.%s(%s)" (Source: 00000000-00008080.00000002.71107.06400000.00000040.mdmp, Indicator: "create table %q.%s(%s)"), "DELETE FROM %Q.%s WHERE tbl=%Q" (Source: 00000000-00008080.00000002.71107.06400000.00000040.mdmp, Indicator: "delete from %q.%s where tbl=%q"), "SELECT tbl idx stat FROM %Q.sqlite_stat1" (Source: 00000000-00008080.00000002.71107.06400000.00000040.mdmp, Indicator: "select tbl idx stat from %q.sqlite_stat1"), "CREATE TABLE" (Source: 00000000-00008080.00000002.71107.06400000.00000040.mdmp, 00000000-00008080.00000002.71107.06480000.00000040.mdmp, Indicator: "create table"), "UPDATE %Q.%s SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 00000000-00008080.00000002.71107.06400000.00000040.mdmp, 00000000-00008080.00000002.71107.06480000.00000040.mdmp, Indicator: "update %q.%s set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 00000000-00008080.00000002.71107.06400000.00000040.mdmp, 00000000-00008080.00000002.71107.06480000.00000040.mdmp, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'"), "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 00000000-00008080.00000002.71107.06400000.00000040.mdmp, Indicator: "delete from %q.sqlite_stat1 where tbl=%q"), "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 00000000-00008080.00000002.71107.06400000.00000040.mdmp, 00000000-00008080.00000002.71107.06480000.00000040.mdmp, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);")71:T567,"RFQ110623.pdf.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "RFQ110623.pdf.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "RFQ110623.pdf.exe" trying to touch file "C:\FLTLIB.DLL" "RFQ110623.pdf.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "RFQ110623.pdf.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "RFQ110623.pdf.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "RFQ110623.pdf.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "RFQ110623.pdf.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "RFQ110623.pdf.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "RFQ110623.pdf.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "RFQ110623.pdf.exe" trying to touch file "C:\msimg32.dll" "RFQ110623.pdf.exe" trying to touch file "C:\Windows\system32\msimg32.dll" "RFQ110623.pdf.exe" trying to touch file "C:\RFQ110623.pdf.exe.Local\" "RFQ110623.pdf.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e" "RFQ110623.pdf.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" "RFQ110623.pdf.exe" trying to touch file "C:\Windows\System32\imm32.dll"72:T6d4,Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00006484.00000000.67864.00400000.00000040.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp, 00000000-00008080.00000002.71107.06480000.00000040.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp, 00000000-00008080.00000002.71107.064E0000.00000040.mdmp")73:T5f8,Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp")18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":["windows-server-utility"],"file_activity":{"dropped_files":[],"extracted_files":[{"name":"Adobereaderxi.exe","sha256":"0e8dfb4c4b15bffe7df07f0a9240c2287e23c149b465991da96b73eff7b8f903","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"verdict":"malicious"},{"name":"updnsrjfeencnoktwtogyhnwp","sha256":"b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"verdict":"undetected"},{"name":"json_1_.json","sha256":"88d410a3c6fcf969d063adb37fd0259aeca6555e2db0f2acd85a6a0daeb998ca","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Adobereaderxi.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"verdict":"undetected"}],"files_deleted":[],"files_written":[{"path":"%ALLUSERSPROFILE%\\AdobereaderXI","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\4EKOOWYY\\json[1].json","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\key4.db","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"path":"%TEMP%\\updnsrjfeencnoktwtogyhnwp","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"path":"%TEMP%\\erixtjchsmfgxuyxfwbhjuifypnc","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Web Data","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"path":"%SAMPLEDIR%\\Users\\%OSUSER%","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"path":"%TEMP%\\plnqucnaguxtaiujxgwbmhcvheelwhdd","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[{"name":"SM0:8080:168:WilStaging_02","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"name":"SM0:8080:64:WilError_01","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"name":"SM0:7804:64:WilError_01","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"name":"Local\\SM0:8080:168:WilStaging_02","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"name":"SM0:4928:64:WilError_01","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"name":"Local\\SM0:4928:168:WilStaging_02","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"name":"Local\\SM0:7804:168:WilStaging_02","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"name":"SM0:7804:168:WilStaging_02","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"name":"Local\\SessionImmersiveColorMutex","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"name":"Local\\SM0:7804:64:WilError_01","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"name":"Rmc-74HSI3","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]}]},"network_activity":{"contacted_hosts":[{"address":"5.253.18.198","country":"Germany","port":2407,"protocol":"TCP","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"address":"178.237.33.50","country":"Netherlands","port":80,"protocol":"TCP","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]}],"dns_resolutions":[{"address":"178.237.33.50","country":"Netherlands","domain":"geoplugin.net","registrar_creation_date":"2006-11-06T00:00:00+00:00","registrar_name":"OVH, SAS","registrar_name_servers":"DNS200.ANYCAST.ME","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"ttl":2461},{"address":"5.253.18.198","country":"Germany","domain":"novbillions.myddns.me","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"ttl":60}],"http_requests":[{"header":"GET /json.gp HTTP/1.1\nHost: geoplugin.net\nCache-Control: no-cache","host":"geoplugin.net","host_ip":"178.237.33.50:80","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"url":"/json.gp"}]},"process_activity":{"all_imported_dlls":["sfc.dll","msvcp90.dll","api-ms-win-core-synch-l1-2-0.dll","wow64.dll","msi.dll","cldapi.dll","windows.storage.dll","cryptsp.dll","msvcp_win.dll","profapi.dll","msctf.dll","cfgmgr32.dll","winmm.dll","ucrtbase.dll","RstrtMgr.dll","ntshrui.dll","rmclient.dll","urlmon.dll","ntmarta.dll","ncrypt.dll","winnsi.dll","crypt32.dll","IPHLPAPI.DLL","combase.dll","win32u.dll","rpcrt4.dll","powrprof.dll","msvcr90.dll","SHCore.dll","VxSSL32.dll","msIso.dll","uxtheme.dll","OneCoreUAPCommonProxyStub.dll","ATL90.dll","Windows.StateRepositoryPS.dll","KernelBase.dll","ole32.dll","shlwapi.dll","winmmbase.dll","OnDemandConnRouteHelper.dll","FWPUCLNT.DLL","comdlg32.dll","dpapi.dll","twext.dll","lpk.dll","msvcrt.dll","msimg32.dll","usp10.dll","kernel32.dll","clbcatq.dll","winhttp.dll","psapi.dll","cscapi.dll","pstorec.dll","rsaenh.dll","sfc_os.dll","acppage.dll","imagehlp.dll","srvcli.dll","twinapi.appcore.dll","wow64win.dll","advapi32.dll","gdi32.dll","msvcr100.dll","bcrypt.dll","wininet.dll","mswsock.dll","rasadhlp.dll","imm32.dll","user32.dll","gdi32full.dll","GROOVEEX.DLL","netutils.dll","comctl32.dll","vaultcli.dll","dnsapi.dll","shell32.dll","ntdll.dll","GdiPlus.dll","userenv.dll","propsys.dll","version.dll","ntasn1.dll","bcryptprimitives.dll","msvcp110_win.dll","fltLib.dll","wow64cpu.dll","cryptbase.dll","msasn1.dll","slc.dll","BCP47Langs.dll","iertutil.dll","ws2_32.dll","nsi.dll","AppResolver.dll","ELSCore.dll","kernel.appcore.dll","edputil.dll","aepic.dll","WinTypes.dll","sechost.dll","oleaut32.dll","policymanager.dll","sspicli.dll","setupapi.dll","sppc.dll","apphelp.dll"],"processes":[{"command_line":"","icon":"$22","name":"RFQ110623.pdf.exe","normalized_path":"C:\\RFQ110623.pdf.exe","pid":7804,"ppid":0,"sha256":"0e8dfb4c4b15bffe7df07f0a9240c2287e23c149b465991da96b73eff7b8f903","uid":"00000000-00007804"},{"command_line":"-u -p 7804 -s 552","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007804","pid":7420,"ppid":7804,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00007420"},{"command_line":"-u -p 7804 -s 868","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007804","pid":1288,"ppid":7804,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00001288"},{"command_line":"-u -p 7804 -s 984","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007804","pid":1412,"ppid":7804,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00001412"},{"command_line":"-u -p 7804 -s 1012","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007804","pid":1492,"ppid":7804,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00001492"},{"command_line":"-u -p 7804 -s 1032","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007804","pid":3292,"ppid":7804,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00003292"},{"command_line":"-u -p 7804 -s 1008","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007804","pid":368,"ppid":7804,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00000368"},{"command_line":"","name":"Adobereaderxi.exe","normalized_path":"%ALLUSERSPROFILE%\\AdobereaderXI\\Adobereaderxi.exe","parent_uid":"00000000-00007804","pid":8080,"ppid":7804,"sha256":"0e8dfb4c4b15bffe7df07f0a9240c2287e23c149b465991da96b73eff7b8f903","uid":"00000000-00008080"},{"command_line":"-u -p 8080 -s 556","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008080","pid":4640,"ppid":8080,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00004640"},{"command_line":"-u -p 8080 -s 700","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008080","pid":7952,"ppid":8080,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00007952"},{"command_line":"-u -p 8080 -s 720","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008080","pid":6092,"ppid":8080,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00006092"},{"command_line":"-u -p 8080 -s 836","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008080","pid":8180,"ppid":8080,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00008180"},{"command_line":"-u -p 8080 -s 836","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008080","pid":420,"ppid":8080,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00000420"},{"command_line":"-u -p 8080 -s 852","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008080","pid":6524,"ppid":8080,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00006524"},{"command_line":"-u -p 8080 -s 856","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008080","pid":5900,"ppid":8080,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00005900"},{"command_line":"-u -p 8080 -s 1016","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008080","pid":6352,"ppid":8080,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00006352"},{"command_line":"-u -p 8080 -s 1032","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008080","pid":964,"ppid":8080,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00000964"},{"command_line":"-u -p 8080 -s 1032","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008080","pid":3784,"ppid":8080,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00003784"},{"command_line":"-u -p 8080 -s 1084","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008080","pid":4528,"ppid":8080,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00004528"},{"command_line":"-u -p 8080 -s 836","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008080","pid":8152,"ppid":8080,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00008152"},{"command_line":"/stext \"%TEMP%\\updnsrjfeencnoktwtogyhnwp\"","name":"Adobereaderxi.exe","normalized_path":"%ALLUSERSPROFILE%\\AdobereaderXI\\Adobereaderxi.exe","parent_uid":"00000000-00008080","pid":4928,"ppid":8080,"sha256":"0e8dfb4c4b15bffe7df07f0a9240c2287e23c149b465991da96b73eff7b8f903","uid":"00000000-00004928"},{"command_line":"/stext \"%TEMP%\\erixtjchsmfgxuyxfwbhjuifypnc\"","name":"Adobereaderxi.exe","normalized_path":"%ALLUSERSPROFILE%\\AdobereaderXI\\Adobereaderxi.exe","parent_uid":"00000000-00008080","pid":6484,"ppid":8080,"sha256":"0e8dfb4c4b15bffe7df07f0a9240c2287e23c149b465991da96b73eff7b8f903","uid":"00000000-00006484"},{"command_line":"/stext \"%TEMP%\\plnqucnaguxtaiujxgwbmhcvheelwhdd\"","name":"Adobereaderxi.exe","normalized_path":"%ALLUSERSPROFILE%\\AdobereaderXI\\Adobereaderxi.exe","parent_uid":"00000000-00008080","pid":1052,"ppid":8080,"sha256":"0e8dfb4c4b15bffe7df07f0a9240c2287e23c149b465991da96b73eff7b8f903","uid":"00000000-00001052"},{"command_line":"-u -p 8080 -s 860","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008080","pid":408,"ppid":8080,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00000408"},{"command_line":"-u -p 8080 -s 1112","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008080","pid":4012,"ppid":8080,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00004012"},{"command_line":"-u -p 8080 -s 1112","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008080","pid":3940,"ppid":8080,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00003940"},{"command_line":"-u -p 8080 -s 1248","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008080","pid":2724,"ppid":8080,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00002724"},{"command_line":"-u -p 8080 -s 1248","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008080","pid":7468,"ppid":8080,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00007468"},{"command_line":"-u -p 8080 -s 760","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008080","pid":2604,"ppid":8080,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00002604"},{"command_line":"-u -p 8080 -s 1324","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008080","pid":7940,"ppid":8080,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00007940"},{"command_line":"-u -p 8080 -s 840","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008080","pid":2548,"ppid":8080,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00002548"},{"command_line":"-u -p 8080 -s 840","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008080","pid":7644,"ppid":8080,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00007644"},{"command_line":"-u -p 8080 -s 1288","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008080","pid":7716,"ppid":8080,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00007716"},{"command_line":"-u -p 8080 -s 1316","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008080","pid":5572,"ppid":8080,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00005572"},{"command_line":"-u -p 8080 -s 1340","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008080","pid":1812,"ppid":8080,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00001812"},{"command_line":"-u -p 8080 -s 1340","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008080","pid":6820,"ppid":8080,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00006820"},{"command_line":"-pss -s 440 -p 7804 -ip 7804","icon":"$23","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":7880,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00007880"},{"command_line":"-pss -s 496 -p 7804 -ip 7804","icon":"$24","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":6552,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00006552"},{"command_line":"-pss -s 516 -p 7804 -ip 7804","icon":"$25","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":5352,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00005352"},{"command_line":"-pss -s 536 -p 7804 -ip 7804","icon":"$26","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":7816,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00007816"},{"command_line":"-pss -s 544 -p 7804 -ip 7804","icon":"$27","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":4596,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00004596"},{"command_line":"-pss -s 512 -p 7804 -ip 7804","icon":"$28","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":7240,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00007240"},{"command_line":"-pss -s 536 -p 8080 -ip 8080","icon":"$29","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":5324,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00005324"},{"command_line":"-pss -s 552 -p 8080 -ip 8080","icon":"$2a","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":2600,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00002600"},{"command_line":"-pss -s 568 -p 8080 -ip 8080","icon":"$2b","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":6384,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00006384"},{"command_line":"-pss -s 552 -p 8080 -ip 8080","icon":"$2c","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":8112,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00008112"},{"command_line":"-pss -s 552 -p 8080 -ip 8080","icon":"$2d","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":7444,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00007444"},{"command_line":"-pss -s 536 -p 8080 -ip 8080","icon":"$2e","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":6684,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00006684"},{"command_line":"-pss -s 536 -p 8080 -ip 8080","icon":"$2f","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":7248,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00007248"},{"command_line":"-pss -s 532 -p 8080 -ip 8080","icon":"$30","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":6340,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00006340"},{"command_line":"-pss -s 532 -p 8080 -ip 8080","icon":"$31","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":6328,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00006328"},{"command_line":"-pss -s 532 -p 8080 -ip 8080","icon":"$32","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":6664,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00006664"},{"command_line":"-pss -s 508 -p 8080 -ip 8080","icon":"$33","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":1996,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00001996"},{"command_line":"-pss -s 536 -p 8080 -ip 8080","icon":"$34","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":5356,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00005356"},{"command_line":"-pss -s 548 -p 8080 -ip 8080","icon":"$35","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":2412,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00002412"},{"command_line":"-pss -s 552 -p 8080 -ip 8080","icon":"$36","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":7488,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00007488"},{"command_line":"-pss -s 552 -p 8080 -ip 8080","icon":"$37","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":1376,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00001376"},{"command_line":"-pss -s 516 -p 8080 -ip 8080","icon":"$38","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":5468,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00005468"},{"command_line":"-pss -s 540 -p 8080 -ip 8080","icon":"$39","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":7500,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00007500"},{"command_line":"-pss -s 540 -p 8080 -ip 8080","icon":"$3a","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":952,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00000952"},{"command_line":"-pss -s 520 -p 8080 -ip 8080","icon":"$3b","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":7792,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00007792"},{"command_line":"-pss -s 520 -p 8080 -ip 8080","icon":"$3c","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":4460,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00004460"},{"command_line":"-pss -s 540 -p 8080 -ip 8080","icon":"$3d","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":3576,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00003576"},{"command_line":"-pss -s 528 -p 8080 -ip 8080","icon":"$3e","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":7740,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00007740"},{"command_line":"-pss -s 540 -p 8080 -ip 8080","icon":"$3f","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":1384,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00001384"},{"command_line":"-pss -s 504 -p 8080 -ip 8080","icon":"$40","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":1420,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00001420"},{"command_line":"-pss -s 444 -p 8080 -ip 8080","icon":"$41","name":"WerFault.exe","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","pid":4800,"ppid":0,"sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","uid":"00000000-00004800"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\RMC-74HSI3\\\\","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\\","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\\","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]}],"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\RMC-74HSI3\\DEL\\DEL","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]}],"keys_modified":[]},"sample_flags":["Sample Crashed","Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"analysis_start_time":"2023-11-06T17:07:10+00:00","environment_description":"Windows 7 32 bit","environment_id":100,"id":"65491d3dd4920e1cef07d1c8","indicators_count":{"informative":69,"malicious":3,"suspicious":6},"is_in_unified_schema":true,"malware_family":"UDS:Backdoor.Remcos","state":"SUCCESS","submit_name":"0e8dfb4c4b15bffe7df07f0a9240c2287e23c149b465991da96b73eff7b8f903.exe","threat_score":100,"verdict":"malicious"},{"analysis_start_time":"2023-11-06T16:36:38+00:00","environment_description":"Windows 7 32 bit (HWP Support)","environment_id":110,"id":"6549158a52d9d77db20b623e","indicators_count":{"informative":69,"malicious":3,"suspicious":6},"is_in_unified_schema":true,"malware_family":"UDS:Backdoor.Remcos","state":"SUCCESS","submit_name":"RFQ110623.pdf .exe","threat_score":100,"verdict":"malicious"},{"analysis_start_time":"2023-11-06T16:36:38+00:00","contacted_countries":["DEU","NLD"],"environment_description":"Windows 10 64 bit","environment_id":160,"id":"654915673d2a32ad5e0e07f0","indicators_count":{"informative":190,"malicious":19,"suspicious":49},"is_in_unified_schema":true,"malware_family":"UDS:Backdoor.Remcos","state":"SUCCESS","submit_name":"RFQ110623.pdf .exe","tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"threat_score":100,"verdict":"malicious"}],"stats":{"contacted_hosts_count":2,"contacted_urls_count":1,"dns_resolutions_count":2,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":4,"files_deleted_count":0,"files_written_count":15,"http_requests_count":1,"imported_dlls_count":107,"injected_processes_count":0,"mutex_created_count":13,"process_count":67,"registry_keys_created_count":4,"registry_keys_deleted_count":1,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"script_calls_count":0,"spawned_processes_count":67}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{"malware_families":[{"sources":[{"report_id":"","report_type":"quickscan"}],"value":"Malware"}]},"av_detections":{"engines":{"aegislab":{"data_source":"MetaDefender","name":"AegisLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"clamav":{"data_source":"MetaDefender","name":"ClamAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"comodo":{"data_source":"MetaDefender","name":"Comodo","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"cylance":{"data_source":"MetaDefender","name":"Cylance","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware","verdict":"malicious"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"a variant of Win32/Kryptik.HVEA trojan","verdict":"malicious"},"filseclab":{"data_source":"MetaDefender","name":"Filseclab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"huorong":{"data_source":"MetaDefender","name":"Huorong","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"kaspersky":{"data_source":"MetaDefender","name":"Kaspersky","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"HEUR:Backdoor.Win32.Remcos.gen","verdict":"malicious"},"mcafee":{"data_source":"MetaDefender","name":"McAfee","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"nanoav":{"data_source":"MetaDefender","name":"NANOAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"netgate":{"data_source":"MetaDefender","name":"NETGATE","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"rocketcyber":{"data_source":"MetaDefender","name":"RocketCyber","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"tachyon":{"data_source":"MetaDefender","name":"TACHYON","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trendmicro":{"data_source":"MetaDefender","name":"Trend Micro","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trendmicrohousecall":{"data_source":"MetaDefender","name":"Trend Micro HouseCall","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"varist":{"data_source":"MetaDefender","name":"Varist","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"virusblokada":{"data_source":"MetaDefender","name":"VirusBlokAda","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"webrootsmd":{"data_source":"MetaDefender","name":"Webroot SMD","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware","verdict":"malicious"},"zillya":{"data_source":"MetaDefender","name":"Zillya!","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"}}},"incidents":[{"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"details_count":4,"name":"Persistence","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Tries to identify its external IP address"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Tries to steal Mail credentials from registry"},{"detail":"Queries the display settings of system associated file extensions"}],"details_count":7,"name":"Fingerprint","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"details_count":1,"name":"Network Behavior","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"details":[{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"details_count":1,"name":"Evasive","sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"}],"details_count":2,"name":"Spyware","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"details":[{"detail":"Touched instant messenger related registry keys"},{"detail":"Tries to steal Mail credentials from registry"}],"details_count":2,"name":"Stealer/Phishing","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to retrieve list of TCP/UDP endpoints (API string)"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Network Connections Discovery"},{"attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Discovery","technique":"Software Discovery"},{"attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection"},{"attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains the ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Persistence","technique":"Windows Service"},{"attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection"},{"attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking"},{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Modify Registry"},{"attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"malicious","value":"Calls an API typically used to enumerate the credentials from the user's credential set"},{"type":"informative","value":"Contains ability to to enumerates the credentials (API string)"},{"type":"informative","value":"Found string related to Windows Vault/Credentials location"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Windows Credential Manager"},{"attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Collection","technique":"Automated Collection"},{"attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"suspicious","value":"YARA signature match -: Public Private Key"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Encrypted Channel"},{"attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information"},{"attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains the ability to enumerate volumes (API string)"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Direct Volume Access"},{"attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Software Packing"},{"attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"type":"informative","value":"References user shell folders registry key string"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Dynamic API Resolution"},{"attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Keylogging"},{"attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Input Capture"},{"attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Non-Standard Port"},{"attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Shows ability to use asymmetric encryption algorithm"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Asymmetric Cryptography"},{"attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Execution","technique":"Malicious File"},{"attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Persistence","technique":"Transport Agent"},{"attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"informative","value":"References Firefox browser credentials files"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Credentials from Web Browsers"},{"attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Collection","technique":"Screen Capture"},{"attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Location Discovery"},{"attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Scheduled Transfer"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Symmetric Cryptography"},{"attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Persistence","technique":"Component Object Model Hijacking"},{"attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"},{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Hollowing"},{"attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"malicious","value":"Tries to steal Mail credentials from registry"},{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Collection","technique":"Email Collection"},{"attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Encrypted for Impact"},{"attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Execution","technique":"Service Execution"},{"attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Local System"},{"attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Data Encoding"},{"attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Persistence","technique":"DLL Side-Loading"},{"attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Execution","technique":"Inter-Process Communication"},{"attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Management Instrumentation"},{"attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification"},{"attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Collection","technique":"Archive Collected Data"},{"attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Collection","technique":"Clipboard Data"},{"attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Debugger Evasion"},{"attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Access Token Manipulation"},{"attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hidden Window"},{"attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Application Layer Protocol"},{"attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains reference to licensed c/c++ library"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information"},{"attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Masquerading"},{"attack_id":"T1552.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/002","identifiers":[{"type":"malicious","value":"Touched instant messenger related registry keys"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Credentials in Registry"},{"attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Time Based Evasion"},{"attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Language Discovery"},{"attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal from Tools"},{"attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File Deletion"},{"attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Lateral Tool Transfer"},{"attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal"},{"attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Credentials from Password Stores"},{"attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Information Repositories"},{"attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Execution","technique":"Shared Modules"},{"attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Found a reference to an external IP address lookup service"},{"type":"malicious","value":"Tries to identify its external IP address"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Network Configuration Discovery"},{"attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Contains the ability to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Service Discovery"},{"attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Collection","technique":"Local Data Staging"},{"attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Command and Control","technique":"DNS"},{"attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Discovery","technique":"Application Window Discovery"},{"attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Persistence","technique":"Account Manipulation"},{"attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Web Protocols"},{"attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Impact","technique":"System Shutdown/Reboot"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Execution Guardrails"},{"attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft"},{"attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Impact","technique":"Service Stop"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"},{"attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Owner/User Discovery"},{"attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Persistence","technique":"Boot or Logon Autostart Execution"},{"attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Discovery","technique":"Security Software Discovery"},{"attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Timestomp"},{"attack_id":"T1588.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1588/004","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Resource Development","technique":"Digital Certificates"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Bypass User Account Control"},{"attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Ingress Tool Transfer"},{"attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Persistence","technique":"Create or Modify System Process"},{"attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Command Shell"},{"attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Time Discovery"}],"rule_matches":{},"sandbox_signatures":[{"category":"Anti-Detection/Stealthyness","description":"$42","id":"string-90","level":"informative","mitre_attack_id":"T1055.012","name":"Contains ability to unmap view of a section from a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")","id":"string-132","level":"informative","mitre_attack_id":"T1098","name":"Contains ability to modify the user configuration/privilege (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"System Destruction","description":"\"Adobereaderxi.exe\" marked \"C:\\RFQ110623.pdf.exe\" for deletion\n \"Adobereaderxi.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\plnqucnaguxtaiujxgwbmhcvheelwhdd\" for deletion\n \"Adobereaderxi.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\updnsrjfeencnoktwtogyhnwp\" for deletion","id":"api-26","level":"suspicious","mitre_attack_id":"T1070.004","name":"Marks file for deletion","origin":"API Call","relevance":10,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","id":"summary-32","level":"informative","mitre_attack_id":"T1140","name":"Shows ability to deobfuscate/decode files or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"RFQ110623.pdf .exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"RFQ110623.pdf .exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"RFQ110623.pdf .exe\")","id":"string-148","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to register a top-level exception handler (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"$43","id":"string-208","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to show a graphical window (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"\"RFQ110623.pdf.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 770F0000\n \"RFQ110623.pdf.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 736C0000\n \"Adobereaderxi.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 770F0000\n \"Adobereaderxi.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 736C0000","id":"module-9","level":"informative","mitre_attack_id":"T1027","name":"Loads the Bcrypt module DLL","origin":"Loaded Module","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")","id":"string-84","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to find logical drives of the machine (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"RFQ110623.pdf .exe\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"RFQ110623.pdf .exe\")","id":"string-121","level":"informative","mitre_attack_id":"T1033","name":"Contains ability to retrieve usernames and/or user information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"\"1300140054f47476@RPCRT4.dll\"\n \"150016003cca586a@ADVAPI32.dll\"\n \"0e000f00ecca586a@ADVAPI32.dll\"\n \"0e000f0048cb586a@ADVAPI32.dll\"\n \"1100120010d3586a@ADVAPI32.dll\"\n \"11001200acd3586a@ADVAPI32.dll\"\n \"12001300f0d3586a@ADVAPI32.dll\"\n \"1200130048d4586a@ADVAPI32.dll\"\n \"14001500d4f3586a@ADVAPI32.dll\"\n \"14001500ecf3586a@ADVAPI32.dll\"\n \"1400150004f4586a@ADVAPI32.dll\"\n \"170018001cf4586a@ADVAPI32.dll\"\n \"0d000e0034f4586a@ADVAPI32.dll\"\n \"0f00100060f5586a@ADVAPI32.dll\"\n \"14001500a0f5586a@ADVAPI32.dll\"\n \"14001500b8f5586a@ADVAPI32.dll\"\n \"0c000d0000f6586a@ADVAPI32.dll\"\n \"0c000d0010f6586a@ADVAPI32.dll\"\n \"0e000f0020f6586a@ADVAPI32.dll\"\n \"1800190088f7586a@RPCRT4.dll\"\n \"13001400b4f7586a@RPCRT4.dll\"\n \"14001500c8f7586a@RPCRT4.dll\"\n \"16001700e0f7586a@RPCRT4.dll\"\n \"0b000c0044f0586a@WS2_32.dll\"\n \"1b001c0060d0f569@api-ms-win-core-synch-l1-2-0.DLL\"","id":"api-8","level":"informative","mitre_attack_id":"T1129","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","origin":"API Call","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"RFQ110623.pdf.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","id":"registry-78","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to read software policies","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"\"RFQ110623.pdf.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 713c0000\n \"RFQ110623.pdf.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 0\n \"RFQ110623.pdf.exe\" loaded module \"KERNEL32\" at base 75400000\n \"RFQ110623.pdf.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 0\n \"RFQ110623.pdf.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 69f30000\n \"RFQ110623.pdf.exe\" loaded module \"MSIMG32.DLL\" at base 6f330000\n \"RFQ110623.pdf.exe\" loaded module \"KERNEL32.DLL\" at base 75400000\n \"RFQ110623.pdf.exe\" loaded module \"ADVAPI32.DLL\" at base 76bd0000\n \"RFQ110623.pdf.exe\" loaded module \"GDI32.DLL\" at base 76fa0000\n \"RFQ110623.pdf.exe\" loaded module \"GDIPLUS.DLL\" at base 736c0000\n \"RFQ110623.pdf.exe\" loaded module \"OLE32.DLL\" at base 76710000\n \"RFQ110623.pdf.exe\" loaded module \"SHELL32.DLL\" at base 75780000\n \"RFQ110623.pdf.exe\" loaded module \"SHLWAPI.DLL\" at base 754e0000","id":"api-7","level":"informative","mitre_attack_id":"T1129","name":"Loads modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"\"RFQ110623.pdf .exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"RFQ110623.pdf .exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"RFQ110623.pdf .exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","id":"static-157","level":"informative","mitre_attack_id":"T1027","name":"Matched Compiler/Packer signature (DIE)","origin":"Static Parser","sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Network Related","description":"\"Adobereaderxi.exe\" called \"InternetReadFile\" with parameter 65535 (UID: 00000000-00008080)","id":"api-118","level":"informative","mitre_attack_id":"T1105","name":"Calls an API typically used to retrieve the URL data","origin":"API Call","relevance":3,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")","id":"string-188","level":"informative","mitre_attack_id":"T1115","name":"Contains ability to access clipboard data (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found PE header \"MZ\" - Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007804.00000000.66766.03550000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008080.00000000.67269.03381000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008080.00000001.69190.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008080.00000002.71107.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008080.00000002.71107.03381000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")","id":"memorydump-8","level":"informative","mitre_attack_id":"T1055","name":"Found PE header in memory","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"$44","id":"string-120","level":"informative","mitre_attack_id":"T1012","name":"Contains registry location strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"System Security","description":"$45","id":"string-230","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to delete registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","id":"summary-29","level":"informative","mitre_attack_id":"T1480","name":"Shows ability to use execution guardrails","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Network Related","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","id":"summary-27","level":"informative","mitre_attack_id":"T1119","name":"Shows ability to send encrypted data to the internet","origin":"Indicator Combinations","relevance":2,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"RFQ110623.pdf .exe\")\n Found reference to API \"ExpandEnvironmentStringsA\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"RFQ110623.pdf .exe\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"RFQ110623.pdf .exe\")","id":"string-89","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve information about the current system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Network Related","description":"Heuristic match: \"B}.Ps\"","id":"string-3","level":"informative","mitre_attack_id":"T1071","name":"Found potential URL in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"\"RFQ110623.pdf.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\AdobereaderXI (UID: 00000000-00007804)\n \"Adobereaderxi.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\AdobereaderXI (UID: 00000000-00008080)","id":"api-122","level":"informative","mitre_attack_id":"T1074.001","name":"Calls an API typically used to create a directory","origin":"API Call","relevance":3,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00007804.00000000.66766.00400000.00000040.mdmp\n 00000000-00007804.00000000.66766.05000000.00000040.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00008080.00000000.67269.00400000.00000040.mdmp\n 00000000-00008080.00000001.69190.00400000.00000040.mdmp\n 00000000-00008080.00000002.71107.00400000.00000040.mdmp\n 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Trillian\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00008080.00000002.71107.064E0000.00000040.mdmp","id":"string-96","level":"informative","mitre_attack_id":"T1012","name":"Found registry key string for installed applications","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"RFQ110623.pdf .exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"RFQ110623.pdf .exe\")","id":"string-319","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to set/get the last-error code for a calling thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetLocaleInfoA@KERNEL32.dll at 11154-696-0040F9E2\n GetLocaleInfoW@KERNEL32.dll at 11154-691-0040F7B6\n GetLocaleInfoA@KERNEL32.dll at 11154-689-0040F70F","id":"stream-49","level":"informative","mitre_attack_id":"T1614","name":"Contains ability to query the system locale","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"Adobereaderxi.exe\" called \"GetComputerNameA\" (UID: 00000000-00006484)\n \"Adobereaderxi.exe\" called \"GetComputerNameW\" (UID: 00000000-00006484)\n \"Adobereaderxi.exe\" called \"GetComputerNameA\" (UID: 00000000-00001052)\n \"Adobereaderxi.exe\" called \"GetComputerNameW\" (UID: 00000000-00001052)","id":"api-141","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve computer name","origin":"API Call","relevance":2,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00006484.00000000.67864.00400000.00000040.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp, 00000000-00008080.00000002.71107.06480000.00000040.mdmp\")","id":"string-534","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to read files (API string)","origin":"File/Memory","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"DuplicateToken\" (Indicator: \"DuplicateToken\"; Source: \"00000000-00008080.00000002.71107.064E0000.00000040.mdmp\")","id":"string-114","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"GetCommandLineW@KERNEL32.dll at 11154-1-00408216","id":"stream-118","level":"suspicious","mitre_attack_id":"T1106","name":"Contains ability to retrieve the command-line string for the current process","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"RFQ110623.pdf .exe\" was detected as \"VC8 -> Microsoft Corporation\"","id":"static-18","level":"informative","mitre_attack_id":"T1027.002","name":"Matched Compiler/Packer signature","origin":"Static Parser","relevance":10,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$46","id":"string-92","level":"informative","mitre_attack_id":"T1055","name":"Contains ability to inject code into another process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Possibly contains Public/Private key (encryption)","id":"summary-33","level":"informative","mitre_attack_id":"T1573.002","name":"Shows ability to use asymmetric encryption algorithm","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"\"Adobereaderxi.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\updnsrjfeencnoktwtogyhnwp\"","id":"api-267","level":"informative","mitre_attack_id":"T1005","name":"Writes files in a temp directory","origin":"API Call","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Network Related","description":"TCP traffic to 5.253.18.198 on port 2407","id":"network-7","level":"malicious","mitre_attack_id":"T1571","name":"Uses network protocols on unusual ports","origin":"Network Traffic","relevance":7,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")","id":"string-450","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to determine if process is running under WOW64 (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for Public Private Key used in process \"00000000-00008080\"\n YARA signature for Public Private Key used in process \"00000000-00007804\"","id":"yara-122","level":"suspicious","mitre_attack_id":"T1573","name":"YARA signature match -: Public Private Key","origin":"YARA Signature","relevance":2,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$47","id":"api-125","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get system version information","origin":"API Call","relevance":3,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"$48","id":"string-101","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute Windows APIs","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 11154-2740-0040C551","id":"stream-4","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"GetFileAttributesA\n WriteFile\n GetModuleFileNameW\n VirtualProtect\n CopyFileA\n UnhandledExceptionFilter\n TerminateProcess\n LoadLibraryW\n GetTickCount\n LoadLibraryA\n GetStartupInfoA\n DeleteFileA\n GetStartupInfoW\n FindNextFileW\n GetProcAddress\n CreateFileW\n IsDebuggerPresent\n GetCommandLineW\n GetModuleHandleA\n FindFirstFileA\n GetModuleHandleW\n Sleep","id":"static-1","level":"suspicious","mitre_attack_id":"T1106","name":"Imports suspicious APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"Adobereaderxi.exe\" queries volume information of \"C:\\\" at 00000000-00001052-00000C15-55194269","id":"api-39","level":"informative","mitre_attack_id":"T1082","name":"Queries volume information of an entire harddrive","origin":"API Call","relevance":8,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Network Related","description":"Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance\n Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=sports","id":"network-66","level":"informative","mitre_attack_id":"T1071.001","name":"Sends GET/POST requests (HTTPS)","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"key4.db\" (Indicator: \"key4.db\"; in Source: \"00000000-00006484.00000000.67864.00400000.00000040.mdmp\")\n Found string \"key3.db\" (Indicator: \"key3.db\"; in Source: \"00000000-00006484.00000000.67864.00400000.00000040.mdmp\")\n Found string \"\\key3.db\" (Indicator: \"key3.db\"; in Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found string \"\\key3.db\" (Indicator: \"key3.db\"; in Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")\n Found string \"key4.db\" (Indicator: \"key4.db\"; in Source: \"00000000-00008080.00000002.71107.06480000.00000040.mdmp\")\n Found string \"key3.db\" (Indicator: \"key3.db\"; in Source: \"00000000-00008080.00000002.71107.06480000.00000040.mdmp\")","id":"string-405","level":"informative","mitre_attack_id":"T1555.003","name":"References Firefox browser credentials files","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Network Related","description":"TCP traffic to 178.237.33.50 on port 80 is sent without HTTP header","id":"network-23","level":"suspicious","mitre_attack_id":"T1071.001","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"RFQ110623.pdf .exe\")","id":"string-317","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve address of exported function from a DLL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007804.00000000.66766.03530000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00008080.00000000.67269.03360000.00000004.mdmp, 00000000-00008080.00000001.69190.03360000.00000004.mdmp, 00000000-00008080.00000002.71107.03360000.00000004.mdmp\")","id":"string-320","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to pass information to a window procedure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"Adobereaderxi.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%ALLUSERSPROFILE%\\AdobereaderXI\\Adobereaderxi.exe]- [targetUID: 00000000-00007804]\n \"json_1_.json\" has type \"JSON data\"- [targetUID: N/A]\n \"Adobereaderxi.exe%3AZone.Identifier\" has type \"ASCII text with CRLF line terminators\"- [targetUID: N/A]\n \"updnsrjfeencnoktwtogyhnwp\" has type \"Little-endian UTF-16 Unicode text with no line terminators\"- Location: [%TEMP%\\updnsrjfeencnoktwtogyhnwp]- [targetUID: 00000000-00008080]","id":"binary-0","level":"informative","mitre_attack_id":"T1105","name":"Dropped files","origin":"Binary File","relevance":3,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Network Related","description":"Found http requests in header \"GET /json.gp\"","id":"network-62","level":"informative","mitre_attack_id":"T1071.001","name":"Communicates with HTTP webserver (GET/POST requests)","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$49","id":"registry-172","level":"informative","mitre_attack_id":"T1012","name":"Queries registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"RFQ110623.pdf.exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003672)\n \"RFQ110623.pdf.exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c5ce6764379fe74ffffffff0c0000004c62e6761f79fe74ffffffff0c000000c0ea1200040000000004000001000000d4ea1200210e2f0000000000 (UID: 00000000-00003672)","id":"api-222","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve OS information","origin":"API Call","relevance":2,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$4a","id":"api-139","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to load a resource in memory","origin":"API Call","relevance":3,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")","id":"string-539","level":"informative","mitre_attack_id":"T1071.001","name":"Contains reference to Windows internet services (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"FindNextFileW@KERNEL32.dll at 11154-2639-0045AE82","id":"stream-89","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerate files inside a directory","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"RFQ110623.pdf .exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"RFQ110623.pdf .exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"RFQ110623.pdf .exe\")","id":"string-316","level":"informative","mitre_attack_id":"T1489","name":"Contains ability to terminate a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"Adobereaderxi.exe\" queries volume information of \"C:\\\" at 00000000-00001052-00000C15-55194269","id":"api-11","level":"informative","mitre_attack_id":"T1082","name":"Queries volume information","origin":"API Call","relevance":2,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")","id":"string-426","level":"informative","mitre_attack_id":"T1222","name":"Contains ability to modify file attributes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"Adobereaderxi.exe\" set thread context in remote process \"%ALLUSERSPROFILE%\\AdobereaderXI\\Adobereaderxi.exe\" (PID: 1340)\n \"Adobereaderxi.exe\" set thread context in remote process \"%ALLUSERSPROFILE%\\AdobereaderXI\\Adobereaderxi.exe\" (PID: 1954)\n \"Adobereaderxi.exe\" set thread context in remote process \"%ALLUSERSPROFILE%\\AdobereaderXI\\Adobereaderxi.exe\" (PID: 41c)","id":"api-14","level":"malicious","mitre_attack_id":"T1055.012","name":"Sets thread context in a remote process (often injection or process hollowing)","origin":"API Call","relevance":10,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$4b","id":"api-140","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to find a resource in a module","origin":"API Call","relevance":3,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"\"geoplugin.net\"\n \"novbillions.myddns.me\"","id":"network-51","level":"informative","mitre_attack_id":"T1071.004","name":"Queries DNS server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Network Related","description":"\"Adobereaderxi.exe\" called \"InternetOpenA\" (UID: 00000000-00008080)\n \"Adobereaderxi.exe\" called \"InternetOpenW\" (UID: 00000000-00008080)","id":"api-199","level":"informative","mitre_attack_id":"T1071.001","name":"Calls an API used to connect to internet","origin":"API Call","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")","id":"string-131","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"System Security","description":"$4c","id":"string-474","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to access device drivers","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"Adobereaderxi.exe\" (Thread ID: 8172) slept \"525\" times (threshold: 500)","id":"api-47","level":"suspicious","mitre_attack_id":"T1497.003","name":"Possibly tries to evade analysis by sleeping many times","origin":"API Call","relevance":10,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"RFQ110623.pdf .exe\")","id":"string-535","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to write files (API string)","origin":"File/Memory","sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"External Systems","description":"No specific details available","id":"avtest-5","level":"malicious","name":"Sample was identified as malicious by a trusted Antivirus engine","origin":"External System","relevance":10,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"}]},{"category":"General","description":"$4d","id":"string-161","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve/modify process thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"%APPDATA%\\Microsoft\\Credentials\\*.*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00001052-00000C27-1982484084\")\n \"%LOCALAPPDATA%\\Microsoft\\Credentials\\*.*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00001052-00000C27-2270333678\")","id":"string-197","level":"informative","mitre_attack_id":"T1555.004","name":"Found string related to Windows Vault/Credentials location","origin":"File/Memory","relevance":3,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"FindNextVolumeMountPointA\" (Indicator: \"FindNextVolume\"; File: \"RFQ110623.pdf .exe\")\n Found reference to API \"FindNextVolumeMountPointA\" (Indicator: \"FindNextVolumeMountPoint\"; File: \"RFQ110623.pdf .exe\")\n Found reference to API \"FindFirstVolumeW\" (Indicator: \"FindFirstVolume\"; File: \"RFQ110623.pdf .exe\")","id":"string-194","level":"informative","mitre_attack_id":"T1006","name":"Contains the ability to enumerate volumes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Network Related","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","id":"network-54","level":"informative","mitre_attack_id":"T1573","name":"Making HTTPS connections using secure TLS/SSL version","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$4e","id":"string-354","level":"informative","mitre_attack_id":"T1082","name":"Contains reference to mutex-related activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$4f","id":"target-14","level":"malicious","mitre_attack_id":"T1057","name":"Spawns a lot of processes","origin":"Monitored Target","relevance":8,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$50","id":"string-192","level":"informative","mitre_attack_id":"T1543.003","name":"Contains the ability to modify system service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"RFQ110623.pdf.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","id":"registry-13","level":"informative","mitre_attack_id":"T1082","name":"Reads the windows installation date","origin":"Registry Access","relevance":3,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$51","id":"string-475","level":"informative","mitre_attack_id":"T1555","name":"Contains string like password/secret","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"32/72 Antivirus vendors marked spawned process \"Adobereaderxi.exe\" (PID: 8080) as malicious (classified as \"UDS:Backdoor.Remcos\" with 44% detection rate)\n 32/72 Antivirus vendors marked spawned process \"Adobereaderxi.exe\" (PID: 4928) as malicious (classified as \"UDS:Backdoor.Remcos\" with 44% detection rate)\n 32/72 Antivirus vendors marked spawned process \"Adobereaderxi.exe\" (PID: 6484) as malicious (classified as \"UDS:Backdoor.Remcos\" with 44% detection rate)\n 32/72 Antivirus vendors marked spawned process \"Adobereaderxi.exe\" (PID: 1052) as malicious (classified as \"UDS:Backdoor.Remcos\" with 44% detection rate)","id":"target-58","level":"malicious","mitre_attack_id":"T1204.002","name":"The analysis spawned a process that was identified as malicious","origin":"Monitored Target","relevance":10,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$52","id":"string-280","level":"informative","mitre_attack_id":"T1486","name":"Contains reference to cryptographic keys","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"System Security","description":"$53","id":"string-77","level":"informative","mitre_attack_id":"T1134","name":"Contains ability to modify access token privileges (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetStartupInfoA@KERNEL32.dll at 11154-2639-0045AE82\n GetStartupInfoW@KERNEL32.dll at 11154-1-00408216","id":"stream-133","level":"suspicious","mitre_attack_id":"T1543","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"RFQ110623.pdf .exe\")","id":"string-164","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve the fully qualified path of module (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$54","id":"string-226","level":"informative","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"\"5.253.18.198:2407\"\n \"178.237.33.50:80\"","id":"network-1","level":"informative","mitre_attack_id":"T1071","name":"Contacts server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$55","id":"registry-37","level":"malicious","mitre_attack_id":"T1114","name":"Tries to steal Mail credentials from registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0\" (Indicator: \"select * from \"; Source: \"00000000-00008080.00000002.71107.06400000.00000040.mdmp\")\n Found string \"SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';\" (Indicator: \"select * from \"; Source: \"00000000-00008080.00000002.71107.06400000.00000040.mdmp\")","id":"string-433","level":"informative","mitre_attack_id":"T1047","name":"Contains ability to execute a WMI query","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"CredEnumerateA\" (Indicator: \"CredEnumerate\"; Source: \"00000000-00006484.00000000.67864.00400000.00000040.mdmp\")\n Found reference to API \"CredEnumerateW\" (Indicator: \"CredEnumerate\"; Source: \"00000000-00006484.00000000.67864.00400000.00000040.mdmp\")\n Found reference to API \"CredEnumerateA\" (Indicator: \"CredEnumerate\"; Source: \"00000000-00008080.00000002.71107.06480000.00000040.mdmp\")\n Found reference to API \"CredEnumerateW\" (Indicator: \"CredEnumerate\"; Source: \"00000000-00008080.00000002.71107.06480000.00000040.mdmp, 00000000-00008080.00000002.71107.064E0000.00000040.mdmp\")","id":"string-81","level":"informative","mitre_attack_id":"T1555.004","name":"Contains ability to to enumerates the credentials (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$56","id":"string-64","level":"suspicious","mitre_attack_id":"T1106","name":"Input file contains API references not part of its Import Address Table (IAT)","origin":"File/Memory","relevance":10,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"}]},{"category":"General","description":"$57","id":"string-550","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to find and load resources of specific modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"\"Local\\SM0:7804:168:WilStaging_02\"\n \"SM0:7804:168:WilStaging_02\"\n \"Local\\SessionImmersiveColorMutex\"\n \"SM0:7804:64:WilError_01\"\n \"Local\\SM0:7804:64:WilError_01\"\n \"Rmc-74HSI3\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"","id":"mutant-0","level":"informative","name":"Creates mutants","origin":"Created Mutant","relevance":3,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"Observed system executable string:\"%WINDIR%\\system32\\shell32.dll\" [Source: 00000000-00004928-00000C25-54616846]\n Observed system executable string:\"%WINDIR%\\system32\\psapi.dll\" [Source: 00000000-00004928-00000C25-54797777]\n Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00004928-00000C25-54965998]\n Observed system executable string:\"%WINDIR%\\system32\\pstorec.dll\" [Source: 00000000-00004928-00000C25-55257071]\n Observed system executable string:\"%WINDIR%\\system32\\vaultcli.dll\" [Source: 00000000-00004928-00000C25-55383310]\n Observed system executable string:\"%WINDIR%\\system32\\crypt32.dll\" [Source: 00000000-00004928-00000C25-55558795]","id":"string-625","level":"informative","mitre_attack_id":"T1083","name":"References Windows filepaths for DLLs (possible dropped files)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$58","id":"registry-0","level":"suspicious","mitre_attack_id":"T1547.001","name":"Modifies auto-execute functionality by setting/creating a value in the registry","origin":"Registry Access","relevance":8,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Network Related","description":"\"geoplugin.net\"","id":"network-24","level":"malicious","mitre_attack_id":"T1016","name":"Tries to identify its external IP address","origin":"Network Traffic","relevance":6,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"\"RFQ110623.pdf .exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","id":"static-153","level":"informative","name":"Uses 32 bit executable PE","origin":"Static Parser","sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"\"RFQ110623.pdf.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"RFQ110623.pdf.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]","id":"api-22","level":"informative","mitre_attack_id":"T1574.002","name":"Fails to load modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")","id":"string-544","level":"informative","mitre_attack_id":"T1569.002","name":"Contains ability to open a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"taskhostex.exe\" (Indicator: \"taskhostex.exe\")","id":"string-65","level":"informative","name":"Possibly uses a Windows Server utility","origin":"File/Memory","relevance":10,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"External Systems","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","id":"avtest-8","level":"malicious","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","origin":"External System","relevance":10,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathNamesForVolumeName\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathNamesForVolumeName\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")","id":"string-162","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve volume information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")","id":"string-209","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to start a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"External Systems","description":"Detected alert \"ET JA3 Hash - Remcos 3.x TLS Connection\" (SID: 2036594, Rev: 1, Severity: 1) categorized as \"Malware Command and Control Activity Detected\"","id":"suricata-2","level":"malicious","name":"Detected Suricata Alert","origin":"Suricata Alerts","relevance":10,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"$59","id":"api-175","level":"informative","mitre_attack_id":"T1129","name":"Calls an API typically used to load libraries","origin":"API Call","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"Virtual size of \".data\" is \"0x38928c\" greater than 0x100000","id":"static-124","level":"informative","name":"PE file has a big virtual size section","origin":"Static Parser","relevance":3,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"RFQ110623.pdf .exe\")","id":"string-365","level":"informative","mitre_attack_id":"T1029","name":"Contains ability to perform scheduled transfer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp, 00000000-00008080.00000002.71107.064E0000.00000040.mdmp\")\n Found reference to API \"SetThreadToken\" (Indicator: \"SetThreadToken\"; Source: \"00000000-00008080.00000002.71107.064E0000.00000040.mdmp\")","id":"string-306","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to impersonate access tokens (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"$5a","id":"string-191","level":"informative","mitre_attack_id":"T1007","name":"Contains the ability to enumerate service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"RFQ110623.pdf.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"Adobereaderxi.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","id":"api-108","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve information about the current system","origin":"API Call","relevance":3,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")","id":"string-88","level":"informative","mitre_attack_id":"T1056.001","name":"Contains ability to retrieve information about pressed keystrokes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"System Security","description":"$5b","id":"registry-173","level":"informative","mitre_attack_id":"T1007","name":"Queries services related registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"$5c","id":"api-176","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to retrieve function addresses","origin":"API Call","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"RFQ110623.pdf .exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"RFQ110623.pdf .exe\")","id":"string-427","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"RFQ110623.pdf .exe\")","id":"string-143","level":"informative","mitre_attack_id":"T1614.001","name":"Contains ability to retrieve system language (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; File: \"RFQ110623.pdf .exe\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"RFQ110623.pdf .exe\")","id":"string-308","level":"informative","mitre_attack_id":"T1070.004","name":"Contains ability to delete files/directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"Adobereaderxi.exe\" called \"GetUserNameW\" (UID: 00000000-00008080)\n \"Adobereaderxi.exe\" called \"GetUserNameA\" (UID: 00000000-00006484)\n \"Adobereaderxi.exe\" called \"GetUserNameA\" (UID: 00000000-00001052)","id":"api-135","level":"informative","mitre_attack_id":"T1033","name":"Calls an API typically used to retrieve user name","origin":"API Call","relevance":2,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"System Destruction","description":"\"Adobereaderxi.exe\" opened \"C:\\RFQ110623.pdf.exe\" with delete access\n \"Adobereaderxi.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\plnqucnaguxtaiujxgwbmhcvheelwhdd\" with delete access\n \"Adobereaderxi.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\updnsrjfeencnoktwtogyhnwp\" with delete access","id":"api-25","level":"suspicious","mitre_attack_id":"T1070.004","name":"Opens file with deletion access rights","origin":"API Call","relevance":7,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"RFQ110623.pdf.exe\" wrote 4 bytes to a remote process \"C:\\ProgramData\\AdobereaderXI\\Adobereaderxi.exe\" (Handle: 1664)\n \"Adobereaderxi.exe\" wrote 4 bytes to a remote process \"C:\\ProgramData\\AdobereaderXI\\Adobereaderxi.exe\" (Handle: 1112)\n \"Adobereaderxi.exe\" wrote 4 bytes to a remote process \"C:\\ProgramData\\AdobereaderXI\\Adobereaderxi.exe\" (Handle: 1292)","id":"api-0","level":"malicious","mitre_attack_id":"T1055","name":"Writes data to a remote process","origin":"API Call","relevance":6,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$5d","id":"api-96","level":"malicious","mitre_attack_id":"T1005","name":"Tries to steal browser sensitive information (file access)","origin":"API Call","relevance":10,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"RFQ110623.pdf .exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"RFQ110623.pdf .exe\")","id":"string-310","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to load modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"RFQ110623.pdf.exe\" queries basic process information of the \"C:\\RFQ110623.pdf.exe\" (UID: 7804)\n \"Adobereaderxi.exe\" queries basic process information of the \"C:\\ProgramData\\AdobereaderXI\\Adobereaderxi.exe\" (UID: 8080)","id":"api-235","level":"informative","mitre_attack_id":"T1057","name":"Queries basic information of the specified process","origin":"API Call","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Network Related","description":"$5e","id":"string-601","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to communicate with network (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"\"RFQ110623.pdf.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75640000","id":"module-10","level":"informative","mitre_attack_id":"T1129","name":"Loads the RPC (Remote Procedure Call) module DLL","origin":"Loaded Module","sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"RFQ110623.pdf.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003672)","id":"api-124","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get product type","origin":"API Call","relevance":3,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")","id":"string-410","level":"informative","mitre_attack_id":"T1547.001","name":"References user shell folders registry key string","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")","id":"string-423","level":"informative","mitre_attack_id":"T1074.001","name":"Contains ability to create directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp, 00000000-00008080.00000002.71107.06400000.00000040.mdmp\")","id":"string-345","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to disable/close registry key (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"RFQ110623.pdf.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"Adobereaderxi.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","id":"api-264","level":"informative","mitre_attack_id":"T1055.003","name":"Creates a thread in a self process","origin":"API Call","relevance":3,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"RFQ110623.pdf .exe\")","id":"string-315","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create/open files (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"RFQ110623.pdf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Adobereaderxi.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","id":"registry-35","level":"informative","mitre_attack_id":"T1082","name":"Reads the active computer name","origin":"Registry Access","relevance":5,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"RFQ110623.pdf.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"Adobereaderxi.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","id":"registry-1","level":"informative","mitre_attack_id":"T1082","name":"Reads the cryptographic machine GUID","origin":"Registry Access","relevance":5,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")","id":"string-210","level":"informative","mitre_attack_id":"T1559","name":"Contains ability to create/connect to a named pipe (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Network Related","description":"Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00008080.00000001.69190.033C5000.00000004.mdmp, 00000000-00008080.00000002.71107.033C5000.00000004.mdmp\")","id":"string-457","level":"informative","mitre_attack_id":"T1071.001","name":"Found string related to HTTP headers","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Network Related","description":"GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com\n\n GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=sports HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com","id":"network-72","level":"informative","mitre_attack_id":"T1071.001","name":"GETs files from a webserver (HTTPS)","origin":"Network Traffic","relevance":3,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for AES encryption matched on process \"00000000-00008080\"\n YARA signature for AES encryption matched on process \"00000000-00007804\"","id":"yara-103","level":"informative","mitre_attack_id":"T1027","name":"YARA signature match - AES Encryption","origin":"YARA Signature","relevance":5,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"System Security","description":"\"Adobereaderxi.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001052)","id":"api-111","level":"informative","mitre_attack_id":"T1134","name":"Calls an API typically used to enable or disable privileges in the specified access token","origin":"API Call","relevance":3,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"RFQ110623.pdf .exe\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"RFQ110623.pdf .exe\")","id":"string-83","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerate files on disk (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"\"RFQ110623.pdf .exe\" file has an entrypoint instructions - \"call\t0x40cec6,jmp\t0x4080a9,push\tdword ptr [0x461eec],call\tdword ptr [0x401124],test\teax, eax,je\t0x408232,call\teax,push\t0x19,call\t0x40c585,push\t1,push\t0,call\t0x40a15c,add\tesp, 0xc,jmp\t0x40a129,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,mov\tecx, dword ptr [esp + 4],test\tecx, 3,je\t0x408280,mov\tal, byte ptr [ecx],add\tecx, 1,test\tal, al,je\t0x4082b3,test\tecx, 3,jne\t0x40825c,add\teax, 0,lea\tesp, [esp],\"","id":"static-96","level":"informative","name":"PE file entrypoint instructions","origin":"Static Parser","sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$5f","id":"registry-177","level":"informative","mitre_attack_id":"T1012","name":"Opens registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","id":"summary-28","level":"informative","mitre_attack_id":"T1027","name":"Shows ability to obfuscate file or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"$60","id":"target-103","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes that are not known child processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Network Related","description":"$61","id":"memorydump-2","level":"informative","mitre_attack_id":"T1071","name":"Found potential URLs in memory dumps","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")","id":"string-403","level":"informative","mitre_attack_id":"T1056","name":"Contains ability to register/read input devices (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"System Security","description":"\"RFQ110623.pdf.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"Adobereaderxi.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","id":"registry-27","level":"suspicious","mitre_attack_id":"T1112","name":"Modifies proxy settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"\"RFQ110623.pdf.exe\" called \"CreateProcessW\" with parameter \"\"%ALLUSERSPROFILE%\\AdobereaderXI\\Adobereaderxi.exe\"\" - (UID: 00000000-00007804)\n \"Adobereaderxi.exe\" called \"CreateProcessW\" with parameter \"%ALLUSERSPROFILE%\\AdobereaderXI\\Adobereaderxi.exe /stext \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\updnsrjfeencnoktwtogyhnwp\"\" - (UID: 00000000-00008080)\n \"Adobereaderxi.exe\" called \"CreateProcessW\" with parameter \"%ALLUSERSPROFILE%\\AdobereaderXI\\Adobereaderxi.exe /stext \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\erixtjchsmfgxuyxfwbhjuifypnc\"\" - (UID: 00000000-00008080)\n \"Adobereaderxi.exe\" called \"CreateProcessW\" with parameter \"%ALLUSERSPROFILE%\\AdobereaderXI\\Adobereaderxi.exe /stext \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\plnqucnaguxtaiujxgwbmhcvheelwhdd\"\" - (UID: 00000000-00008080)","id":"api-128","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to create a process","origin":"API Call","relevance":5,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"RFQ110623.pdf.exe\" touched file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"RFQ110623.pdf.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"Adobereaderxi.exe\" touched file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"Adobereaderxi.exe\" touched file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"Adobereaderxi.exe\" touched file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"Adobereaderxi.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\4EKOOWYY\\json[1].json\"\n \"Adobereaderxi.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\"\n \"Adobereaderxi.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"\n \"Adobereaderxi.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"","id":"api-55","level":"informative","mitre_attack_id":"T1083","name":"Touches files in the Windows directory","origin":"API Call","relevance":7,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"Adobereaderxi.exe\" (Path: \"HKCU\\SOFTWARE\\GOOGLE\\GOOGLE TALK\\ACCOUNTS\")\n \"Adobereaderxi.exe\" (Path: \"HKCU\\SOFTWARE\\YAHOO\\PAGER\")\n \"Adobereaderxi.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\IDENTITYCRL\\DYNAMIC SALT\")\n \"Adobereaderxi.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS LIVE MAIL\")\n \"Adobereaderxi.exe\" (Path: \"HKCU\\SOFTWARE\\AMERICA ONLINE\\AIM6\\PASSWORDS\")\n \"Adobereaderxi.exe\" (Path: \"HKCU\\SOFTWARE\\PALTALK\")","id":"registry-34","level":"malicious","mitre_attack_id":"T1552.002","name":"Touched instant messenger related registry keys","origin":"Registry Access","relevance":5,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"LaES.\" (Indicator: \"aes\"; File: \"RFQ110623.pdf .exe\")","id":"string-57","level":"informative","mitre_attack_id":"T1027","name":"Contains CRYPTO related strings","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"$62","id":"target-25","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$63","id":"api-243","level":"informative","mitre_attack_id":"T1083","name":"Reads files","origin":"API Call","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$64","id":"string-171","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the OS information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"\"RFQ110623.pdf.exe\" called \"CreateProcessW\" with parameter \"\"%ALLUSERSPROFILE%\\AdobereaderXI\\Adobereaderxi.exe\"\" - (UID: 00000000-00007804)\n \"Adobereaderxi.exe\" called \"CreateProcessW\" with parameter \"%ALLUSERSPROFILE%\\AdobereaderXI\\Adobereaderxi.exe /stext \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\updnsrjfeencnoktwtogyhnwp\"\" - (UID: 00000000-00008080)\n \"Adobereaderxi.exe\" called \"CreateProcessW\" with parameter \"%ALLUSERSPROFILE%\\AdobereaderXI\\Adobereaderxi.exe /stext \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\erixtjchsmfgxuyxfwbhjuifypnc\"\" - (UID: 00000000-00008080)\n \"Adobereaderxi.exe\" called \"CreateProcessW\" with parameter \"%ALLUSERSPROFILE%\\AdobereaderXI\\Adobereaderxi.exe /stext \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\plnqucnaguxtaiujxgwbmhcvheelwhdd\"\" - (UID: 00000000-00008080)","id":"api-129","level":"malicious","mitre_attack_id":"T1055","name":"Creates a process in suspended mode (likely for process injection)","origin":"API Call","relevance":10,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$65","id":"string-193","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to query volume/memory size (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"MoveFileWithProgressA\" (Indicator: \"MoveFile\"; File: \"RFQ110623.pdf .exe\")\n Found reference to API \"MoveFileWithProgressW\" (Indicator: \"MoveFile\"; File: \"RFQ110623.pdf .exe\")","id":"string-322","level":"informative","mitre_attack_id":"T1570","name":"Contains ability to move file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"RFQ110623.pdf .exe\")","id":"string-206","level":"informative","mitre_attack_id":"T1059.003","name":"Contains ability to retrieve the command-line string for the current process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"RFQ110623.pdf .exe\")","id":"string-249","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to retrieve file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")","id":"string-227","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve information about MS-DOS device names (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")","id":"string-189","level":"informative","mitre_attack_id":"T1529","name":"Contains ability to reboot/shutdown the operating system (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$66","id":"string-78","level":"informative","mitre_attack_id":"T1113","name":"Contains ability to capture screen (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"IsUserAnAdmin\" (Indicator: \"IsUserAnAdmin\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"IsUserAnAdmin\" (Indicator: \"IsUserAnAdmin\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")","id":"string-217","level":"informative","mitre_attack_id":"T1033","name":"Contains ability to retrieve user privileges (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"RFQ110623.pdf .exe\")","id":"string-205","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"RFQ110623.pdf.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"RFQ110623.pdf.exe\" trying to access non-existent file \"C:\\Windows\\system32\\api-ms-win-core-fibers-l1-1-1.DLL\"\n \"RFQ110623.pdf.exe\" trying to access non-existent file \"C:\\Windows\\system32\\api-ms-win-core-localization-l1-2-1.DLL\"\n \"RFQ110623.pdf.exe\" trying to access non-existent file \"C:\\msimg32.dll\"\n \"RFQ110623.pdf.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\FLTLIB.DLL\"\n \"RFQ110623.pdf.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\"\n \"RFQ110623.pdf.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\Windows\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\"\n \"RFQ110623.pdf.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\MSIMG32.DLL\"","id":"api-126","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"System Security","description":"$67","id":"string-239","level":"informative","mitre_attack_id":"T1548.002","name":"Contains ability to bypass UAC using COM object (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"\"RFQ110623.pdf.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"RFQ110623.pdf.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"RFQ110623.pdf.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"RFQ110623.pdf.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"RFQ110623.pdf.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"RFQ110623.pdf.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"RFQ110623.pdf.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"\n \"RFQ110623.pdf.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"RFQ110623.pdf.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini\"\n \"Adobereaderxi.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini\"","id":"api-6","level":"suspicious","mitre_attack_id":"T1083","name":"Reads configuration files (.ini files)","origin":"API Call","relevance":4,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"RFQ110623.pdf .exe\")","id":"string-312","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve path in which Windows is installed (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Network Related","description":"\"76.47.92.68\"","id":"string-14","level":"informative","mitre_attack_id":"T1071","name":"Found potential IP address in binary/memory","origin":"File/Memory","sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Sample file \"sample.bin\" has high entropy 7.398836074742079","id":"binary-71","level":"informative","mitre_attack_id":"T1027","name":"Sample file has high entropy (likely encrypted/compressed content)","origin":"Binary File","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"RFQ110623.pdf.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007804)\n \"Adobereaderxi.exe\" called \"GetForegroundWindow\" (UID: 00000000-00008080)","id":"api-142","level":"informative","mitre_attack_id":"T1010","name":"Calls an API possibly used to retrieve a handle to the foreground window","origin":"API Call","relevance":3,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"PathFileExistsA\" (Indicator: \"PathFileExist\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")\n Found reference to API \"PathFileExistsA\" (Indicator: \"PathFileExist\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")","id":"string-140","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to verify if file exist on disk (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"\"GET /json.gp HTTP/1.1\nHost: geoplugin.net\nCache-Control: no-cache\" Response ==> HTTP/1.1 200 OK\ndate: Mon\n 06 Nov 2023 16:39:22 GMT\nserver: Apache/2.4.52 (Ubuntu)\ncontent-length: 970\ncontent-type: application/json; charset=utf-8\ncache-control: public\n max-age=300\naccess-control-allow-origin: * with response body ==>7B0A20202267656F706C7567696E5F72657175657374223A2236372E3231382E3131312E323032222C0A20202267656F706C7567696E5F737461747573223A32.......","id":"network-2","level":"informative","mitre_attack_id":"T1071.001","name":"GETs files from a webserver","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$68","id":"string-229","level":"informative","mitre_attack_id":"T1012","name":"Contains ability to query registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"32/72 Antivirus vendors marked dropped file \"Adobereaderxi.exe\" as malicious (classified as \"UDS:Backdoor.Remcos\" with 44% detection rate)","id":"binary-11","level":"malicious","mitre_attack_id":"T1204.002","name":"The analysis extracted a file that was identified as malicious","origin":"Binary File","relevance":10,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"External Systems","description":"32/72 Antivirus vendors marked sample as malicious (44% detection rate)","id":"avtest-3","level":"malicious","name":"Sample was identified as malicious by a large number of Antivirus engines","origin":"External System","relevance":10,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"RFQ110623.pdf.exe\"\n Report process \"WerFault.exe\" was created by \"Adobereaderxi.exe\"","id":"target-2","level":"informative","name":"An application crash occurred","origin":"Monitored Target","sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"\"RFQ110623.pdf .exe\" has an executable section named \".text\"","id":"static-80","level":"informative","name":"PE file contains executable sections","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"\"geoplugin.net\"","id":"network-0","level":"informative","mitre_attack_id":"T1071","name":"Contacts domains","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Network Related","description":"$69","id":"string-273","level":"informative","mitre_attack_id":"T1049","name":"Contains ability to retrieve list of TCP/UDP endpoints (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"\"Adobereaderxi.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","id":"registry-9","level":"suspicious","mitre_attack_id":"T1012","name":"Checks warning level of secure to non-secure traffic redirection","origin":"Registry Access","relevance":7,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"RFQ110623.pdf .exe\")","id":"string-248","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine timezone (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"RFQ110623.pdf .exe\")","id":"string-247","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"System Security","description":"\"Adobereaderxi.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","id":"registry-67","level":"informative","mitre_attack_id":"T1543.003","name":"Creates or modifies windows services","origin":"Registry Access","relevance":10,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; File: \"RFQ110623.pdf .exe\")\n Found reference to API \"GetCurrentDirectoryA\" (Indicator: \"GetCurrentDirectory\"; File: \"RFQ110623.pdf .exe\")","id":"string-207","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve file and directory information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"EnumSystemLocalesA\" (Indicator: \"EnumSystemLocales\"; File: \"RFQ110623.pdf .exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"RFQ110623.pdf .exe\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"RFQ110623.pdf .exe\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"RFQ110623.pdf .exe\")","id":"string-201","level":"informative","mitre_attack_id":"T1614","name":"Contains ability to query system locale (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"$6a","id":"registry-72","level":"informative","mitre_attack_id":"T1546.015","name":"Overview of unique CLSIDs touched in registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"RFQ110623.pdf .exe\")\n Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"RFQ110623.pdf .exe\")","id":"string-167","level":"informative","mitre_attack_id":"T1543","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"RFQ110623.pdf.exe\" trying to access non-existent file \"C:\\RFQ110623.pdf.exe.Local\\\"\n \"RFQ110623.pdf.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume2\\RFQ110623.PDF.EXE.LOCAL\"","id":"api-161","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (non-executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")\n Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")","id":"string-240","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute an application (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"RFQ110623.pdf.exe\" writes file \"c:\\programdata\\adobereaderxi\\adobereaderxi.exe\"\n \"RFQ110623.pdf.exe\" writes file \"c:\\programdata\\adobereaderxi\\adobereaderxi.exe:zone.identifier\"\n \"RFQ110623.pdf.exe\" writes file \"\\device\\namedpipe\\srvsvc\"\n \"Adobereaderxi.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\4ekoowyy\\json[1].json\"\n \"Adobereaderxi.exe\" writes file \"%localappdata%\\microsoft\\windows\\inetcache\\ie\\4ekoowyy\\json[1].json\"\n \"Adobereaderxi.exe\" writes file \"%temp%\\updnsrjfeencnoktwtogyhnwp\"\n \"Adobereaderxi.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\updnsrjfeencnoktwtogyhnwp\"\n \"RFQ110623.pdf.exe\" writes file \"%allusersprofile%\\adobereaderxi\\adobereaderxi.exe\"","id":"api-242","level":"informative","name":"Writes files","origin":"API Call","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"Adobereaderxi.exe\" called \"CredEnumerateW\" with parameters {\"Flags\": \"0\"\n \"Count\": \"01000000\"\n \"Credential\": \"d0915a000100000044afef0090525a0034a4ef006d55440084afef00b8aeef00c8aeef0000000000000000000000000000000000\"}\n \"Adobereaderxi.exe\" called \"CredEnumerateW\" with parameters {\"Flags\": \"0\"\n \"Count\": \"01000000\"\n \"Credential\": \"pOd\"}\n \"Adobereaderxi.exe\" called \"CredEnumerateW\" with parameters {\"Filter\": \"WindowsLive:name=*\"\n \"Flags\": \"0\"\n \"Count\": \"00000000\"\n \"Credential\": \"00000000b4f13301000007770100000060330a77f03f097720310a7780310a77203f0977190002000200000002000080c4f13301\"}\n \"Adobereaderxi.exe\" called \"CredEnumerateW\" with parameters {\"Filter\": \"WindowsLive:name=*\"\n \"Flags\": \"0\"\n \"Count\": \"00000000\"\n \"Credential\": \"0000000000000000fe034100ccf7ef00cadc40009cf7ef00000000002c31810038f8ef0044864100000000000000000000000000\"}","id":"api-112","level":"malicious","mitre_attack_id":"T1555.004","name":"Calls an API typically used to enumerate the credentials from the user's credential set","origin":"API Call","relevance":10,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$6b","id":"stream-139","level":"informative","mitre_attack_id":"T1027.005","name":"Contains XOR operation loops [Stream disassembly]","origin":"Hybrid Analysis Technology","sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":".text with unusual entropies 7.78692441585","id":"static-6","level":"suspicious","mitre_attack_id":"T1027.002","name":"PE file has unusual entropy sections","origin":"Static Parser","relevance":3,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"RFQ110623.pdf .exe\")","id":"string-141","level":"informative","mitre_attack_id":"T1010","name":"Contains ability to retrieve open application windows (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"Adobereaderxi.exe\" called \"GetLocaleInfoA\" with parameter \"2048\" - (UID: 00000000-00008080)","id":"api-147","level":"informative","mitre_attack_id":"T1614","name":"Calls an API typically used to retrieve local language","origin":"API Call","relevance":3,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Network Related","description":"$6c","id":"string-56","level":"malicious","mitre_attack_id":"T1016","name":"Found a reference to an external IP address lookup service","origin":"File/Memory","relevance":6,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"RFQ110623.pdf.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"RFQ110623.pdf.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"0\"}","id":"api-103","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used for taking snapshot of the specified processes","origin":"API Call","relevance":3,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"$6d","id":"string-307","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to create/load registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"RFQ110623.pdf .exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"RFQ110623.pdf .exe\")","id":"string-318","level":"informative","mitre_attack_id":"T1055.001","name":"Contains ability to load/free library (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory","id":"summary-31","level":"informative","mitre_attack_id":"T1573.001","name":"Shows ability to use encryption for command and control traffic","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"External Systems","description":"32/72 Antivirus vendors marked sample as malicious (44% detection rate)","id":"avtest-0","level":"suspicious","name":"Sample was identified as malicious by at least one Antivirus engine","origin":"External System","sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"Found string \"Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.\" (Indicator: \"Copyright (c) 1992-2004 by P.J. Plauger\n licensed by Dinkumware\n Ltd. ALL RIGHTS RESERVED.\"; File: \"RFQ110623.pdf .exe\")","id":"string-462","level":"informative","mitre_attack_id":"T1027","name":"Contains reference to licensed c/c++ library","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"RFQ110623.pdf.exe\" called \"IsWow64Process\" with parameter \"3672\" - (UID: 00000000-00003672)","id":"api-146","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used to determine if process is running under WOW64","origin":"API Call","relevance":3,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")","id":"string-304","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to modify registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")","id":"string-80","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to determine disk drive type (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"Adobereaderxi.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%ALLUSERSPROFILE%\\AdobereaderXI\\Adobereaderxi.exe]- [targetUID: 00000000-00007804]","id":"binary-1","level":"suspicious","mitre_attack_id":"T1105","name":"Drops executable files","origin":"Binary File","relevance":10,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"Adobereaderxi.exe\" called \"GetWindowTextW\" with parameter \"Program Manager\" - (UID: 00000000-00008080)","id":"api-151","level":"informative","mitre_attack_id":"T1010","name":"Calls an API typically used to get active windows title","origin":"API Call","relevance":3,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"\"RFQ110623.pdf.exe\" called \"CopyFileW\" to copy C:\\RFQ110623.pdf.exe to new location %ALLUSERSPROFILE%\\AdobereaderXI\\Adobereaderxi.exe (UID: 00000000-00007804)","id":"api-123","level":"informative","mitre_attack_id":"T1005","name":"Calls an API typically used to copy file from one location to another","origin":"API Call","relevance":3,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Network Related","description":"$6e","id":"string-241","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to download a file from a URL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$6f","id":"api-102","level":"informative","mitre_attack_id":"T1083","name":"Calls an API's typically used for searching a directory for a files","origin":"API Call","relevance":5,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")","id":"string-242","level":"informative","mitre_attack_id":"T1489","name":"Contains ability to close a handle to a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"Adobereaderxi.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"16845124\"\n \"cx\": \"32\"\n \"cy\": \"32\"}","id":"api-105","level":"informative","mitre_attack_id":"T1113","name":"Calls an API possibly used to take screenshots","origin":"API Call","relevance":3,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"Software\\Microsoft\\Office\\Outlook\\OMI Account Manager\\Accounts\" in Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp\n \"Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\" in Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp\n \"Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\" in Source: 00000000-00006484.00000000.67864.00400000.00000040.mdmp\n \"Software\\Microsoft\\Office\\Outlook\\OMI Account Manager\\Accounts\" in Source: 00000000-00008080.00000002.71107.06480000.00000040.mdmp\n \"Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\" in Source: 00000000-00008080.00000002.71107.06480000.00000040.mdmp\n \"Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\" in Source: 00000000-00008080.00000002.71107.06480000.00000040.mdmp","id":"string-129","level":"informative","mitre_attack_id":"T1114","name":"Found mail information locations related strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00006484.00000000.67864.00400000.00000040.mdmp, 00000000-00006484.00000000.67864.00640000.00000004.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp, 00000000-00008080.00000002.71107.064E0000.00000040.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00008080.00000002.71107.06480000.00000040.mdmp\")","id":"string-212","level":"informative","mitre_attack_id":"T1140","name":"Contains ability to perform decryption (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"\"RFQ110623.pdf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"RFQ110623.pdf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"RFQ110623.pdf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"RFQ110623.pdf.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\USER PROFILE\"; Key: \"LANGUAGES\")\n \"RFQ110623.pdf.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\GEO\"; Key: \"NATION\")\n \"RFQ110623.pdf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"Adobereaderxi.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"Adobereaderxi.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Adobereaderxi.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","id":"registry-25","level":"informative","mitre_attack_id":"T1082","name":"Reads information about supported languages","origin":"Registry Access","relevance":3,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"RFQ110623.pdf .exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"RFQ110623.pdf .exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"RFQ110623.pdf .exe\")","id":"string-183","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to check debugger is running (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"$70","id":"string-16","level":"informative","mitre_attack_id":"T1213","name":"Contains SQL queries","origin":"File/Memory","relevance":2,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"File type \"PE32 executable (GUI) Intel 80386 for MS Windows\" was dropped at \"%ALLUSERSPROFILE%\\AdobereaderXI\\Adobereaderxi.exe\"","id":"binary-27","level":"malicious","mitre_attack_id":"T1036","name":"Drops executable files to the application program directory (%ProgramData%)","origin":"Binary File","relevance":7,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$71","id":"api-263","level":"informative","mitre_attack_id":"T1083","name":"Touches files","origin":"API Call","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"RFQ110623.pdf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"RFQ110623.pdf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"Adobereaderxi.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","id":"registry-26","level":"informative","mitre_attack_id":"T1614.001","name":"Reads the windows installation language","origin":"Registry Access","relevance":2,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: RFQ110623.pdf .exe)","id":"static-79","level":"informative","mitre_attack_id":"T1027.007","name":"Contains ability to dynamically determine API calls","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; File: \"RFQ110623.pdf .exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"RFQ110623.pdf .exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"RFQ110623.pdf .exe\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"RFQ110623.pdf .exe\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"RFQ110623.pdf .exe\")","id":"string-85","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to enumerate process and/or its information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"\"RFQ110623.pdf .exe\" has an writable section named \".data\"","id":"static-95","level":"informative","name":"PE file contains writable sections","origin":"Static Parser","sources":[{"report_id":"6549158a52d9d77db20b623e","report_type":"sandbox"},{"report_id":"65491d3dd4920e1cef07d1c8","report_type":"sandbox"},{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"RFQ110623.pdf.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ADOBEREADERXI.EXE\")\n \"Adobereaderxi.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\TRILLIAN\")","id":"registry-55","level":"informative","mitre_attack_id":"T1518","name":"Reads the registry for installed applications","origin":"Registry Access","relevance":10,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"$72","id":"string-272","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"System Security","description":"$73","id":"string-91","level":"informative","mitre_attack_id":"T1056.001","name":"Contains ability to hook/unhook windows functions (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")","id":"string-204","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create a new process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to \"SMTPServer\" (Indicator: \"SmtpServer\"; Source: \"00000000-00006484.00000000.67864.00400000.00000040.mdmp\")\n Found reference to \"SMTPServer\" (Indicator: \"SmtpServer\"; Source: \"00000000-00008080.00000002.71107.06480000.00000040.mdmp\")","id":"string-618","level":"informative","mitre_attack_id":"T1505.002","name":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Contains base64 string in header \"netCache\" in header \"GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache\"","id":"network-60","level":"informative","mitre_attack_id":"T1132","name":"HTTP requests contain Base64 strings","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007804.00000000.66766.00400000.00000040.mdmp, 00000000-00007804.00000000.66766.05000000.00000040.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00008080.00000000.67269.00400000.00000040.mdmp, 00000000-00008080.00000001.69190.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.00400000.00000040.mdmp, 00000000-00008080.00000002.71107.04E80000.00000040.mdmp\")","id":"string-122","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"STOREP~1.WINStore.Purchase.Component.winmdLLS\" (Source: 00000000-00006484.00000000.67864.00640000.00000004.mdmp, Indicator: \"chase.com\")","id":"string-23","level":"informative","name":"Detected known bank URL artifact","origin":"File/Memory","relevance":2,"sources":[{"report_id":"654915673d2a32ad5e0e07f0","report_type":"sandbox"}]}],"stats":{"attributions":{"campaigns_count":0,"cves_count":0,"malware_families_count":1,"threat_actors_count":0,"threat_types_count":0},"av":{"malicious_count":4,"suspicious_count":0,"total_engines":27},"mitre_attacks":{"total":82},"rule_matches":{"sigma_count":0,"suricata_count":0,"yara_count":0},"sandbox_signatures":{"informative_count":191,"malicious_count":18,"suspicious_count":16,"total":225}},"summary":{"score":100,"tags":["windows-server-utility"],"verdict":"malicious"}},"metadata":{"file_info":{"file_name":"RFQ110623.pdf .exe","file_size":464896,"file_type":["peexe","executable"],"file_type_id":"exe"},"hashes":{"imphash":"b12cc29254d07cadbb008c92468c8361","md5":"291135e84ac4c935c00a15ab1ce04353","sha1":"ecd8a87237094ffcf9e1fc0ce9fe3fdc2be91c87","sha256":"0e8dfb4c4b15bffe7df07f0a9240c2287e23c149b465991da96b73eff7b8f903","sha512":"cadfd621fff9d8ea734b5e8df84fb99f051f658597c2e7308e3fb055ea3120276b3af407edc7613fe8b1376a5db832a8309ccf16a71125da9d7734e9eb73f89a","ssdeep":"6144:Xsz6W1aqPuk+dcp707D+Rx+ATKb8GrV7yvgbFSfhTSPeesvs76Kio:8D1aqGkqcp702lGrV7yIRShTSPcEx","ssdeep_chunks":["6144:Xsz6W1a","6144:sz6W1aq","6144:z6W1aqP","6144:6W1aqPu","6144:W1aqPuk","6144:1aqPuk+","6144:aqPuk+d","6144:qPuk+dc","6144:Puk+dcp","6144:uk+dcp7","6144:k+dcp70","6144:+dcp707","6144:dcp707D","6144:cp707D+","6144:p707D+R","6144:707D+Rx","6144:07D+Rx+","6144:7D+Rx+A","6144:D+Rx+AT","6144:+Rx+ATK","6144:Rx+ATKb","6144:x+ATKb8","6144:+ATKb8G","6144:ATKb8Gr","6144:TKb8GrV","6144:Kb8GrV7","6144:b8GrV7y","6144:8GrV7yv","6144:GrV7yvg","6144:rV7yvgb","6144:V7yvgbF","6144:7yvgbFS","6144:yvgbFSf","6144:vgbFSfh","6144:gbFSfhT","6144:bFSfhTS","6144:FSfhTSP","6144:SfhTSPe","6144:fhTSPee","6144:hTSPees","6144:TSPeesv","6144:SPeesvs","6144:Peesvs7","6144:eesvs76","6144:esvs76K","6144:svs76Ki","6144:vs76Kio","12288:Xsz6W1a","12288:sz6W1aq","12288:z6W1aqP","12288:6W1aqPu","12288:W1aqPuk","12288:1aqPuk+","12288:aqPuk+d","12288:qPuk+dc","12288:Puk+dcp","12288:uk+dcp7","12288:k+dcp70","12288:+dcp707","12288:dcp707D","12288:cp707D+","12288:p707D+R","12288:707D+Rx","12288:07D+Rx+","12288:7D+Rx+A","12288:D+Rx+AT","12288:+Rx+ATK","12288:Rx+ATKb","12288:x+ATKb8","12288:+ATKb8G","12288:ATKb8Gr","12288:TKb8GrV","12288:Kb8GrV7","12288:b8GrV7y","12288:8GrV7yv","12288:GrV7yvg","12288:rV7yvgb","12288:V7yvgbF","12288:7yvgbFS","12288:yvgbFSf","12288:vgbFSfh","12288:gbFSfhT","12288:bFSfhTS","12288:FSfhTSP","12288:SfhTSPe","12288:fhTSPee","12288:hTSPees","12288:TSPeesv","12288:SPeesvs","12288:Peesvs7","12288:eesvs76","12288:esvs76K","12288:svs76Ki","12288:vs76Kio","6144:8D1aqGk","6144:D1aqGkq","6144:1aqGkqc","6144:aqGkqcp","6144:qGkqcp7","6144:Gkqcp70","6144:kqcp702","6144:qcp702l","6144:cp702lG","6144:p702lGr","6144:702lGrV","6144:02lGrV7","6144:2lGrV7y","6144:lGrV7yI","6144:GrV7yIR","6144:rV7yIRS","6144:V7yIRSh","6144:7yIRShT","6144:yIRShTS","6144:IRShTSP","6144:RShTSPc","6144:ShTSPcE","6144:hTSPcEx"]},"submissions":{"first_seen":1699288423000,"last_multi_scan":1699290429000,"last_seen":1699290429000}},"overall_status":"SUCCESS","report_ids":{"sandbox_job_ids":["65491d3dd4920e1cef07d1c8","6549158a52d9d77db20b623e","654915673d2a32ad5e0e07f0"]},"schema_version":"1.0.9","sha256":"0e8dfb4c4b15bffe7df07f0a9240c2287e23c149b465991da96b73eff7b8f903","threat_score":100,"unified_at":"2026-09-23T07:59:21.994Z","unified_at_epoch_ms":1790150361994,"verdict":"malicious"}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Malware Sample 0e8dfb4c4b15… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0e8dfb4c4b15…. Malware family: Malware. Threat score 100/100. 4/27 AV engines flagged this file. 18 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0e8dfb4c4b15bffe7df07f0a9240c2287e23c149b465991da96b73eff7b8f903"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware Sample 0e8dfb4c4b15… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0e8dfb4c4b15…. Malware family: Malware. Threat score 100/100. 4/27 AV engines flagged this file. 18 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0e8dfb4c4b15bffe7df07f0a9240c2287e23c149b465991da96b73eff7b8f903"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware Sample 0e8dfb4c4b15… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0e8dfb4c4b15…. Malware family: Malware. Threat score 100/100. 4/27 AV engines flagged this file. 18 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L74","11",{}]]