26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TrojanDldr.OffLoader.gen Sample 2336ef277727… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2336ef277727…. Malware family: TrojanDldr.OffLoader.gen. Threat score 100/100. 2/26 AV engines flagged this file. 5 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2336ef2777274c5ebffa98e86a6085d8de354267fe85f9ee9ea74fd92c051724","keywords":["Malicious","TrojanDldr.OffLoader.gen","malware analysis","sandbox report","threat intelligence","2336ef2777274c5ebffa98e86a6085d8de354267fe85f9ee9ea74fd92c051724"],"about":{"@type":"SoftwareApplication","name":"Certificado_20392302026.exe","applicationCategory":["compressed","innosetup"],"identifier":"2336ef2777274c5ebffa98e86a6085d8de354267fe85f9ee9ea74fd92c051724","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"TrojanDldr.OffLoader.gen","antivirusDetections":{"malicious":2,"total":26},"behavioralIndicators":{"malicious":5,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4ad,Found string - 'use strict';var path = require('path');var packageJsonSpec = require('../packageJson');describe('transports/file/packageJson', function () { describe('tryReadJsonAt', function () { it('should resolve data when child path specified', function () { var json = packageJsonSpec.tryReadJsonAt(__filename); expect(json.name).toBe('electron-log'); expect(json.version).toMatch(/\d+\.\d+\.\d+/); }); it('should resolve data when root specified', function () { var rootPath = path.join(__dirname, '../../../..'); var json = packageJsonSpec.tryReadJsonAt(rootPath); expect(json.name).toBe('electron-log'); expect(json.version).toMatch(/\d+\.\d+\.\d+/); }); it('should return null on fail', function () { var json = packageJsonSpec.tryReadJsonAt('/'); expect(json).toBe(null); }); });; Source: "packageJson.spec.js") Found string - \\.\DISPLAY1; Source: "00000000-00000372.00000000.292779.00544000.00000004.mdmp") Found string - \.\DISPLAY1; Source: "00000000-00000372.00000000.292779.00880000.00000004.mdmp, 00000000-00000372.00000001.294700.00880000.00000004.mdmp, 00000000-00000372.00000002.296621.00880000.00000004.mdmp")28:T9ec,"boosten.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{144C71F2-7F10-4AB2-BB07-C38F5B9AE05E}\INPROCSERVER32") "boosten.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{144C71F2-7F10-4AB2-BB07-C38F5B9AE05E}\INPROCSERVER32") "boosten.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{144C71F2-7F10-4AB2-BB07-C38F5B9AE05E}\INPROCHANDLER32") "boosten.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{144C71F2-7F10-4AB2-BB07-C38F5B9AE05E}\INPROCHANDLER32") "boosten.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{144C71F2-7F10-4AB2-BB07-C38F5B9AE05E}\INPROCHANDLER") "boosten.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{144C71F2-7F10-4AB2-BB07-C38F5B9AE05E}\INPROCHANDLER") "boosten.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{144C71F2-7F10-4AB2-BB07-C38F5B9AE05E}\LOCALSERVER32") "boosten.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{144C71F2-7F10-4AB2-BB07-C38F5B9AE05E}\LOCALSERVER32") "boosten.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{144C71F2-7F10-4AB2-BB07-C38F5B9AE05E}") "boosten.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{144C71F2-7F10-4AB2-BB07-C38F5B9AE05E}\LOCALSERVER") "boosten.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{144C71F2-7F10-4AB2-BB07-C38F5B9AE05E}\LOCALSERVER") "boosten.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{144C71F2-7F10-4AB2-BB07-C38F5B9AE05E}\ELEVATION") "boosten.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{144C71F2-7F10-4AB2-BB07-C38F5B9AE05E}\ELEVATION") "boosten.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{144C71F2-7F10-4AB2-BB07-C38F5B9AE05E}\TREATAS") "boosten.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{144C71F2-7F10-4AB2-BB07-C38F5B9AE05E}\TREATAS") "boosten.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\ACCESSIBILITY") "boosten.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\ACCESSIBILITY") "boosten.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "boosten.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "boosten.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "boosten.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS") "boosten.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS")29:Ta8f,"Certificado_20392302026.exe" queried SystemProcessInformation at 00000000-00002196-00000C15-3542627153 [PID: 2196] "Certificado_20392302026.exe" queried SystemProcessInformation at 00000000-00002196-00000C15-3542632815 [PID: 2196] "Certificado_20392302026.exe" queried SystemProcessInformation at 00000000-00002196-00000C15-3542938900 [PID: 2196] "Certificado_20392302026.exe" queried SystemProcessInformation at 00000000-00002196-00000C15-3542945333 [PID: 2196] "Certificado_20392302026.exe" queried SystemProcessInformation at 00000000-00002196-00000C15-3543139141 [PID: 2196] "Certificado_20392302026.exe" queried SystemProcessInformation at 00000000-00002196-00000C15-3543145720 [PID: 2196] "Certificado_20392302026.tmp" queried SystemProcessInformation at 00000000-00005564-00000C15-3544601371 [PID: 5564] "Certificado_20392302026.tmp" queried SystemProcessInformation at 00000000-00005564-00000C15-3544607392 [PID: 5564] "Certificado_20392302026.tmp" queried SystemProcessInformation at 00000000-00005564-00000C15-3545011326 [PID: 5564] "Certificado_20392302026.tmp" queried SystemProcessInformation at 00000000-00005564-00000C15-3545018906 [PID: 5564] "Certificado_20392302026.tmp" queried SystemProcessInformation at 00000000-00005564-00000C15-3545574236 [PID: 5564] "Certificado_20392302026.tmp" queried SystemProcessInformation at 00000000-00005564-00000C15-3545614016 [PID: 5564] "boosten.exe" queried SystemProcessInformation at 00000000-00000372-00000C15-3570317629 [PID: 372] "boosten.exe" queried SystemProcessInformation at 00000000-00000372-00000C15-3570325249 [PID: 372] "boosten.exe" queried SystemProcessInformation at 00000000-00000372-00000C15-3570718584 [PID: 372] "boosten.exe" queried SystemProcessInformation at 00000000-00000372-00000C15-3570725080 [PID: 372] "boosten.exe" queried SystemProcessInformation at 00000000-00000372-00000C15-3571344477 [PID: 372] "boosten.exe" queried SystemProcessInformation at 00000000-00000372-00000C15-3571351189 [PID: 372] "boosten.exe" queried SystemProcessInformation at 00000000-00000372-00000C15-3571673171 [PID: 372] "boosten.exe" queried SystemProcessInformation at 00000000-00000372-00000C15-3571679688 [PID: 372] "boosten.exe" queried SystemProcessInformation at 00000000-00000372-00000C15-3573448359 [PID: 372] "boosten.exe" queried SystemProcessInformation at 00000000-00000372-00000C15-3573454774 [PID: 372] "boosten.exe" queried SystemProcessInformation at 00000000-00000372-00000C15-3573993100 [PID: 372] "boosten.exe" queried SystemProcessInformation at 00000000-00000372-00000C15-3573999711 [PID: 372] "boosten.exe" queried SystemProcessInformation at 00000000-00007504-00000C15-3581793746 [PID: 7504]2a:T460,Contains base64 string in header "POST" in header "POST /e702da9c5a58/o/ HTTP/1.1Content-Type: application/jsonHost: oficiospolicia.comConnection: closeTransfer-Encoding: chunked" Contains base64 string in header "/e702da9c5a58/o/" in header "POST /e702da9c5a58/o/ HTTP/1.1Content-Type: application/jsonHost: oficiospolicia.comConnection: closeTransfer-Encoding: chunked" Contains base64 string in header "1Content" in header "POST /e702da9c5a58/o/ HTTP/1.1Content-Type: application/jsonHost: oficiospolicia.comConnection: closeTransfer-Encoding: chunked" Contains base64 string in header "Type" in header "POST /e702da9c5a58/o/ HTTP/1.1Content-Type: application/jsonHost: oficiospolicia.comConnection: closeTransfer-Encoding: chunked" Contains base64 string in header "application/jsonHost" in header "POST /e702da9c5a58/o/ HTTP/1.1Content-Type: application/jsonHost: oficiospolicia.comConnection: closeTransfer-Encoding: chunked" Contains base64 string in header "Encoding" in header "POST /e702da9c5a58/o/ HTTP/1.1Content-Type: application/jsonHost: oficiospolicia.comConnection: closeTransfer-Encoding: chunked"2b:Te6c3,Found XOR loop in file "libGLESv2.dll" at offset 418079; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2604876; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 3474764; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1277697; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 2359097; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 2455833; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 3655769; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 5091688; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 5142792; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 612292; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1072075; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1142737; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1142770; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1142790; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1142819; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1520122; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1520979; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1521200; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1521477; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1522252; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1812427; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1851454; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1892124; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1892190; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2643945; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2645611; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3148579; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3254698; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3257053; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3259202; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3265406; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3283013; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3306486; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3331925; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3331943; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3331970; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3332237; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3332493; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3332676; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3332829; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3550628; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3553504; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3721983; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3722399; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3722815; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3723231; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3723647; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4045739; code bytes = 8030 Found XOR loop in file "boosten.exe" at offset 360029; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 378445; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 383358; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 1425706; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 1425930; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 1426922; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 1427146; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 1439626; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 1470410; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 2783908; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 2783939; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 2888720; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 2888800; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 2907966; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 3266302; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 3267931; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 3425836; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 3508012; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 3778004; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 3874507; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 3922128; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 4121713; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 4197899; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 4233386; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 4276623; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 4299018; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 4324399; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 4568594; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 5209631; code bytes = 30d0 Found XOR loop in file "boosten.exe" at offset 1292154; code bytes = 33c1 Found XOR loop in file "boosten.exe" at offset 2018281; code bytes = 33c1 Found XOR loop in file "boosten.exe" at offset 2126683; code bytes = 33c1 Found XOR loop in file "boosten.exe" at offset 2131003; code bytes = 33c1 Found XOR loop in file "boosten.exe" at offset 4181563; code bytes = 33c1 Found XOR loop in file "boosten.exe" at offset 4523957; code bytes = 33c1 Found XOR loop in file "boosten.exe" at offset 261004; code bytes = 8030 Found XOR loop in file "boosten.exe" at offset 378037; code bytes = 8030 Found XOR loop in file "boosten.exe" at offset 1186530; code bytes = 8030 Found XOR loop in file "boosten.exe" at offset 1197119; code bytes = 8030 Found XOR loop in file "boosten.exe" at offset 1198155; code bytes = 8030 Found XOR loop in file "boosten.exe" at offset 1425102; code bytes = 8030 Found XOR loop in file "boosten.exe" at offset 1873294; code bytes = 8030 Found XOR loop in file "boosten.exe" at offset 2914231; code bytes = 8030 Found XOR loop in file "boosten.exe" at offset 2962657; code bytes = 8030 Found XOR loop in file "boosten.exe" at offset 3386838; code bytes = 8030 Found XOR loop in file "boosten.exe" at offset 3409974; code bytes = 8030 Found XOR loop in file "boosten.exe" at offset 3788405; code bytes = 8030 Found XOR loop in file "boosten.exe" at offset 3831101; code bytes = 8030 Found XOR loop in file "boosten.exe" at offset 3938382; code bytes = 8030 Found XOR loop in file "boosten.exe" at offset 4116812; code bytes = 8030 Found XOR loop in file "boosten.exe" at offset 4116888; code bytes = 8030 Found XOR loop in file "boosten.exe" at offset 4116964; code bytes = 8030 Found XOR loop in file "boosten.exe" at offset 4117040; code bytes = 8030 Found XOR loop in file "boosten.exe" at offset 4117116; code bytes = 8030 Found XOR loop in file "boosten.exe" at offset 4117192; code bytes = 8030 Found XOR loop in file "boosten.exe" at offset 4117263; code bytes = 8030 Found XOR loop in file "boosten.exe" at offset 4586247; code bytes = 8030 Found XOR loop in file "boosten.exe" at offset 4674017; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 3781351; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 4044320; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 4503124; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 4617468; code bytes = 30d0 Found XOR loop in file "vk_swiftshader.dll" at offset 596361; code bytes = 33c1 Found XOR loop in file "vk_swiftshader.dll" at offset 741465; code bytes = 33c1 Found XOR loop in file "vk_swiftshader.dll" at offset 1095329; code bytes = 33c1 Found XOR loop in file "vk_swiftshader.dll" at offset 3574736; code bytes = 33c1 Found XOR loop in file "vk_swiftshader.dll" at offset 3625800; code bytes = 33c1 Found XOR loop in file "vk_swiftshader.dll" at offset 391048; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 430004; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 442174; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 671036; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 834876; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1654279; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1681755; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1809669; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1809781; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1815769; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1816171; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 1833635; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2029007; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2030118; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2040992; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2083789; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2210743; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 2831500; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 3100629; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 3271692; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 4035199; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 4037951; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 4315096; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 4446115; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 4474311; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 4547104; code bytes = 8030 Found XOR loop in file "vk_swiftshader.dll" at offset 4574028; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 268108; code bytes = 30d0 Found XOR loop in file "d3dcompiler_47.dll" at offset 537116; code bytes = 30d0 Found XOR loop in file "d3dcompiler_47.dll" at offset 3439360; code bytes = 30d0 Found XOR loop in file "d3dcompiler_47.dll" at offset 3635364; code bytes = 30d0 Found XOR loop in file "d3dcompiler_47.dll" at offset 3642194; code bytes = 30d0 Found XOR loop in file "d3dcompiler_47.dll" at offset 4363080; code bytes = 30d0 Found XOR loop in file "d3dcompiler_47.dll" at offset 290618; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 370143; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 370175; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 432737; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 433198; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 433214; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 433252; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 433261; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 438151; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 446052; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 515378; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 515495; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 515527; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 515589; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 517648; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 517680; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 518132; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 562726; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 597233; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 627107; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 627316; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 686981; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 687000; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 699936; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 699960; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 700479; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 700503; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 707328; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 707360; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 707647; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 707666; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 711309; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 712152; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 712187; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 758741; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 797379; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 813737; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 922185; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 970345; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 970584; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 970631; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 970740; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 970760; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 970887; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 970917; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 971018; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 971165; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 972994; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 973233; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 973280; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 973389; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 973409; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 973536; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 973566; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 973667; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 973814; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1018222; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1191321; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1837354; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1890057; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2546060; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2587329; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2588016; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2606938; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2629786; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2634122; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2667385; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2667423; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2667461; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2667504; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2667547; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2667590; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2667633; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2667676; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2667719; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2667762; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2667805; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2667848; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2667891; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2667934; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2667977; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2668064; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2668102; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2668140; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2668183; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2668226; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2668269; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2668312; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2668355; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2668398; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2668441; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2668484; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2668527; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2668570; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2668613; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2668656; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2668743; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2668781; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2668819; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2668862; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2668905; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2668948; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2668991; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2669034; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2669077; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2669120; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2669163; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2669206; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2669249; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2730938; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2800330; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2801018; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2994492; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3123647; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3130947; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3130962; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3130976; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3130983; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3147092; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3147141; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3219958; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3219977; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3261107; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3261112; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3261259; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3261264; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3294195; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3294202; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3313259; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 4437492; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 4437500; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 68761; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 318366; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 336875; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 367664; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 368548; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 474765; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 499085; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 603669; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 626818; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 627125; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 642018; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 643404; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 855816; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 858554; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 858733; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1191012; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1191119; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1373981; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1387146; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1398885; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1427181; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1427305; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1427390; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1427727; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1427882; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1428019; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1430953; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1431076; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1431198; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1431320; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1435881; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1435924; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1436048; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1436193; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1436867; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1437211; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1437373; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1437603; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1438525; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1438674; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1439489; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1440109; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1440898; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1441417; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1441578; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1443630; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1443783; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1443906; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1446769; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1446835; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1447051; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1447068; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1475385; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1515624; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1594264; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1782509; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1783425; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1783784; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1784622; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1785837; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1786584; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1920852; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1931762; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1950927; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1969798; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1988632; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2032687; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2109511; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2250388; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2250823; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2274306; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2676201; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2676969; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2677521; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2678289; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2679009; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2679777; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2680281; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2961344; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 3645220; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4365176; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4403696; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4463461; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4463469; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 2800839; code bytes = 30d0 Found XOR loop in file "libGLESv2_526df8.dll" at offset 3113574; code bytes = 30d0 Found XOR loop in file "libGLESv2_526df8.dll" at offset 3121890; code bytes = 30d0 Found XOR loop in file "libGLESv2_526df8.dll" at offset 3209596; code bytes = 30d0 Found XOR loop in file "libGLESv2_526df8.dll" at offset 231449; code bytes = 33c1 Found XOR loop in file "libGLESv2_526df8.dll" at offset 1379345; code bytes = 33c1 Found XOR loop in file "libGLESv2_526df8.dll" at offset 1379415; code bytes = 33c1 Found XOR loop in file "libGLESv2_526df8.dll" at offset 1379481; code bytes = 33c1 Found XOR loop in file "libGLESv2_526df8.dll" at offset 1379547; code bytes = 33c1 Found XOR loop in file "libGLESv2_526df8.dll" at offset 2592448; code bytes = 33c1 Found XOR loop in file "libGLESv2_526df8.dll" at offset 2757631; code bytes = 33c1 Found XOR loop in file "libGLESv2_526df8.dll" at offset 564407; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 591883; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 730761; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 731163; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 748627; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 944863; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 945974; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 956848; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 999645; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 1126599; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 1973212; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 2326173; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 2326466; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 2493760; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 2901014; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 3023996; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 3027599; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 3219124; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 3232777; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 3236029; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 3236053; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 3236065; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 3236077; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 3236089; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 3236161; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 3236233; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 3236245; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 3236257; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 3236281; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 3238201; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 3238225; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 3239533; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 3240685; code bytes = 8030 Found XOR loop in file "libGLESv2_526df8.dll" at offset 3246196; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1868519; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2554744; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2616864; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2687807; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2690099; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2693091; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2773156; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2789812; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 656048; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 795412; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 826067; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1024872; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 2007829; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 2776912; code bytes = 30040e Found XOR loop in file "ffmpeg.dll" at offset 134314; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 199061; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1045950; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 2500253; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 2564079; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 2663171; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 2688187; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 2790352; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 122064; code bytes = 30d0 Found XOR loop in file "vulkan-1.dll" at offset 427479; code bytes = 30d0 Found XOR loop in file "vulkan-1.dll" at offset 635968; code bytes = 30d0 Found XOR loop in file "vulkan-1.dll" at offset 249216; code bytes = 33c1 Found XOR loop in file "vulkan-1.dll" at offset 72365; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 72411; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 81973; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 82741; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 84133; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 86405; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 87045; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 88037; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 186437; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 186949; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 187525; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 190165; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 207296; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 225705; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 582959; code bytes = 8030 Found XOR loop in file "vulkan-1.dll" at offset 624275; code bytes = 8030 Found XOR loop in file "libEGL_15e52e.dll" at offset 237719; code bytes = 30d0 Found XOR loop in file "libEGL_15e52e.dll" at offset 84320; code bytes = 33c1 Found XOR loop in file "libEGL_15e52e.dll" at offset 340111; code bytes = 8030 Found XOR loop in file "libEGL_15e52e.dll" at offset 342703; code bytes = 8030 Found XOR loop in file "libEGL_15e52e.dll" at offset 416276; code bytes = 8030 Found XOR loop in file "libEGL_15e52e.dll" at offset 457848; code bytes = 8030 Found XOR loop in file "libEGL.dll" at offset 12932; code bytes = 30d0 Found XOR loop in file "libEGL.dll" at offset 218887; code bytes = 30d0 Found XOR loop in file "libEGL.dll" at offset 325200; code bytes = 30d0 Found XOR loop in file "libEGL.dll" at offset 325408; code bytes = 30d0 Found XOR loop in file "libEGL.dll" at offset 378183; code bytes = 30d0 Found XOR loop in file "libEGL.dll" at offset 61312; code bytes = 33c1 Found XOR loop in file "libEGL.dll" at offset 320751; code bytes = 8030 Found XOR loop in file "libEGL.dll" at offset 437780; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 699259; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 741476; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 1164332; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 2299051; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 2475096; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3167818; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3167835; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3170110; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3324967; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3613156; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3920867; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3922319; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3923275; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3929493; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3930831; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3930997; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3937587; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3938281; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3940811; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3950339; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3957731; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3958989; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3970341; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3973749; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3981569; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3985023; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3988889; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4000145; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4004741; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4009725; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4015979; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4020119; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4023585; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4024323; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4033295; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4034019; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4042151; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4047065; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4056611; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4060279; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4061503; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4062507; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4063611; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4064129; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4065219; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4075951; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4081583; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4092045; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4094257; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4099875; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4105695; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4107579; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4108141; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4108419; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4114869; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4115973; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4122943; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4125697; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4127617; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4132767; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4135363; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4135703; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4139775; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4143039; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4147721; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4153083; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4157835; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4164333; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4166445; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4167815; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4176425; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4192829; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4194135; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4195573; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4201729; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4205783; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4207827; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4209855; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4211883; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4213901; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4215921; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4217923; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4222711; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4224031; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4226139; code bytes = 30d0 Found XOR loop in file "Certificado_20392302026.tmp" at offset 221902; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 504937; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 1323166; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 1323269; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 1815724; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3121859; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3121892; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3121925; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3121958; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3122121; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3122363; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3924191; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3936957; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3954051; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3959777; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3960507; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3986219; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4000255; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4011681; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4014983; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4015481; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4023151; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4023675; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4056775; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4061589; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4085907; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4134003; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4140679; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4169255; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4175985; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4202221; code bytes = 33c1 Found XOR loop in file "Certificado_20392302026.tmp" at offset 176401; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 176428; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 176863; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 176890; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 177139; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 177163; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 177390; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 177471; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 177494; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 177518; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 177546; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 177570; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 1194089; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 1492777; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 1520252; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 1524686; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 1527682; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 1537986; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 1562124; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 1638199; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 1694952; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 1706985; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 1972684; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 2827126; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 2947201; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 2969457; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 2982641; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3026588; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3050367; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3281445; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3281463; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3338238; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3338603; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3401238; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3402836; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3402866; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3402886; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3462107; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3462170; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3462207; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3462225; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3462556; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3462574; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3469857; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3914258; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3914798; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3916888; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3920848; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3921662; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3923262; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3925934; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3930130; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3933560; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3936248; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3937552; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3939726; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3940774; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3942964; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3949022; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3949358; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3957704; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3960334; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3965160; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3967262; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3969778; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3987396; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3987970; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3992956; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3994332; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3996534; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3997576; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 3998552; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4008484; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4009096; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4019144; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4021334; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4024284; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4025992; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4033256; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4033980; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4042120; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4051156; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4054712; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4056572; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4062496; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4063008; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4070276; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4077520; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4081572; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4083842; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4084508; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4089746; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4097492; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4103580; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4108116; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4116548; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4130588; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4131578; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4143010; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4147682; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4153044; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4154040; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4157796; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4160892; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4164293; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4167780; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4170904; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4171470; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4174820; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4180234; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4180664; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4186732; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4189260; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4195534; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4201690; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4205744; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4207788; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4209816; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4211844; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4213862; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4215882; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4217884; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4221892; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4222672; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4224012; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4226100; code bytes = 8030 Found XOR loop in file "Certificado_20392302026.tmp" at offset 4228199; code bytes = 80302c:T25a7,"Certificado_20392302026.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002196) "Certificado_20392302026.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002196) "Certificado_20392302026.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002196) "Certificado_20392302026.tmp" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000c76d91760000000060f74f00a0182e73ccfe4f00a0182e739b69f105feffffff80fe4f005c7f2c7330fe4f003c01000000800000757f2c739cfe4f00ffffffffffffffff0c000000000000009cfe4f00000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff0c000000000000009cfe4f0000000000819e9000200dca02a999900001000000f86290000000000066989000a4fe4f00 (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000ca0210f5ca02905bc702e05ac70200f6ca0210f5ca0274fb4f0074fb4f00a854a20018f5ca02b254a2003c010000ce080a3898fb4f0010f5ca0210f5ca0298fb4f0010f5ca0290fb4f002b5ea20034fc4f00405ea2004a5ea20000f6ca0200f6ca02a0fe4f00da60a200ce080a38f4ffffff00000000000001085365676f65205549000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0f6ca02 (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000f486ca020800000000000000000000000000000058fe4f00aa4158760004000000010000f486ca0208000000f486ca02080000003c01000088fe4f0008000000100000008cfe4f0042789200f486ca02080000005ef141ff7a6f9000b9ad9000b0fe4f009c079100f8ffca00b0fe4f008b079100f8ffca00acfe4f0013ca9d001dca9d00f0ae9900a850cc02a028c90201000000f0ae990000000000a0bdc9023bd59a000200000000000000584fcc028bde9a00f0ae990011989000a0bdc902379b9000f0ae9900a0bdc902939b9000f0ae990006e49a0010e49a00010000000cff4f0010ff4f0026e49a00b831ca00ee000000d731ca00f487bd00 (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc778377b4f38777e60000008cfe4f000400000070fe4f000c00000090fe4f00648607004c011200000000003c010000709f5e7612f48777c4010000000000000c0000000aa7a14dacfe4f00839f5e76c4010000abfe4f000000000010ff4f0032a9c800c4010000c4fe4f004c0164860000000000000000000000000000000000002475af6a91761200000004ff4f00f0552b757a6f9000ddad900000ff4f00 (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005f87e7712a5a14d78547f0000000000c0fc4f000000000000000000000000000000000048fc4f0000000000e8fc4f00b0e88377ca7c633afeffffff9cfc4f00fc317f7778547f00f0097f00dcfc4f0078547f0078547f00ccfc4f0000000000ccfc4f0080477f7795477f7705000000c0f2cb009b6f9000c4fc4f00db6c91760037c90274f84f00c0f2cb0038fd4f00a0182e733b68f105feffffff04fd4f002d17a9761a03070096040000112700000000000000000000b70200000000000020ff4f006840c8001a0307009604000011270000 (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005564) "boosten.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000372) "boosten.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c93812f3fb7f000080000000000000000000000000000000204cfe707d020000103344f5fb7f00000000000000000000000055f3fb7f000020eeffc1bc00000010410ff3fb7f0000104ffb707d020000e0edffc1bc000000000000000000000000000000000000000100000000000000b8400ff3fb7f000006000000000000000100000000000000000055f3fb7f00003b4d85f2fb7f0000000000000000000098f2ffc1bc0000000000000000000000d02a67f3fb7f000010b3cdf3fb7f0000e8f80ef3fb7f000010b3cdf3fb7f0000d02a67f3fb7f00000d000000fb7f00000d00000000000000a0f6bdf3fb7f0000f58762f3fb7f0000d02a67f3 (UID: 00000000-00000372) "boosten.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000372) "boosten.exe" called "RtlGetVersion" with parameter aaaaaaaa0a000000000000005d580000020000000000aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa (UID: 00000000-00000372)2d:T430,Found reference to API "7986742154,4348,3024,,RtlGetVersion,NTDLL.dll,"01:16:13.296",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00000372.00000000.292779.70FA0000.00000004.mdmp, 00000000-00000372.00000001.294700.70FA0000.00000004.mdmp") Found reference to API "8172397318,4348,3024,,RtlGetVersion,NTDLL.dll,"01:16:13.375",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00000372.00000000.292779.70FA0000.00000004.mdmp") Found reference to API "52263638624,6224,3024,,RtlGetVersion,NTDLL.dll,"01:16:31.734",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00000372.00000001.294700.70FA0000.00000004.mdmp, 00000000-00000372.00000002.296621.70FA0000.00000004.mdmp") Found reference to API "128060326111,4348,3024,,RtlGetVersion,NTDLL.dll,"01:17:03.312",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00000372.00000002.296621.70FA0000.00000004.mdmp") Found reference to API "9376778251,6208,3024,,RtlGetVersion,NTDLL.dll,"01:16:35.906",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00001392.00000000.294191.60840000.00000004.mdmp")2e:T794,"boosten.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "boosten.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "boosten.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{37255216-02EF-44F9-8AED-5DC539DF48FB}"; Key: "SEARCHLIST"; Value: "") "boosten.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{37255216-02EF-44F9-8AED-5DC539DF48FB}"; Key: "DOMAIN"; Value: "") "boosten.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{37255216-02EF-44F9-8AED-5DC539DF48FB}"; Key: "DHCPDOMAIN"; Value: "") "boosten.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "boosten.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "boosten.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "boosten.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{47E2A11A-1F71-4949-AADD-6B479BDC0801}"; Key: "SEARCHLIST"; Value: "") "boosten.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{47E2A11A-1F71-4949-AADD-6B479BDC0801}"; Key: "DHCPDOMAIN"; Value: "") "boosten.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "SEARCHLIST"; Value: "")2f:Td49,"boosten.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\resources\app\package.json" at 00000000-00000372-00000C17-3572386084 "boosten.exe" queries volume information of "C:\" at 00000000-00000372-00000C17-3572388154 "boosten.exe" queries volume information of "C:\Users" at 00000000-00000372-00000C17-3572388858 "boosten.exe" queries volume information of "C:\Users\%OSUSER%" at 00000000-00000372-00000C17-3572389309 "boosten.exe" queries volume information of "C:\Users\%OSUSER%\AppData" at 00000000-00000372-00000C17-3572389539 "boosten.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local" at 00000000-00000372-00000C17-3572389765 "boosten.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly" at 00000000-00000372-00000C17-3572390085 "boosten.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\resources" at 00000000-00000372-00000C17-3572390453 "boosten.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\resources\app" at 00000000-00000372-00000C17-3572390890 "boosten.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\resources\app\package.json" at 00000000-00000372-00000C17-3572391481 "boosten.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\resources\app\package.json" at 00000000-00000372-00000C17-3572396600 "boosten.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\resources\app\index.js" at 00000000-00000372-00000C17-3572428499 "boosten.exe" queries volume information of "C:\" at 00000000-00000372-00000C17-3572429201 "boosten.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\resources\app\index.js" at 00000000-00000372-00000C17-3572429801 "boosten.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\resources\app\index.js" at 00000000-00000372-00000C17-3572433068 "boosten.exe" queries volume information of "C:\Windows\System32\drivers\etc\hosts" at 00000000-00000372-00000C17-3573405256 "boosten.exe" queries volume information of "C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm" at 00000000-00000372-00000C17-3575475583 "boosten.exe" queries volume information of "C:\Windows\System32\drivers\etc\hosts" at 00000000-00000372-00000C17-3606414259 "boosten.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\temp.txt" at 00000000-00000372-00000C17-3623464908 "boosten.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\temp.txt" at 00000000-00000372-00000C17-3623465734 "boosten.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\temp.txt" at 00000000-00000372-00000C17-3673114469 "boosten.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\temp.txt" at 00000000-00000372-00000C17-3673115133 "boosten.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\temp.txt" at 00000000-00000372-00000C17-3722398931 "boosten.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\temp.txt" at 00000000-00000372-00000C17-3722399566 "boosten.exe" queries volume information of "C:\Windows\System32\drivers\etc\hosts" at 00000000-00001392-00000C17-359400572830:T1302,"Certificado_20392302026.tmp" called "CopyFileW" to copy %TEMP%\is-38DALNPB3K.tmp\boosten.exe to new location %LOCALAPPDATA%\AutoMaxwareUltraPlusly\boosten.exe (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CopyFileW" to copy %TEMP%\is-38DALNPB3K.tmp\chrome_100_percent.pak to new location %LOCALAPPDATA%\AutoMaxwareUltraPlusly\chrome_100_percent.pak (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CopyFileW" to copy %TEMP%\is-38DALNPB3K.tmp\chrome_200_percent.pak to new location %LOCALAPPDATA%\AutoMaxwareUltraPlusly\chrome_200_percent.pak (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CopyFileW" to copy %TEMP%\is-38DALNPB3K.tmp\d3dcompiler_47.dll to new location %LOCALAPPDATA%\AutoMaxwareUltraPlusly\d3dcompiler_47.dll (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CopyFileW" to copy %TEMP%\is-38DALNPB3K.tmp\ffmpeg.dll to new location %LOCALAPPDATA%\AutoMaxwareUltraPlusly\ffmpeg.dll (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CopyFileW" to copy %TEMP%\is-38DALNPB3K.tmp\icudtl.dat to new location %LOCALAPPDATA%\AutoMaxwareUltraPlusly\icudtl.dat (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CopyFileW" to copy %TEMP%\is-38DALNPB3K.tmp\libEGL.dll to new location %LOCALAPPDATA%\AutoMaxwareUltraPlusly\libEGL.dll (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CopyFileW" to copy %TEMP%\is-38DALNPB3K.tmp\libGLESv2.dll to new location %LOCALAPPDATA%\AutoMaxwareUltraPlusly\libGLESv2.dll (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CopyFileW" to copy %TEMP%\is-38DALNPB3K.tmp\LICENSE.electron.txt to new location %LOCALAPPDATA%\AutoMaxwareUltraPlusly\LICENSE.electron.txt (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CopyFileW" to copy %TEMP%\is-38DALNPB3K.tmp\LICENSES.chromium.html to new location %LOCALAPPDATA%\AutoMaxwareUltraPlusly\LICENSES.chromium.html (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CopyFileW" to copy %TEMP%\is-38DALNPB3K.tmp\resources.pak to new location %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources.pak (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CopyFileW" to copy %TEMP%\is-38DALNPB3K.tmp\snapshot_blob.bin to new location %LOCALAPPDATA%\AutoMaxwareUltraPlusly\snapshot_blob.bin (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CopyFileW" to copy %TEMP%\is-38DALNPB3K.tmp\v8_context_snapshot.bin to new location %LOCALAPPDATA%\AutoMaxwareUltraPlusly\v8_context_snapshot.bin (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CopyFileW" to copy %TEMP%\is-38DALNPB3K.tmp\vk_swiftshader.dll to new location %LOCALAPPDATA%\AutoMaxwareUltraPlusly\vk_swiftshader.dll (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CopyFileW" to copy %TEMP%\is-38DALNPB3K.tmp\vk_swiftshader_icd.json to new location %LOCALAPPDATA%\AutoMaxwareUltraPlusly\vk_swiftshader_icd.json (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CopyFileW" to copy %TEMP%\is-38DALNPB3K.tmp\vulkan-1.dll to new location %LOCALAPPDATA%\AutoMaxwareUltraPlusly\vulkan-1.dll (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CopyFileW" to copy %TEMP%\is-38DALNPB3K.tmp\boostnote.json to new location %LOCALAPPDATA%\AutoMaxwareUltraPlusly\a\boostnote.json (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CopyFileW" to copy %TEMP%\is-38DALNPB3K.tmp\jj2ZkYwtsV.json to new location %LOCALAPPDATA%\AutoMaxwareUltraPlusly\a\notes\jj2ZkYwtsV.json (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CopyFileW" to copy %TEMP%\is-38DALNPB3K.tmp\p1Jo8DYL_.json to new location %LOCALAPPDATA%\AutoMaxwareUltraPlusly\a\notes\p1Jo8DYL_.json (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CopyFileW" to copy %TEMP%\is-38DALNPB3K.tmp\XV6ER1EEs.json to new location %LOCALAPPDATA%\AutoMaxwareUltraPlusly\a\notes\XV6ER1EEs.json (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CopyFileW" to copy %TEMP%\is-38DALNPB3K.tmp\am.pak to new location %LOCALAPPDATA%\AutoMaxwareUltraPlusly\locales\am.pak (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CopyFileW" to copy %TEMP%\is-38DALNPB3K.tmp\ar.pak to new location %LOCALAPPDATA%\AutoMaxwareUltraPlusly\locales\ar.pak (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CopyFileW" to copy %TEMP%\is-38DALNPB3K.tmp\bg.pak to new location %LOCALAPPDATA%\AutoMaxwareUltraPlusly\locales\bg.pak (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CopyFileW" to copy %TEMP%\is-38DALNPB3K.tmp\bn.pak to new location %LOCALAPPDATA%\AutoMaxwareUltraPlusly\locales\bn.pak (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CopyFileW" to copy %TEMP%\is-38DALNPB3K.tmp\ca.pak to new location %LOCALAPPDATA%\AutoMaxwareUltraPlusly\locales\ca.pak (UID: 00000000-00005564)31:Tfbf,"Certificado_20392302026.exe" called "CreateDirectoryW" with parameter %TEMP%\is-PBGOKJDIR9.tmp (UID: 00000000-00002196) "Certificado_20392302026.tmp" called "CreateDirectoryW" with parameter %TEMP%\is-38DALNPB3K.tmp (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CreateDirectoryW" with parameter %TEMP%\is-38DALNPB3K.tmp\_isetup (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\a (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\a\notes (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\locales (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\compiled (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\compiled\app (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\compiled\app\codemirror (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\compiled\app\codemirror\theme (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\compiled\app\katex (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\compiled\app\katex\fonts (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\compiled\app\remark-admonitions (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\compiled\app\static (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\node_modules (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\node_modules\@sindresorhus (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\node_modules\@sindresorhus\is (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\node_modules\@sindresorhus\is\dist (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\node_modules\@szmarczak (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\node_modules\@szmarczak\http-timer (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\node_modules\@szmarczak\http-timer\dist (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\node_modules\@szmarczak\http-timer\dist\source (UID: 00000000-00005564)32:T2b39,"Certificado_20392302026.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002196) "Certificado_20392302026.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002196) "Certificado_20392302026.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002196) "Certificado_20392302026.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002196) "Certificado_20392302026.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002196) "Certificado_20392302026.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcrypt.dll (UID: 00000000-00002196) "Certificado_20392302026.tmp" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "LoadLibrary" with a parameter Msctf.dll (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\bcrypt.dll (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shfolder.dll (UID: 00000000-00005564) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000372) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000372) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000372) "boosten.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000372) "boosten.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000372) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00000372) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00000372) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00000372) "boosten.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00000372) "boosten.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000372) "boosten.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000372) "boosten.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00000372) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00000372) "boosten.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00000372) "boosten.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000372) "boosten.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00000372) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00000372) "boosten.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000372) "boosten.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00000372) "boosten.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000372) "boosten.exe" called "LoadLibrary" with a parameter COMCTL32.dll (UID: 00000000-00000372) "boosten.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00000372) "boosten.exe" called "LoadLibrary" with a parameter shcore.dll (UID: 00000000-00000372) "boosten.exe" called "LoadLibrary" with a parameter WTSAPI32.dll (UID: 00000000-00000372) "boosten.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000372) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00000372) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007504) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007504) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007504) "boosten.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007504) "boosten.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007504) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007504) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007504) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007504) "boosten.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00007504) "boosten.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007504) "boosten.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007504) "boosten.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007504) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00007504) "boosten.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007504) "boosten.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00007504) "boosten.exe" called "LoadLibrary" with a parameter mf.dll (UID: 00000000-00007504) "boosten.exe" called "LoadLibrary" with a parameter mfplat.dll (UID: 00000000-00007504) "boosten.exe" called "LoadLibrary" with a parameter msmpeg2vdec.dll (UID: 00000000-00007504) "boosten.exe" called "LoadLibrary" with a parameter dxva2.dll (UID: 00000000-00007504) "boosten.exe" called "LoadLibrary" with a parameter msvproc.dll (UID: 00000000-00007504) "boosten.exe" called "LoadLibrary" with a parameter D3DCompiler_47.dll (UID: 00000000-00007504) "boosten.exe" called "LoadLibrary" with a parameter ddraw.dll (UID: 00000000-00007504) "boosten.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\swiftshader\libglesv2.dll (UID: 00000000-00007504) "boosten.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\swiftshader\libegl.dll (UID: 00000000-00007504) "boosten.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\swiftshader\libGLES_CM.dll (UID: 00000000-00007504) "boosten.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\swiftshader\libGLES_CM_translator.dll (UID: 00000000-00007504) "boosten.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00007504) "boosten.exe" called "LoadLibrary" with a parameter MFPlat.DLL (UID: 00000000-00007504) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001392) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001392) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001392) "boosten.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001392) "boosten.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001392) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00001392) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00001392) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00001392) "boosten.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00001392) "boosten.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001392) "boosten.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001392) "boosten.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001392) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00001392) "boosten.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001392) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003300) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003300) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003300) "boosten.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003300) "boosten.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003300) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003300) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00003300) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00003300) "boosten.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00003300) "boosten.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003300) "boosten.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003300) "boosten.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003300) "boosten.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00003300) "boosten.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003300) "boosten.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00003300) "boosten.exe" called "LoadLibrary" with a parameter d3d11.dll (UID: 00000000-00003300) "boosten.exe" called "LoadLibrary" with a parameter mf.dll (UID: 00000000-00003300) "boosten.exe" called "LoadLibrary" with a parameter mfplat.dll (UID: 00000000-00003300) "boosten.exe" called "LoadLibrary" with a parameter msmpeg2vdec.dll (UID: 00000000-00003300) "boosten.exe" called "LoadLibrary" with a parameter dxva2.dll (UID: 00000000-00003300) "boosten.exe" called "LoadLibrary" with a parameter msvproc.dll (UID: 00000000-00003300) "boosten.exe" called "LoadLibrary" with a parameter d3d12.dll (UID: 00000000-00003300)33:Tfe9,Found reference to API (Indicator: "GetLogicalProcessorInformation"; File: "Certificado_20392302026.exe") Found reference to API (Indicator: "GetThreadPreferredUILanguages"; File: "Certificado_20392302026.exe") Found reference to API (Indicator: "SetThreadPreferredUILanguages"; File: "Certificado_20392302026.exe") Found reference to API (Indicator: "GetThreadUILanguage"; File: "Certificado_20392302026.exe") Found reference to API (Indicator: "GetLongPathNameW"; File: "Certificado_20392302026.exe") Found reference to API (Indicator: "SetEvent"; File: "Certificado_20392302026.exe") Found reference to API (Indicator: "ResetEvent"; File: "Certificado_20392302026.exe") Found reference to API (Indicator: "CompareStringOrdinal"; File: "Certificado_20392302026.exe") Found reference to API (Indicator: "RtlCompareUnicodeString"; File: "Certificado_20392302026.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "Certificado_20392302026.exe") Found reference to API (Indicator: "InitializeConditionVariable"; File: "Certificado_20392302026.exe") Found reference to API (Indicator: "WakeConditionVariable"; File: "Certificado_20392302026.exe") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "Certificado_20392302026.exe") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "Certificado_20392302026.exe") Found reference to API (Indicator: "GetTickCount64"; File: "Certificado_20392302026.exe") Found reference to API (Indicator: "CheckTokenMembership"; File: "Certificado_20392302026.exe") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "Certificado_20392302026.exe") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "Certificado_20392302026.exe") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; File: "Certificado_20392302026.exe") Found reference to API (Indicator: "GetCurrentDirectory"; File: "Certificado_20392302026.exe") Found reference to API (Indicator: "getsockname"; Source: "00000000-00000372.00000000.292779.003C8000.00000004.mdmp") Found reference to API (Indicator: "getpeername"; Source: "00000000-00000372.00000000.292779.003C8000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00000372.00000000.292779.70FA0000.00000004.mdmp, 00000000-00000372.00000001.294700.70FA0000.00000004.mdmp, 00000000-00000372.00000002.296621.70FA0000.00000004.mdmp") Found reference to API (Indicator: "NtOpenThreadToken"; Source: "00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp") Found reference to API (Indicator: "NtSetInformationThread"; Source: "00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp") Found reference to API (Indicator: "NtOpenProcessToken"; Source: "00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp") Found reference to API (Indicator: "NtOpenProcess"; Source: "00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp") Found reference to API (Indicator: "NtOpenThread"; Source: "00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp") Found reference to API (Indicator: "NtSetInformationFile"; Source: "00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp") Found reference to API (Indicator: "NtQueryAttributesFile"; Source: "00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp") Found reference to API (Indicator: "NtOpenFile"; Source: "00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp") Found reference to API (Indicator: "NtCreateFile"; Source: "00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp")34:T449,"Software\Embarcadero\Locales" in Source: Certificado_20392302026.exe "Software\CodeGear\Locales" in Source: Certificado_20392302026.exe "Software\Borland\Locales" in Source: Certificado_20392302026.exe "Software\Borland\Delphi\Locales" in Source: Certificado_20392302026.exe "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: Certificado_20392302026.exe "Registry\Machine\SOFTWARE\Policies\Microsoft\Windows\Appx" in Source: 00000000-00000372.00000000.292779.70FA0000.00000004.mdmp 00000000-00000372.00000001.294700.70FA0000.00000004.mdmp 00000000-00000372.00000002.296621.70FA0000.00000004.mdmp "y\Machine\Software\Classes\AppID\boosten.exe" in Source: 00000000-00000372.00000000.292779.70FA0000.00000004.mdmp 00000000-00000372.00000001.294700.70FA0000.00000004.mdmp 00000000-00000372.00000002.296621.70FA0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00000372.00000001.294700.70FA0000.00000004.mdmp 00000000-00000372.00000002.296621.70FA0000.00000004.mdmp35:Td35,"Certificado_20392302026.exe" with parameter %TEMP%\is-PBGOKJDIR9.tmp (UID: 00000000-00002196) "Certificado_20392302026.tmp" with parameter %TEMP%\is-38DALNPB3K.tmp (UID: 00000000-00005564) "Certificado_20392302026.tmp" with parameter %TEMP%\is-38DALNPB3K.tmp\_isetup (UID: 00000000-00005564) "Certificado_20392302026.tmp" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly (UID: 00000000-00005564) "Certificado_20392302026.tmp" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\a (UID: 00000000-00005564) "Certificado_20392302026.tmp" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\a\notes (UID: 00000000-00005564) "Certificado_20392302026.tmp" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\locales (UID: 00000000-00005564) "Certificado_20392302026.tmp" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources (UID: 00000000-00005564) "Certificado_20392302026.tmp" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app (UID: 00000000-00005564) "Certificado_20392302026.tmp" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\compiled (UID: 00000000-00005564) "Certificado_20392302026.tmp" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\compiled\app (UID: 00000000-00005564) "Certificado_20392302026.tmp" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\compiled\app\codemirror (UID: 00000000-00005564) "Certificado_20392302026.tmp" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\compiled\app\codemirror\theme (UID: 00000000-00005564) "Certificado_20392302026.tmp" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\compiled\app\katex (UID: 00000000-00005564) "Certificado_20392302026.tmp" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\compiled\app\katex\fonts (UID: 00000000-00005564) "Certificado_20392302026.tmp" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\compiled\app\remark-admonitions (UID: 00000000-00005564) "Certificado_20392302026.tmp" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\compiled\app\static (UID: 00000000-00005564) "Certificado_20392302026.tmp" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\node_modules (UID: 00000000-00005564) "Certificado_20392302026.tmp" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\node_modules\@sindresorhus (UID: 00000000-00005564) "Certificado_20392302026.tmp" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\node_modules\@sindresorhus\is (UID: 00000000-00005564) "Certificado_20392302026.tmp" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\node_modules\@sindresorhus\is\dist (UID: 00000000-00005564) "Certificado_20392302026.tmp" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\node_modules\@szmarczak (UID: 00000000-00005564) "Certificado_20392302026.tmp" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\node_modules\@szmarczak\http-timer (UID: 00000000-00005564) "Certificado_20392302026.tmp" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\node_modules\@szmarczak\http-timer\dist (UID: 00000000-00005564) "Certificado_20392302026.tmp" with parameter %LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\node_modules\@szmarczak\http-timer\dist\source (UID: 00000000-00005564)36:T5fc,Process Certificado_20392302026.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5564:168:WilStaging_02" Process Certificado_20392302026.tmp created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5564:64:WilError_03" Process Certificado_20392302026.tmp created mutex with name "SM0:5564:64:WilError_03" Process Certificado_20392302026.tmp created mutex with name "Local\SM0:5564:168:WilStaging_02" Process boosten.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:372:304:WilStaging_02" Process boosten.exe created mutex with name "Local\SM0:372:304:WilStaging_02" Process boosten.exe created mutex with name "SM0:372:120:WilError_03" Process boosten.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:372:120:WilError_03" Process boosten.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7504:304:WilStaging_02" Process boosten.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7504:120:WilError_03" Process boosten.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7504:120:WilError_03" Process boosten.exe created mutex with name "Local\SM0:7504:304:WilStaging_02" Process boosten.exe created mutex with name "SM0:7504:120:WilError_03" Process boosten.exe created mutex with name "Local\SM0:7504:120:WilError_03" Process boosten.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3300:304:WilStaging_02" Process boosten.exe created mutex with name "Local\SM0:3300:304:WilStaging_02"37:T4c6,Antivirus vendors marked dropped file "vk_swiftshader.dll" as clean (type is "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"), Antivirus vendors marked dropped file "d3dcompiler_47.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "libGLESv2_526df8.dll" as clean (type is "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"), Antivirus vendors marked dropped file "ffmpeg.dll" as clean (type is "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"), Antivirus vendors marked dropped file "vulkan-1.dll" as clean (type is "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"), Antivirus vendors marked dropped file "libEGL_15e52e.dll" as clean (type is "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"), Antivirus vendors marked dropped file "logo.svg" as clean (type is "SVG Scalable Vector Graphics image ASCII text with very long lines (516)"), Antivirus vendors marked dropped file "safari-pinned-tab.svg" as clean (type is "SVG XML document"), Antivirus vendors marked dropped file "_setup64.tmp" as clean (type is "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections")38:T514,"vk_swiftshader.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "d3dcompiler_47.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "libGLESv2_526df8.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "ffmpeg.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "vulkan-1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "libEGL_15e52e.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "libEGL.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF39:T1914,"Registry\Machine\SOFTWARE\Policies\Microsoft\Windows\Appx" in Source: 00000000-00000372.00000000.292779.70FA0000.00000004.mdmp "y\Machine\Software\Classes\AppID\boosten.exe" in Source: 00000000-00000372.00000000.292779.70FA0000.00000004.mdmp "Registry\Machine\SOFTWARE\Policies\Microsoft\Windows\Appx" in Source: 00000000-00000372.00000001.294700.70FA0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00000372.00000001.294700.70FA0000.00000004.mdmp "y\Machine\Software\Classes\AppID\boosten.exe" in Source: 00000000-00000372.00000001.294700.70FA0000.00000004.mdmp "Registry\Machine\SOFTWARE\Policies\Microsoft\Windows\Appx" in Source: 00000000-00000372.00000002.296621.70FA0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00000372.00000002.296621.70FA0000.00000004.mdmp "y\Machine\Software\Classes\AppID\boosten.exe" in Source: 00000000-00000372.00000002.296621.70FA0000.00000004.mdmp "Registry\Machine\SOFTWARE\Policies\Microsoft\Windows\Appx" in Source: 00000000-00003300.00000000.301130.ED0E0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdatesk" in Source: 00000000-00005564.00000001.293026.007E0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates" in Source: 00000000-00005564.00000001.293026.007E0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs" in Source: 00000000-00005564.00000001.293026.007E0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00005564.00000001.293026.007E0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdatesk" in Source: 00000000-00005564.00000002.294947.007E0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates" in Source: 00000000-00005564.00000002.294947.007E0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs" in Source: 00000000-00005564.00000002.294947.007E0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00005564.00000002.294947.007E0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs" in Source: 00000000-00007504.00000000.293514.68DE0000.00000004.mdmp "Registry\Machine\SOFTWARE\Policies\Microsoft\Windows\Appx" in Source: 00000000-00007504.00000000.293514.68DE0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000352-0000-0000-C000-000000000046}" in Source: 00000000-00007504.00000000.293514.68DE0000.00000004.mdmp "C\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000352-0000-0000-C000-000000000046}E=C:\Users\Hl" in Source: 00000000-00007504.00000000.293514.68DE0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000352-0000-0000-C000-000000000046}" in Source: 00000000-00007504.00000000.293514.68DE0000.00000004.mdmp "CO\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0000032A-0000-0000-C000-000000000046}" in Source: 00000000-00007504.00000000.293514.68DE0000.00000004.mdmp "874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0000032A-0000-0000-C000-000000000046}pping 0, Gen" in Source: 00000000-00007504.00000000.293514.68DE0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{03" in Source: 00000000-00007504.00000000.293514.68DE0000.00000004.mdmp "Software\Microsoft\Direct3D\Direct3D12" in Source: 00000000-00007504.00000000.293514.C711F000.00000002.mdmp "Software\Microsoft\VisualStudio\MSPDB" in Source: 00000000-00007504.00000000.293514.C711F000.00000002.mdmp "Registry\Machine\SOFTWARE\Policies\Microsoft\Windows\Appx" in Source: 00000000-00007504.00000001.295433.68DE0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000352-0000-0000-C000-000000000046}" in Source: 00000000-00007504.00000001.295433.68DE0000.00000004.mdmp "C\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000352-0000-0000-C000-000000000046}E=C:\Users\Hl" in Source: 00000000-00007504.00000001.295433.68DE0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000352-0000-0000-C000-000000000046}" in Source: 00000000-00007504.00000001.295433.68DE0000.00000004.mdmp "CO\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0000032A-0000-0000-C000-000000000046}" in Source: 00000000-00007504.00000001.295433.68DE0000.00000004.mdmp "874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0000032A-0000-0000-C000-000000000046}pping 0, Gen" in Source: 00000000-00007504.00000001.295433.68DE0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{03" in Source: 00000000-00007504.00000001.295433.68DE0000.00000004.mdmp "Registry\Machine\SOFTWARE\Policies\Microsoft\Windows\Appx" in Source: 00000000-00007504.00000002.297354.68DE0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000352-0000-0000-C000-000000000046}" in Source: 00000000-00007504.00000002.297354.68DE0000.00000004.mdmp "C\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000352-0000-0000-C000-000000000046}E=C:\Users\Hl" in Source: 00000000-00007504.00000002.297354.68DE0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000352-0000-0000-C000-000000000046}" in Source: 00000000-00007504.00000002.297354.68DE0000.00000004.mdmp "CO\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0000032A-0000-0000-C000-000000000046}" in Source: 00000000-00007504.00000002.297354.68DE0000.00000004.mdmp "874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0000032A-0000-0000-C000-000000000046}pping 0, Gen" in Source: 00000000-00007504.00000002.297354.68DE0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{03" in Source: 00000000-00007504.00000002.297354.68DE0000.00000004.mdmp3a:T1feb,"Certificado_20392302026.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 763e0000 "Certificado_20392302026.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 763e0000 "Certificado_20392302026.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 763e0000 "Certificado_20392302026.exe" loaded module "KERNEL32" at base 762f0000 "Certificado_20392302026.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 731e0000 "Certificado_20392302026.exe" loaded module "KERNEL32.DLL" at base 762f0000 "Certificado_20392302026.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPT.DLL" at base 731c0000 "Certificado_20392302026.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75f80000 "Certificado_20392302026.exe" loaded module "RPCRT4.DLL" at base 75e20000 "Certificado_20392302026.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74cc0000 "Certificado_20392302026.exe" loaded module "NTDLL.DLL" at base 777c0000 "Certificado_20392302026.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74bf0000 "Certificado_20392302026.tmp" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 763e0000 "Certificado_20392302026.tmp" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 763e0000 "Certificado_20392302026.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 763e0000 "Certificado_20392302026.tmp" loaded module "KERNEL32" at base 762f0000 "Certificado_20392302026.tmp" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 731e0000 "Certificado_20392302026.tmp" loaded module "KERNEL32.DLL" at base 762f0000 "Certificado_20392302026.tmp" loaded module "MSCTF.DLL" at base 76740000 "Certificado_20392302026.tmp" loaded module "IMM32.DLL" at base 75f50000 "Certificado_20392302026.tmp" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74cc0000 "Certificado_20392302026.tmp" loaded module "NTDLL.DLL" at base 777c0000 "Certificado_20392302026.tmp" loaded module "RPCRT4.DLL" at base 75e20000 "Certificado_20392302026.tmp" loaded module "UXTHEME.DLL" at base 74cc0000 "Certificado_20392302026.tmp" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76ca0000 "Certificado_20392302026.tmp" loaded module "%WINDIR%\SYSTEM32\BCRYPT.DLL" at base 731c0000 "Certificado_20392302026.tmp" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75f80000 "Certificado_20392302026.tmp" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 73000000 "Certificado_20392302026.tmp" loaded module "KERNELBASE" at base 763e0000 "Certificado_20392302026.tmp" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74bf0000 "Certificado_20392302026.tmp" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76c10000 "Certificado_20392302026.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 76a60000 "Certificado_20392302026.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 76a60000 "Certificado_20392302026.tmp" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 75da0000 "Certificado_20392302026.tmp" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75540000 "Certificado_20392302026.tmp" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76740000 "boosten.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffbf2810000 "boosten.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffbf2810000 "boosten.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffbf2810000 "boosten.exe" loaded module "KERNEL32" at base 7ffbf4630000 "boosten.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffbc8320000 "boosten.exe" loaded module "ADVAPI32.DLL" at base 7ffbf3260000 "boosten.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffbf2810000 "boosten.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffbf2810000 "boosten.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffbf2810000 "boosten.exe" loaded module "POWRPROF.DLL" at base 7ffbf26f0000 "boosten.exe" loaded module "USER32.DLL" at base 7ffbf40e0000 "boosten.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffbefe40000 "boosten.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffbf1cd0000 "boosten.exe" loaded module "SHELL32.DLL" at base 7ffbf3550000 "boosten.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 27d732c0000 "boosten.exe" loaded module "COMBASE.DLL" at base 7ffbf4290000 "boosten.exe" loaded module "OLE32.DLL" at base 7ffbf4700000 "boosten.exe" loaded module "KERNEL32.DLL" at base 7ffbf4630000 "boosten.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffbf1860000 "boosten.exe" loaded module "NTDLL.DLL" at base 7ffbf53f0000 "boosten.exe" loaded module "IPHLPAPI.DLL" at base 7ffbf1380000 "boosten.exe" loaded module "RPCRT4.DLL" at base 7ffbf3d70000 "boosten.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffbea0f0000 "boosten.exe" loaded module "COMCTL32.DLL" at base 7ffbd8e10000 "boosten.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffbeb1e0000 "boosten.exe" loaded module "%WINDIR%\SYSTEM32\NLANSP_C.DLL" at base 7ffbdc850000 "boosten.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ffbf51b0000 "boosten.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffbf4700000 "boosten.exe" loaded module "GDI32.DLL" at base 7ffbf3520000 "boosten.exe" loaded module "SHCORE.DLL" at base 27d732c0000 "boosten.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.DLL" at base 7ffbe1c60000 "boosten.exe" loaded module "WTSAPI32.DLL" at base 7ffbec940000 "boosten.exe" loaded module "%WINDIR%\SYSTEM32\MMDEVAPI.DLL" at base 7ffbea560000 "boosten.exe" loaded module "CFGMGR32.DLL" at base 7ffbf2420000 "boosten.exe" loaded module "MSCMS.DLL" at base 7ffbeab10000 "boosten.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 7ffbf2810000 "boosten.exe" loaded module "KERNELBASE" at base 7ffbf2810000 "boosten.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 2016b0b0000 "boosten.exe" loaded module "OLE32.DLL" at base 2016ae10000 "boosten.exe" loaded module "DXGI.DLL" at base 7ffbf0050000 "boosten.exe" loaded module "EXT-MS-WIN-CORE-RESOURCEPOLICY-L1-1-0.DLL" at base 7ffbf02d0000 "boosten.exe" loaded module "MF.DLL" at base 7ffbc8290000 "boosten.exe" loaded module "MFPLAT.DLL" at base 7ffbdd900000 "boosten.exe" loaded module "MSMPEG2VDEC.DLL" at base 7ffbc7ff0000 "boosten.exe" loaded module "DXVA2.DLL" at base 7ffbcdeb0000 "boosten.exe" loaded module "MSVPROC.DLL" at base 7ffbc7920000 "boosten.exe" loaded module "D3DCOMPILER_47.DLL" at base 0 "boosten.exe" loaded module "D3DCOMPILER_47.DLL" at base 7ffbc6de0000 "boosten.exe" loaded module "DDRAW.DLL" at base 7ffbc7dc0000 "boosten.exe" loaded module "%LOCALAPPDATA%\AUTOMAXWAREULTRAPLUSLY\SWIFTSHADER\LIBGLESV2.DLL" at base 7ffbc6a60000 "boosten.exe" loaded module "%LOCALAPPDATA%\AUTOMAXWAREULTRAPLUSLY\SWIFTSHADER\LIBEGL.DLL" at base 7ffbc78a0000 "boosten.exe" loaded module "%LOCALAPPDATA%\AUTOMAXWAREULTRAPLUSLY\SWIFTSHADER\LIBGLES_CM.DLL" at base 0 "boosten.exe" loaded module "%LOCALAPPDATA%\AUTOMAXWAREULTRAPLUSLY\SWIFTSHADER\LIBGLES_CM_TRANSLATOR.DLL" at base 0 "boosten.exe" loaded module "DWMAPI.DLL" at base 7ffbf0250000 "boosten.exe" loaded module "%WINDIR%\SYSTEM32\MFH264ENC.DLL" at base 7ffbc7800000 "boosten.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.MEDIA.DLL" at base 7ffbc6390000 "boosten.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 21362a20000 "boosten.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 210ef0b0000 "boosten.exe" loaded module "D3D11.DLL" at base 0 "boosten.exe" loaded module "D3D11.DLL" at base 7ffbee990000 "boosten.exe" loaded module "D3D12.DLL" at base 0 "boosten.exe" loaded module "D3D12.DLL" at base 7ffbefc40000 "boosten.exe" loaded module "API-MS-WIN-APPMODEL-UNLOCK-L1-1-0.DLL" at base 7ffbf1860000 "boosten.exe" loaded module "%WINDIR%\SYSTEM32\D3D12CORE.DLL" at base 7ffbcc510000 "boosten.exe" loaded module "DXCORE.DLL" at base 7ffbeff30000 "boosten.exe" loaded module "D3D10WARP.DLL" at base 7ffbec2200003b:Taa5,"Certificado_20392302026.exe" was detected as "Inno Setup Module" and name: "Installer" "Certificado_20392302026.exe" was detected as ".NET Reactor" and name: "Protector" "Certificado_20392302026.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "Certificado_20392302026.exe" was detected as "Turbo Linker" and name: "Linker" "vk_swiftshader.dll" was detected as "Inno Setup Module" and name: "Installer" "vk_swiftshader.dll" was detected as ".NET Reactor" and name: "Protector" "vk_swiftshader.dll" was detected as "Embarcadero Delphi" and name: "Compiler" "vk_swiftshader.dll" was detected as "Turbo Linker" and name: "Linker" "d3dcompiler_47.dll" was detected as "Inno Setup Module" and name: "Installer" "d3dcompiler_47.dll" was detected as ".NET Reactor" and name: "Protector" "d3dcompiler_47.dll" was detected as "Embarcadero Delphi" and name: "Compiler" "d3dcompiler_47.dll" was detected as "Turbo Linker" and name: "Linker" "libGLESv2_526df8.dll" was detected as "Inno Setup Module" and name: "Installer" "libGLESv2_526df8.dll" was detected as ".NET Reactor" and name: "Protector" "libGLESv2_526df8.dll" was detected as "Embarcadero Delphi" and name: "Compiler" "libGLESv2_526df8.dll" was detected as "Turbo Linker" and name: "Linker" "ffmpeg.dll" was detected as "Inno Setup Module" and name: "Installer" "ffmpeg.dll" was detected as ".NET Reactor" and name: "Protector" "ffmpeg.dll" was detected as "Embarcadero Delphi" and name: "Compiler" "ffmpeg.dll" was detected as "Turbo Linker" and name: "Linker" "vulkan-1.dll" was detected as "Inno Setup Module" and name: "Installer" "vulkan-1.dll" was detected as ".NET Reactor" and name: "Protector" "vulkan-1.dll" was detected as "Embarcadero Delphi" and name: "Compiler" "vulkan-1.dll" was detected as "Turbo Linker" and name: "Linker" "libEGL_15e52e.dll" was detected as "Inno Setup Module" and name: "Installer" "libEGL_15e52e.dll" was detected as ".NET Reactor" and name: "Protector" "libEGL_15e52e.dll" was detected as "Embarcadero Delphi" and name: "Compiler" "libEGL_15e52e.dll" was detected as "Turbo Linker" and name: "Linker" "libEGL.dll" was detected as "Inno Setup Module" and name: "Installer" "libEGL.dll" was detected as ".NET Reactor" and name: "Protector" "libEGL.dll" was detected as "Embarcadero Delphi" and name: "Compiler" "libEGL.dll" was detected as "Turbo Linker" and name: "Linker" "_setup64.tmp" was detected as "Inno Setup Module" and name: "Installer" "_setup64.tmp" was detected as ".NET Reactor" and name: "Protector" "_setup64.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "_setup64.tmp" was detected as "Turbo Linker" and name: "Linker"3c:T17b8,"libGLESv2.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\libGLESv2.dll]- [targetUID: 00000000-00007504] "boosten.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 12 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\boosten.exe]- [targetUID: 00000000-00000372] "vk_swiftshader.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\vk_swiftshader.dll]- [targetUID: 00000000-00005564] "d3dcompiler_47.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\d3dcompiler_47.dll]- [targetUID: 00000000-00007504] "libGLESv2_526df8.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\libGLESv2_526df8.dll]- [targetUID: 00000000-00005564] "ffmpeg.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\ffmpeg.dll]- [targetUID: 00000000-00000372] "vulkan-1.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\vulkan-1.dll]- [targetUID: 00000000-00005564] "libEGL_15e52e.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\libEGL_15e52e.dll]- [targetUID: 00000000-00005564] "libEGL.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\libEGL.dll]- [targetUID: 00000000-00007504] "logo.svg" has type "SVG Scalable Vector Graphics image ASCII text with very long lines (516)"- Location: [%TEMP%\is-38DALNPB3K.tmp\logo.svg]- [targetUID: 00000000-00005564] "safari-pinned-tab.svg" has type "SVG XML document"- Location: [%TEMP%\is-38DALNPB3K.tmp\safari-pinned-tab.svg]- [targetUID: 00000000-00005564] "LICENSES.chromium.html" has type "HTML document text HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\is-38DALNPB3K.tmp\LICENSES.chromium.html]- [targetUID: 00000000-00005564] "Certificado_20392302026.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-PBGOKJDIR9.tmp\Certificado_20392302026.tmp]- [targetUID: 00000000-00002196] "AppUpdater.js.map" has type "JSON text data"- Location: [%TEMP%\is-38DALNPB3K.tmp\AppUpdater.js.map]- [targetUID: 00000000-00005564] "DataSplitter.js.map" has type "JSON text data"- Location: [%TEMP%\is-38DALNPB3K.tmp\DataSplitter.js.map]- [targetUID: 00000000-00005564] "MacUpdater.js.map" has type "JSON text data"- Location: [%TEMP%\is-38DALNPB3K.tmp\MacUpdater.js.map]- [targetUID: 00000000-00005564] "Provider.js.map" has type "JSON text data"- Location: [%TEMP%\is-38DALNPB3K.tmp\Provider.js.map]- [targetUID: 00000000-00005564] "AppImageUpdater.js.map" has type "JSON text data"- Location: [%TEMP%\is-38DALNPB3K.tmp\AppImageUpdater.js.map]- [targetUID: 00000000-00005564] "json2xml.js" has type "JavaScript source ASCII text"- Location: [%TEMP%\is-38DALNPB3K.tmp\json2xml.js]- [targetUID: 00000000-00005564] "xml.js.map" has type "JSON text data"- Location: [%TEMP%\is-38DALNPB3K.tmp\xml.js.map]- [targetUID: 00000000-00005564] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00005564] "BaseUpdater.js.map" has type "JSON text data"- Location: [%TEMP%\is-38DALNPB3K.tmp\BaseUpdater.js.map]- [targetUID: 00000000-00005564] "CancellationToken.js.map" has type "JSON text data"- Location: [%TEMP%\is-38DALNPB3K.tmp\CancellationToken.js.map]- [targetUID: 00000000-00005564] "windowsExecutableCodeSignatureVerifier.js" has type "JavaScript source ASCII text"- Location: [%TEMP%\is-38DALNPB3K.tmp\windowsExecutableCodeSignatureVerifier.js]- [targetUID: 00000000-00005564] "electronHttpExecutor.js.map" has type "JSON text data"- Location: [%TEMP%\is-38DALNPB3K.tmp\electronHttpExecutor.js.map]- [targetUID: 00000000-00005564] "FileWithEmbeddedBlockMapDifferentialDownloader.js.map" has type "JSON text data"- Location: [%TEMP%\is-38DALNPB3K.tmp\FileWithEmbeddedBlockMapDifferentialDownloader.js.map]- [targetUID: 00000000-00005564] "util.js.map" has type "JSON text data"- Location: [%TEMP%\is-38DALNPB3K.tmp\util.js.map]- [targetUID: 00000000-00005564] "index.js.map" has type "JSON text data"- Location: [%TEMP%\is-38DALNPB3K.tmp\index.js.map]- [targetUID: 00000000-00005564] "node2json_str.js" has type "JavaScript source ASCII text"- Location: [%TEMP%\is-38DALNPB3K.tmp\node2json_str.js]- [targetUID: 00000000-00005564] "packageJson.js" has type "JavaScript source ASCII text"- Location: [%TEMP%\is-38DALNPB3K.tmp\packageJson.js]- [targetUID: 00000000-00005564] "node2json.js" has type "JavaScript source ASCII text"- Location: [%TEMP%\is-38DALNPB3K.tmp\node2json.js]- [targetUID: 00000000-00005564] "main.js_a0f034.map" has type "JSON text data"- Location: [%TEMP%\is-38DALNPB3K.tmp\main.js_a0f034.map]- [targetUID: 00000000-00005564] "index.html" has type "HTML document ASCII text"- Location: [%TEMP%\is-38DALNPB3K.tmp\index.html]- [targetUID: 00000000-00005564] "packageJson.spec.js" has type "JavaScript source ASCII text"- Location: [%TEMP%\is-38DALNPB3K.tmp\packageJson.spec.js]- [targetUID: 00000000-00005564] "NoOpLogger.js.map" has type "JSON text data"- Location: [%TEMP%\is-38DALNPB3K.tmp\NoOpLogger.js.map]- [targetUID: 00000000-00005564] "json.js" has type "JavaScript source ASCII text"- Location: [%TEMP%\is-38DALNPB3K.tmp\json.js]- [targetUID: 00000000-00005564] "output-json.js" has type "JavaScript source ASCII text"- Location: [%TEMP%\is-38DALNPB3K.tmp\output-json.js]- [targetUID: 00000000-00005564] "output-json-sync.js" has type "JavaScript source ASCII text"- Location: [%TEMP%\is-38DALNPB3K.tmp\output-json-sync.js]- [targetUID: 00000000-00005564] "jsonfile.js" has type "JavaScript source ASCII text"- Location: [%TEMP%\is-38DALNPB3K.tmp\jsonfile.js]- [targetUID: 00000000-00005564]3d:T544,"Certificado_20392302026.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "Certificado_20392302026.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "Certificado_20392302026.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "Certificado_20392302026.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Certificado_20392302026.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "Certificado_20392302026.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "Certificado_20392302026.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "Certificado_20392302026.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Certificado_20392302026.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Certificado_20392302026.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "")3e:T582,"libGLESv2.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\libGLESv2.dll]- [targetUID: 00000000-00007504] "vk_swiftshader.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\vk_swiftshader.dll]- [targetUID: 00000000-00005564] "d3dcompiler_47.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\d3dcompiler_47.dll]- [targetUID: 00000000-00007504] "libGLESv2_526df8.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\libGLESv2_526df8.dll]- [targetUID: 00000000-00005564] "ffmpeg.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\ffmpeg.dll]- [targetUID: 00000000-00000372] "vulkan-1.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\vulkan-1.dll]- [targetUID: 00000000-00005564] "libEGL_15e52e.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\libEGL_15e52e.dll]- [targetUID: 00000000-00005564] "libEGL.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\libEGL.dll]- [targetUID: 00000000-00007504]3f:Tba8,"Certificado_20392302026.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "Certificado_20392302026.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "Certificado_20392302026.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "Certificado_20392302026.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "Certificado_20392302026.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "Certificado_20392302026.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "CERTIFICADO_20392302026.EXE"; Value: "") "Certificado_20392302026.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Certificado_20392302026.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "Certificado_20392302026.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "Certificado_20392302026.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "Certificado_20392302026.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "Certificado_20392302026.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "Certificado_20392302026.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "Certificado_20392302026.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "Certificado_20392302026.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "CA967C75-04BF-40B5-9A16-98B5F9332A92"; Value: "") "Certificado_20392302026.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B6FD710B-F783-4B1C-AB9C-C68099DCC0C7"; Value: "") "Certificado_20392302026.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "BF30465B-E93C-46FD-9CDF-F41C8904A01F"; Value: "") "Certificado_20392302026.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "C1376338-0984-48B8-B933-9C7D779FD84D"; Value: "") "Certificado_20392302026.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F25BCD2E-2690-55DC-3BC4-07B65B1B41C9"; Value: "")40:T82e,"Certificado_20392302026.tmp" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "boosten.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\CRYPTSP.DLL" "boosten.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\CRYPTBASE.DLL" "boosten.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\powrprof.dll" "boosten.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\UMPDC.dll" "boosten.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\update.exe" "boosten.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\profapi.dll" "boosten.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\WTSAPI32.dll" "boosten.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\mscms.dll" "boosten.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\WINSTA.dll" "boosten.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\dxgi.dll" "boosten.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\d3d10warp.dll" "boosten.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\mf.dll" "boosten.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\mfplat.dll" "boosten.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\RTWorkQ.DLL" "boosten.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\msmpeg2vdec.dll" "boosten.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\mfperfhelper.dll" "boosten.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\dxva2.dll"41:Td6c,"Certificado_20392302026.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-PBGOKJDIR9.tmp" "Certificado_20392302026.tmp" trying to access non-existent file "C:\Windows\SysWOW64\en-US\tzres.dll.mui" "Certificado_20392302026.tmp" trying to access non-existent file "C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui" "Certificado_20392302026.tmp" trying to access non-existent file "C:\Windows\SysWOW64\en-US\netmsg.dll.mui" "Certificado_20392302026.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-38DALNPB3K.tmp" "Certificado_20392302026.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly" "Certificado_20392302026.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\a" "Certificado_20392302026.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\a\notes" "Certificado_20392302026.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\locales" "Certificado_20392302026.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\resources" "Certificado_20392302026.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\resources\app" "Certificado_20392302026.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\resources\app\compiled" "Certificado_20392302026.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\resources\app\compiled\app" "Certificado_20392302026.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\resources\app\compiled\app\codemirror" "Certificado_20392302026.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\resources\app\compiled\app\codemirror\theme" "Certificado_20392302026.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\resources\app\compiled\app\katex" "Certificado_20392302026.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\resources\app\compiled\app\katex\fonts" "Certificado_20392302026.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\resources\app\compiled\app\remark-admonitions" "Certificado_20392302026.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\resources\app\compiled\app\static" "Certificado_20392302026.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\resources\app\node_modules" "Certificado_20392302026.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\resources\app\node_modules\@sindresorhus" "Certificado_20392302026.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\resources\app\node_modules\@sindresorhus\is" "Certificado_20392302026.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\resources\app\node_modules\@sindresorhus\is\dist" "Certificado_20392302026.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\resources\app\node_modules\@szmarczak"42:Tbe7,Found reference to API "getHostname" (Indicator: "gethostname"; Source: "00000000-00000372.00000000.292779.00294000.00000004.mdmp, 00000000-00000372.00000001.294700.00294000.00000004.mdmp, 00000000-00000372.00000002.296621.00294000.00000004.mdmp") Found reference to API ":authority header is required for CONNECT requests" (Indicator: " connect "; Source: "00000000-00000372.00000000.292779.0047C000.00000004.mdmp, 00000000-00000372.00000001.294700.0047C000.00000004.mdmp, 00000000-00000372.00000002.296621.0047C000.00000004.mdmp") Found reference to API "The :path header is forbidden for CONNECT requests" (Indicator: " connect "; Source: "00000000-00000372.00000000.292779.0047C000.00000004.mdmp, 00000000-00000372.00000001.294700.0047C000.00000004.mdmp, 00000000-00000372.00000002.296621.0047C000.00000004.mdmp") Found reference to API "The :scheme header is forbidden for CONNECT requests" (Indicator: " connect "; Source: "00000000-00000372.00000000.292779.0047C000.00000004.mdmp, 00000000-00000372.00000001.294700.0047C000.00000004.mdmp, 00000000-00000372.00000002.296621.0047C000.00000004.mdmp") Found reference to API "The socket is already bound to an Http2Session" (Indicator: " socket "; Source: "00000000-00000372.00000000.292779.0047C000.00000004.mdmp, 00000000-00000372.00000001.294700.0047C000.00000004.mdmp, 00000000-00000372.00000002.296621.0047C000.00000004.mdmp") Found reference to API "The socket has been disconnected from the Http2Session" (Indicator: " socket "; Source: "00000000-00000372.00000000.292779.0047C000.00000004.mdmp, 00000000-00000372.00000001.294700.0047C000.00000004.mdmp, 00000000-00000372.00000002.296621.0047C000.00000004.mdmp") Found reference to API "Bad socket type specified. Valid types are: udp4, udp6" (Indicator: " socket "; Source: "00000000-00000372.00000000.292779.0047C000.00000004.mdmp, 00000000-00000372.00000001.294700.0047C000.00000004.mdmp, 00000000-00000372.00000002.296621.0047C000.00000004.mdmp") Found reference to API "TLS socket connection must be securely established" (Indicator: " socket "; Source: "00000000-00000372.00000000.292779.0047C000.00000004.mdmp, 00000000-00000372.00000001.294700.0047C000.00000004.mdmp, 00000000-00000372.00000002.296621.0047C000.00000004.mdmp") Found reference to API "service not available for socket type" (Indicator: " socket "; Source: "00000000-00000372.00000000.292779.08080000.00000004.mdmp, 00000000-00000372.00000001.294700.08080000.00000004.mdmp, 00000000-00000372.00000002.296621.08080000.00000004.mdmp") Found reference to API "CLIENT socket onClose" (Indicator: " socket "; Source: "00000000-00000372.00000001.294700.087C0000.00000004.mdmp, 00000000-00000372.00000002.296621.087C0000.00000004.mdmp") Found reference to API "HTTP socket close" (Indicator: " socket "; Source: "00000000-00000372.00000001.294700.087C0000.00000004.mdmp, 00000000-00000372.00000002.296621.087C0000.00000004.mdmp") file/memory contains long string with (Indicator: " connect "; Source: "00000000-00001392.00000001.296113.62960000.00000002.mdmp")43:T17c0,Pattern match: "https://jrsoftware.org/ishelp/index.php?topic=setupcmdline" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "http://www.w3.org/tr/2001/rec-svg-20010904/dtd/svg10.dtd" Pattern match: "https://github.com/electron-userland/electron-builder/pull/5524\n" Pattern match: "https://stackoverflow.com/a/1712051/1910191\n" Pattern match: "https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_quoting_rules?view=powershell-7" Pattern match: "https://github.com/electron/electron/issues/11505\n" Pattern match: "http://www.yaml.org/spec/1.2/spec.html#id2803231//" Heuristic match: "oficiospolicia.com" Heuristic match: "%localappdata%\automaxwareultraplusly\resources\app\node_modules\electron-updater\out\downloadedupdatehelper.js.ma" Heuristic match: "%temp%\is-38dalnpb3k.tmp\license.md" Heuristic match: "%localappdata%\automaxwareultraplusly\resources\app\node_modules\is-typedarray\license.md" Heuristic match: "%temp%\is-38dalnpb3k.tmp\license_c4bbd3.md" Heuristic match: "%localappdata%\automaxwareultraplusly\resources\app\node_modules\ms\license.md" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl" Pattern match: "www.xrampsecurity.com1$0" Pattern match: "http://crl.xrampsecurity.com/xgca.crl0" Pattern match: "crl.comodoca.com/comodocertificationauthority.crl" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist0c" Pattern match: "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%20ev%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist0f" Pattern match: "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "https://www.catcert.net/verarrel" Pattern match: "www.camerfirma.com/address" Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com1+0" Pattern match: "https://nodejs.org/download/release/v14.16.0/win-x64/node.lib" Pattern match: "crl.netsolssl.com/networksolutionscertificateauthority.crl" Heuristic match: "izenpe.com" Pattern match: "www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crl" Pattern match: "www.digicert.com1" Pattern match: "http://logo.verisign.com/vslogo.gif" Pattern match: "www.digicert.com1!0" Pattern match: "http://crl.certigna.fr/certignarootca.crl01" Pattern match: "http://crl.dhimyotis.com/certignarootca.crl" Pattern match: "https://nodejs.org/download/release/v14.16.0/node-v14.16.0.tar.gz" Pattern match: "https://nodejs.org/download/release/v14.16.0/node-v14.16.0-headers.tar.gz" Pattern match: "http://repository.swisssign.com/" Pattern match: "http://www2.public-trust.com/crl/ct/ctroot.crl" Pattern match: "https://wwww.certigna.fr/autorites/" Heuristic match: "info@e-szigno.hu" Pattern match: "https://www.catcert.net/verarrel05" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.securetrust.com/sgca.crl0" Pattern match: "http://www2.public-trust.com/crl/ct/ctroot.crl0" Heuristic match: "info@izenpe.com" Heuristic match: "host: oficiospolicia.com" Pattern match: "http://www.firmaprofesional.com/cps0\" Heuristic match: "pki@sk.ee" Pattern match: "http://www.quovadisglobal.com/cps" Pattern match: "http://www.quovadis.bm" Pattern match: "https://ocsp.quovadisoffshore.com0" Pattern match: "http://www.quovadis.bm0" Pattern match: "http://www.quovadisglobal.com/cps0" Pattern match: "https://wwww.certigna.fr/autorites/0m" Pattern match: "http://policy.camerfirma.com" Pattern match: "http://www.accv.es" Pattern match: "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0" Pattern match: "http://ocsp.accv.es0" Pattern match: "http://www.accv.es/legislacion_c.htm0u" Pattern match: "www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crl0" Pattern match: "http://ocsp.accv.es" Pattern match: "http://www.cert.fnmt.es/dpcs/" Heuristic match: "entrust.net" Pattern match: "www.entrust.net/cps_2048" Pattern match: "http://crl.globalsign.net/root-r2.crl" Pattern match: "http://crl.securetrust.com/stca.crl" Pattern match: "http://crl.xrampsecurity.com/xgca.crl" Pattern match: "https://ocsp.quovadisoffshore.com" Pattern match: "www.entrust.net/cps" Pattern match: "http://crl.securetrust.com/sgca.crl" Heuristic match: "secom trust.net" Pattern match: "www.xrampsecurity.com" Pattern match: "www.digicert.com" Heuristic match: "ec_acc@catcert.net" Heuristic match: "accv@accv.es" Pattern match: "www.entrust.net/legal-terms" Heuristic match: "m .ph" Pattern match: "https://chrome.google.com/webstore" Pattern match: "https://clients2.google.com/service/update2/crx" Pattern match: "oficiospolicia.com/e702da9c5a58/o/" Pattern match: "https://issuehunt.io/r/boostio/boostnote.next" Pattern match: "https://fs.microsoft.com/fs/windows/config.json" Pattern match: "https://fs.microsoft.com/fs/windows/config.json,config,0" Heuristic match: "etwork.mojom.ne" Pattern match: "http://www.iec.ch" Heuristic match: "string.prototype.at" Heuristic match: "%typedarray%.prototype.at" Heuristic match: "{8sagp.bd" Heuristic match: "l;e.ie" Heuristic match: "b[l-.ua" Heuristic match: "ficiospolicia.com" Pattern match: "http://example.com" Pattern match: "https://support.google.com/chrome/answer/6098869" Pattern match: "g.co/safebrowsingstatus.insecure" Pattern match: "https://bugs.chromium.org/p/chromium/issues/entry?template=safety+tips+appeals.possible" Pattern match: "https://bugs.chromium.org/p/chromium/issues/entry?template=safety+tips+appeals.computerdevicetabletverify" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Heuristic match: "!w.am"44:T7bf1,Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crlwww.xrampsecurity.com1$0" - Source: "00000000-00000372.00000000.292779.0000C000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0us1%0" - Source: "00000000-00000372.00000000.292779.0000C000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocertificationauthority.crlthawte," - Source: "00000000-00000372.00000000.292779.0000C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0budapest1netlock" - Source: "00000000-00000372.00000000.292779.0000C000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crld-trust" - Source: "00000000-00000372.00000000.292779.0000C000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl" - Source: "00000000-00000372.00000000.292779.0000C000.00000004.mdmp") Found URL "https://www.catcert.net/verarrel" - Source: "00000000-00000372.00000000.292779.00038000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v14.16.0/win-x64/node.libs2--debug-port'--debug=--debug-brk=?--inspect-brk=--inspect-brk-node=--inspect=--print" - Source: "00000000-00000372.00000000.292779.00058000.00000004.mdmp") Found URL "http://crl.netsolssl.com/networksolutionscertificateauthority.crlus1" - Source: "00000000-00000372.00000000.292779.00058000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crlbratislava1disig" - Source: "00000000-00000372.00000000.292779.00058000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gifswisssign" - Source: "00000000-00000372.00000000.292779.00058000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gifvz" - Source: "00000000-00000372.00000000.292779.00058000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif6r" - Source: "00000000-00000372.00000000.292779.00058000.00000004.mdmp") Found URL "http://crl.certigna.fr/certignarootca.crl01+http://crl.dhimyotis.com/certignarootca.crl" - Source: "00000000-00000372.00000000.292779.00058000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v14.16.0/node-v14.16.0.tar.gz" - Source: "00000000-00000372.00000000.292779.00078000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v14.16.0/node-v14.16.0-headers.tar.gzhelp" - Source: "00000000-00000372.00000000.292779.00078000.00000004.mdmp") Found URL "http://repository.swisssign.com/swisssign" - Source: "00000000-00000372.00000000.292779.00078000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocertificationauthority.crlus1" - Source: "00000000-00000372.00000000.292779.00078000.00000004.mdmp") Found URL "http://www2.public-trust.com/crl/ct/ctroot.crlcybertrust," - Source: "00000000-00000372.00000000.292779.00078000.00000004.mdmp") Found URL "https://wwww.certigna.fr/autorites/unitrust1%0" - Source: "00000000-00000372.00000000.292779.00078000.00000004.mdmp") Found URL "https://www.catcert.net/verarrel05'vegeu" - Source: "00000000-00000372.00000000.292779.0008C000.00000004.mdmp") Found URL "https://www.catcert.net/verarrel" - Source: "00000000-00000372.00000000.292779.0008C000.00000004.mdmp") Found URL "https://www.catcert.net/verarrel" - Source: "00000000-00000372.00000000.292779.0009C000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0digicert" - Source: "00000000-00000372.00000000.292779.000CC000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0us1" - Source: "00000000-00000372.00000000.292779.000CC000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crl0" - Source: "00000000-00000372.00000000.292779.000CC000.00000004.mdmp") Found URL "http://www2.public-trust.com/crl/ct/ctroot.crl0arizona1scottsdale1godaddy.com," - Source: "00000000-00000372.00000000.292779.000CC000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\ee1" - Source: "00000000-00000372.00000000.292779.000EC000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps4b]ztaathens1d0b;hellenic" - Source: "00000000-00000372.00000000.292779.00134000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crlzldap://directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist0c=http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl" - Source: "00000000-00000372.00000000.292779.00144000.00000004.mdmp") Found URL "http://crl.netsolssl.com/networksolutionscertificateauthority.crlwisekey1copyright" - Source: "00000000-00000372.00000000.292779.00178000.00000004.mdmp") Found URL "http://www.quovadis.bm.$t@$8=u6nyw1*yeix" - Source: "00000000-00000372.00000000.292779.0018C000.00000004.mdmp") Found URL "https://ocsp.quovadisoffshore.com0reliance" - Source: "00000000-00000372.00000000.292779.00278000.00000004.mdmp") Found URL "http://www.quovadis.bm0quovadis" - Source: "00000000-00000372.00000000.292779.00278000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00000372.00000000.292779.00278000.00000004.mdmp") Found URL "https://www.catcert.net/verarrel" - Source: "00000000-00000372.00000000.292779.002EC000.00000004.mdmp") Found URL "https://www.catcert.net/verarrel05'vegeu" - Source: "00000000-00000372.00000000.292779.002EC000.00000004.mdmp") Found URL "https://wwww.certigna.fr/autorites/0mf0d0/)http://crl.certigna.fr/certignarootca.crl01+http://crl.dhimyotis.com/certignarootca.crlankara1@0>7e-tura" - Source: "00000000-00000372.00000000.292779.002EC000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\7ko6gunrrabxw37ndj4ro1tgqikejanzz2zruyraqmvcy0m9ibwdr/gjqoc6oybtv8tywf2tlhllpwrn9m-----end" - Source: "00000000-00000372.00000000.292779.002EC000.00000004.mdmp") Found URL "http://policy.camerfirma.com----end" - Source: "00000000-00000372.00000000.292779.00304000.00000004.mdmp") Found URL "http://policy.camerfirma.comificate-----" - Source: "00000000-00000372.00000000.292779.00304000.00000004.mdmp") Found URL "http://www.accv.esfileeditviewwindowhelppl" - Source: "00000000-00000372.00000000.292779.003A4000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.es0$http://www.accv.es/legislacion_c.htm0un0l0jdhttp://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crl0accv@accv.eslqmvvkjmjuvvw9y4ayhqnxbxlfs1-----end" - Source: "00000000-00000372.00000000.292779.003A4000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.esd-trust" - Source: "00000000-00000372.00000000.292779.0052C000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crlbuypass" - Source: "00000000-00000372.00000000.292779.0052C000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/gebze" - Source: "00000000-00000372.00000000.292779.00544000.00000004.mdmp") Found URL "http://repository.swisssign.com/swisssign" - Source: "00000000-00000372.00000000.292779.0056C000.00000004.mdmp") Found URL "http://repository.swisssign.com/tw1" - Source: "00000000-00000372.00000000.292779.0056C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0milan1" - Source: "00000000-00000372.00000000.292779.0056C000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crlhttp_http_outgoing_http_clientwww.entrust.net/cps_2048" - Source: "00000000-00000372.00000000.292779.0080C000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl(c)" - Source: "00000000-00000372.00000000.292779.0080C000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0/0-!https://ocsp.quovadisoffshore.comwww.entrust.net/cps" - Source: "00000000-00000372.00000000.292779.0080C000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crlgo" - Source: "00000000-00000372.00000000.292779.0080C000.00000004.mdmp") Found URL "http://policy.camerfirma.com04020*0(http://policy.camerfirma.comizenpe" - Source: "00000000-00000372.00000000.292779.0080C000.00000004.mdmp") Found URL "https://www.catcert.net/verarrel" - Source: "00000000-00000372.00000000.292779.0080C000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/hellenic" - Source: "00000000-00000372.00000000.292779.0080C000.00000004.mdmp") Found URL "https://chrome.google.com/webstore?o" - Source: "00000000-00000372.00000000.292779.00880000.00000004.mdmp") Found URL "https://clients2.google.com/service/update2/crxalarmse0])e0])bluetoothprivateaudiocaptureaudioappviewapp.window.alwaysontopapp.window.alpha)59cfilesystem.directoryfilesystemapp.window.fullscreenfeedbackprivatedisplaysourcediagnosticsdeclarativewebrequestcrashreportprivateclipboardwriteclipboardreadclipboardcecprivatenetworkingprivatenetworking.oncnativemessagingmetricsprivatemediaperceptionprivateloginstateloginscreenuiloginscreenstorageloginlockscreenidleapp.window.imefilesystem.writeunlimitedstorageu2fdevicessystem.storagesystem.displaysystem.networksystem.memorysystem.cpustoragesocketserialprintingmetricsprintingprinterproviderpowernewtabpageoverridedevtoolsunlimited_storageoverrideescfullscreenfullscreenalwaysontopwindowsapp.window.shapewebviewdeclarativenetrequestwebrequestblockingwebrequestvpnprovidervirtualkeyboardvideocaptureusbdevicesmanagementresourcesprivateabledfield-trial-handletypecontent.mojom.childprocesshost" - Source: "00000000-00000372.00000000.292779.008C8000.00000004.mdmp") Found URL "https://issuehunt.io/r/boostio/boostnote.nexth]dg^g=9bh[m7e-tura" - Source: "00000000-00000372.00000001.294700.002EC000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\7ko6gunrrabxw37ndj4ro1tgqikejanzz2zruyraqmvcy0m9ibwdr/gjqoc6oybtv8tywf2tlhllpwrn9m-----end" - Source: "00000000-00000372.00000001.294700.002EC000.00000004.mdmp") Found URL "http://www.accv.esfileeditviewwindowhelppe=utility" - Source: "00000000-00000372.00000001.294700.003A4000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.es0$http://www.accv.es/legislacion_c.htm0un0l0jdhttp://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crl0accv@accv.eslqmvvkjmjuvvw9y4ayhqnxbxlfs1-----end" - Source: "00000000-00000372.00000001.294700.003A4000.00000004.mdmp") Found URL "http://www.iec.chiec" - Source: "00000000-00000372.00000001.294700.004E8000.00000004.mdmp") Found URL "http://www.iec.chdesc.iec" - Source: "00000000-00000372.00000001.294700.004E8000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.esd-trust" - Source: "00000000-00000372.00000001.294700.0052C000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crlbuypass" - Source: "00000000-00000372.00000001.294700.0052C000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/gebze" - Source: "00000000-00000372.00000001.294700.00544000.00000004.mdmp") Found URL "http://repository.swisssign.com/swisssign" - Source: "00000000-00000372.00000001.294700.0056C000.00000004.mdmp") Found URL "http://repository.swisssign.com/tw1" - Source: "00000000-00000372.00000001.294700.0056C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0milan1" - Source: "00000000-00000372.00000001.294700.0056C000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crlhttp_http_outgoing_http_clientwww.entrust.net/cps_2048" - Source: "00000000-00000372.00000001.294700.0080C000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl(c)" - Source: "00000000-00000372.00000001.294700.0080C000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0/0-!https://ocsp.quovadisoffshore.comwww.entrust.net/cps" - Source: "00000000-00000372.00000001.294700.0080C000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crlgo" - Source: "00000000-00000372.00000001.294700.0080C000.00000004.mdmp") Found URL "http://policy.camerfirma.com04020*0(http://policy.camerfirma.comizenpe" - Source: "00000000-00000372.00000001.294700.0080C000.00000004.mdmp") Found URL "https://www.catcert.net/verarrel" - Source: "00000000-00000372.00000001.294700.0080C000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/hellenic" - Source: "00000000-00000372.00000001.294700.0080C000.00000004.mdmp") Found URL "https://chrome.google.com/webstore?o" - Source: "00000000-00000372.00000001.294700.00880000.00000004.mdmp") Found URL "https://clients2.google.com/service/update2/crxalarmse0])e0])bluetoothprivateaudiocaptureaudioappviewapp.window.alwaysontopnetwork.mojom.networkservice" - Source: "00000000-00000372.00000001.294700.008C8000.00000004.mdmp") Found URL "http://www.iec.chiec" - Source: "00000000-00000372.00000001.294700.00930000.00000004.mdmp") Found URL "http://www.iec.chdesc.iec" - Source: "00000000-00000372.00000001.294700.00930000.00000004.mdmp") Found URL "https://issuehunt.io/r/boostio/boostnote.nexth]dg^g=9bh[m7e-tura" - Source: "00000000-00000372.00000002.296621.002EC000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\7ko6gunrrabxw37ndj4ro1tgqikejanzz2zruyraqmvcy0m9ibwdr/gjqoc6oybtv8tywf2tlhllpwrn9m-----end" - Source: "00000000-00000372.00000002.296621.002EC000.00000004.mdmp") Found URL "http://policy.camerfirma.com----end" - Source: "00000000-00000372.00000002.296621.00304000.00000004.mdmp") Found URL "http://policy.camerfirma.com10.0.22621.11943.003.00google" - Source: "00000000-00000372.00000002.296621.00304000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.esd-trust" - Source: "00000000-00000372.00000002.296621.0052C000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crlbuypass" - Source: "00000000-00000372.00000002.296621.0052C000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/gebze" - Source: "00000000-00000372.00000002.296621.00544000.00000004.mdmp") Found URL "http://repository.swisssign.com/swisssign" - Source: "00000000-00000372.00000002.296621.0056C000.00000004.mdmp") Found URL "http://repository.swisssign.com/tw1" - Source: "00000000-00000372.00000002.296621.0056C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0milan1" - Source: "00000000-00000372.00000002.296621.0056C000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crlhttp_http_outgoing_http_clientwww.entrust.net/cps_2048" - Source: "00000000-00000372.00000002.296621.0080C000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl(c)" - Source: "00000000-00000372.00000002.296621.0080C000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0/0-!https://ocsp.quovadisoffshore.comwww.entrust.net/cps" - Source: "00000000-00000372.00000002.296621.0080C000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crlgo" - Source: "00000000-00000372.00000002.296621.0080C000.00000004.mdmp") Found URL "http://policy.camerfirma.com04020*0(http://policy.camerfirma.comizenpe" - Source: "00000000-00000372.00000002.296621.0080C000.00000004.mdmp") Found URL "https://www.catcert.net/verarrel" - Source: "00000000-00000372.00000002.296621.0080C000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/hellenic" - Source: "00000000-00000372.00000002.296621.0080C000.00000004.mdmp") Found URL "https://chrome.google.com/webstore?o" - Source: "00000000-00000372.00000002.296621.00880000.00000004.mdmp") Found URL "https://clients2.google.com/service/update2/crxalarmse0])e0])bluetoothprivateaudiocaptureaudioappviewapp.window.alwaysontopnetwork.mojom.networkservice" - Source: "00000000-00000372.00000002.296621.008C8000.00000004.mdmp") Found URL "http://www.iec.chiec" - Source: "00000000-00000372.00000002.296621.00930000.00000004.mdmp") Found URL "http://www.iec.chdesc.iec" - Source: "00000000-00000372.00000002.296621.00930000.00000004.mdmp") Found URL "https://issuehunt.io/r/boostio/boostnote.nexth]dg^g=9bh[m.

" - Source: "00000000-00001392.00000001.296113.62960000.00000002.mdmp") Found URL "http://," - Source: "00000000-00001392.00000001.296113.62960000.00000002.mdmp") Found URL "http://example.com." - Source: "00000000-00001392.00000001.296113.62960000.00000002.mdmp") Found URL "https://support.google.com/chrome/answer/6098869" - Source: "00000000-00001392.00000001.296113.62960000.00000002.mdmp") Found URL "https://bugs.chromium.org/p/chromium/issues/entry?template=safety+tips+appeals.possible" - Source: "00000000-00001392.00000001.296113.62960000.00000002.mdmp") Found URL "https://bugs.chromium.org/p/chromium/issues/entry?template=safety+tips+appeals.computerdevicetabletverify" - Source: "00000000-00001392.00000001.296113.62960000.00000002.mdmp") Found URL "https://nodejs.org/download/release/v14.16.0/win-x64/node.libs2--debug-port'--debug=--debug-brk=?--inspect-brk=--inspect-brk-node=--inspect=--print" - Source: "00000000-00001392.00000002.298031.00048000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v14.16.0/node-v14.16.0.tar.gz" - Source: "00000000-00001392.00000002.298031.0006C000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v14.16.0/node-v14.16.0-headers.tar.gzhelp" - Source: "00000000-00001392.00000002.298031.0006C000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v14.16.0/win-x64/node.libs2--debug-port'--debug=--debug-brk=?--inspect-brk=--inspect-brk-node=--inspect=--print" - Source: "00000000-00003300.00000000.301130.00050000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v14.16.0/node-v14.16.0.tar.gz" - Source: "00000000-00003300.00000000.301130.00074000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v14.16.0/node-v14.16.0-headers.tar.gzhelp" - Source: "00000000-00003300.00000000.301130.00074000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v14.16.0/win-x64/node.libs2--debug-port'--debug=--debug-brk=?--inspect-brk=--inspect-brk-node=--inspect=--print" - Source: "00000000-00007504.00000000.293514.00054000.00000004.mdmp") Found URL "http://www.w3.org/tr/html4/strict.dtd'>" (Indicator: "HTTP/1.1"; Source: "00000000-00000372.00000001.294700.0014C000.00000004.mdmp, 00000000-00000372.00000002.296621.0014C000.00000004.mdmp")46:T712,Found string "NDOWS\system32\drivers\etc\hosts" (Indicator: "\system32\drivers\etc\hosts"; Source: "00000000-00000372.00000000.292779.00078000.00000004.mdmp, 00000000-00000372.00000001.294700.00078000.00000004.mdmp, 00000000-00000372.00000002.296621.00078000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\etc\hosts" (Indicator: "\system32\drivers\etc\hosts"; Source: "00000000-00000372.00000000.292779.00078000.00000004.mdmp, 00000000-00000372.00000001.294700.00078000.00000004.mdmp, 00000000-00000372.00000002.296621.00078000.00000004.mdmp") Found string "WS\system32\drivers\etc\hosts" (Indicator: "\system32\drivers\etc\hosts"; Source: "00000000-00000372.00000000.292779.00078000.00000004.mdmp, 00000000-00000372.00000001.294700.00078000.00000004.mdmp, 00000000-00000372.00000002.296621.00078000.00000004.mdmp, 00000000-00000372.00000002.296621.008C8000.00000004.mdmp") Found string "INDOWS\system32\drivers\etc\hosts" (Indicator: "\system32\drivers\etc\hosts"; Source: "00000000-00000372.00000002.296621.00078000.00000004.mdmp") Found string ":\windows\system32\drivers\etc\hosts" (Indicator: "\system32\drivers\etc\hosts"; Source: "00000000-00000372.00000002.296621.70FA0000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\etc\hosts" (Indicator: "\system32\drivers\etc\hosts"; Source: "00000000-00001392.00000000.294191.0006C000.00000004.mdmp, 00000000-00001392.00000001.296113.0006C000.00000004.mdmp, 00000000-00001392.00000002.298031.0006C000.00000004.mdmp") Found string "WS\system32\drivers\etc\hosts" (Indicator: "\system32\drivers\etc\hosts"; Source: "00000000-00001392.00000002.298031.0006C000.00000004.mdmp") Found string "indows\system32\drivers\etc\hosts" (Indicator: "\system32\drivers\etc\hosts"; Source: "00000000-00001392.00000002.298031.60840000.00000004.mdmp")47:T581,Found reference to API "7986742154,4348,3024,,RtlGetVersion,NTDLL.dll,"01:16:13.296",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00000372.00000000.292779.70FA0000.00000004.mdmp, 00000000-00000372.00000001.294700.70FA0000.00000004.mdmp") Found reference to API "8172397318,4348,3024,,RtlGetVersion,NTDLL.dll,"01:16:13.375",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00000372.00000000.292779.70FA0000.00000004.mdmp") Found reference to API "7986232820,4348,3025,,RtlGetNtProductType,NTDLL.dll,"01:16:13.296",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00000372.00000000.292779.70FA0000.00000004.mdmp, 00000000-00000372.00000001.294700.70FA0000.00000004.mdmp, 00000000-00000372.00000002.296621.70FA0000.00000004.mdmp") Found reference to API "52263638624,6224,3024,,RtlGetVersion,NTDLL.dll,"01:16:31.734",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00000372.00000001.294700.70FA0000.00000004.mdmp, 00000000-00000372.00000002.296621.70FA0000.00000004.mdmp") Found reference to API "128060326111,4348,3024,,RtlGetVersion,NTDLL.dll,"01:17:03.312",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00000372.00000002.296621.70FA0000.00000004.mdmp") Found reference to API "9376778251,6208,3024,,RtlGetVersion,NTDLL.dll,"01:16:35.906",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00001392.00000000.294191.60840000.00000004.mdmp")48:T446,"Certificado_20392302026.exe" called "FindFirstFileW" with parameter C:\Certificado_20392302026.en-US (UID: 00000000-00002196) "Certificado_20392302026.exe" called "FindFirstFileW" with parameter C:\Certificado_20392302026.en (UID: 00000000-00002196) "Certificado_20392302026.exe" called "FindFirstFileW" with parameter C:\Certificado_20392302026.ENU (UID: 00000000-00002196) "Certificado_20392302026.exe" called "FindFirstFileW" with parameter C:\Certificado_20392302026.EN (UID: 00000000-00002196) "Certificado_20392302026.tmp" called "FindFirstFileW" with parameter %TEMP%\is-PBGOKJDIR9.tmp\Certificado_20392302026.en-US (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "FindFirstFileW" with parameter %TEMP%\is-PBGOKJDIR9.tmp\Certificado_20392302026.en (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "FindFirstFileW" with parameter %TEMP%\is-PBGOKJDIR9.tmp\Certificado_20392302026.ENU (UID: 00000000-00005564) "Certificado_20392302026.tmp" called "FindFirstFileW" with parameter %TEMP%\is-PBGOKJDIR9.tmp\Certificado_20392302026.EN (UID: 00000000-00005564)49:Tf49,Found string "TChaCha20Ctx@" (Indicator: "chacha"; File: "Certificado_20392302026.exe") Found string "TChaCha20Context" (Indicator: "chacha"; File: "Certificado_20392302026.exe") Found string "D:\Coding\Is\issrc-build\Components\ChaCha20.pas" (Indicator: "chacha"; File: "Certificado_20392302026.exe") file/memory contains long string with (Indicator: "aes"; File: "MacUpdater.js.map") file/memory contains long string with (Indicator: "zipfile"; File: "MacUpdater.js.map") file/memory contains long string with (Indicator: "aes"; File: "Provider.js.map") file/memory contains long string with (Indicator: "aes"; File: "AppImageUpdater.js.map") file/memory contains long string with (Indicator: "aes"; File: "BaseUpdater.js.map") file/memory contains long string with (Indicator: "base64"; File: "windowsExecutableCodeSignatureVerifier.js") file/memory contains long string with (Indicator: "ToBase64String"; File: "windowsExecutableCodeSignatureVerifier.js") file/memory contains long string with (Indicator: "aes"; File: "electronHttpExecutor.js.map") Found string "base64Slice" (Indicator: "base64"; Source: "00000000-00000372.00000000.292779.00374000.00000004.mdmp, 00000000-00000372.00000001.294700.00374000.00000004.mdmp, 00000000-00000372.00000002.296621.00374000.00000004.mdmp") Found string "base64Write" (Indicator: "base64"; Source: "00000000-00000372.00000000.292779.00374000.00000004.mdmp, 00000000-00000372.00000001.294700.00374000.00000004.mdmp, 00000000-00000372.00000002.296621.00374000.00000004.mdmp") Found string "^[^/]+\/[^,;]+(?:[^,]*?)(;base64)?,([\s\S]*)$" (Indicator: "base64"; Source: "00000000-00000372.00000000.292779.003A4000.00000004.mdmp, 00000000-00000372.00000001.294700.003A4000.00000004.mdmp") Found string "base64Map" (Indicator: "base64"; Source: "00000000-00000372.00000000.292779.003B0000.00000004.mdmp, 00000000-00000372.00000001.294700.003B0000.00000004.mdmp, 00000000-00000372.00000002.296621.003B0000.00000004.mdmp") Found string "3desc" (Indicator: "3des"; Source: "00000000-00000372.00000001.294700.004E8000.00000004.mdmp, 00000000-00000372.00000001.294700.00930000.00000004.mdmp, 00000000-00000372.00000002.296621.00930000.00000004.mdmp") Found string "base64ByteLength" (Indicator: "base64"; Source: "00000000-00000372.00000002.296621.004BC000.00000004.mdmp") Found string "base64" (Indicator: "base64"; Source: "00000000-00000372.00000002.296621.004BC000.00000004.mdmp") Found string "base64.writea" (Indicator: "base64"; Source: "00000000-00000372.00000002.296621.004BC000.00000004.mdmp") Found string "base64.slicea" (Indicator: "base64"; Source: "00000000-00000372.00000002.296621.004BC000.00000004.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00000372.00000002.296621.08080000.00000004.mdmp") file/memory contains long string with (Indicator: "aes128"; Source: "00000000-00000372.00000002.296621.08080000.00000004.mdmp") file/memory contains long string with (Indicator: "aes256"; Source: "00000000-00000372.00000002.296621.08080000.00000004.mdmp") file/memory contains long string with (Indicator: "ecdsa"; Source: "00000000-00000372.00000002.296621.08080000.00000004.mdmp") Found string "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256" (Indicator: "aes"; Source: "00000000-00000372.00000002.296621.08080000.00000004.mdmp") Found string "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256" (Indicator: "chacha"; Source: "00000000-00000372.00000002.296621.08080000.00000004.mdmp") Found string "Z?aEsN" (Indicator: "aes"; Source: "00000000-00000372.00000002.296621.73130000.00000002.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00001392.00000001.296113.62960000.00000002.mdmp") file/memory contains long string with (Indicator: ".encrypt"; Source: "00000000-00001392.00000001.296113.62960000.00000002.mdmp")4a:T421,Found reference to API "7850149778,7884,3185,,GetAdaptersAddresses,Iphlpapi.dll,"01:16:13.234",RX=0,PX=0" (Indicator: "GetAdaptersAddresses"; Source: "00000000-00000372.00000000.292779.70FA0000.00000004.mdmp") Found reference to API "35060044505,2884,3185,,GetAdaptersAddresses,Iphlpapi.dll,"01:16:24.578",RX=0,PX=0" (Indicator: "GetAdaptersAddresses"; Source: "00000000-00000372.00000001.294700.70FA0000.00000004.mdmp") Found reference to API "87110652148,7652,3185,,GetAdaptersAddresses,Iphlpapi.dll,"01:16:46.250",RX=0,PX=0" (Indicator: "GetAdaptersAddresses"; Source: "00000000-00000372.00000002.296621.70FA0000.00000004.mdmp") Found reference to API "87128470786,2884,3185,,GetAdaptersAddresses,Iphlpapi.dll,"01:16:46.265",RX=0,PX=0" (Indicator: "GetAdaptersAddresses"; Source: "00000000-00000372.00000002.296621.70FA0000.00000004.mdmp") Found reference to API "87109575499,2884,3185,,GetAdaptersAddresses,Iphlpapi.dll,"01:16:46.250",RX=0,PX=0" (Indicator: "GetAdaptersAddresses"; Source: "00000000-00000372.00000002.296621.70FA0000.00000004.mdmp")4b:T4ca,Found reference to API "NtOpenThreadTokenEx" (Indicator: "NtOpenThreadToken"; Source: "00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "NtOpenProcessToken"; Source: "00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "NtOpenThreadToken"; Source: "00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "NtOpenProcessToken"; Source: "00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp")4c:T111a,file/memory contains long string with (Indicator: "password"; File: "Certificado_20392302026.exe") Found string "Please specify the password using the /PASSWORD= command line parameter." (Indicator: "password"; File: "Certificado_20392302026.exe") Found string "The password you specified is not correct. Please try again." (Indicator: "password"; File: "Certificado_20392302026.exe") Found string "passwordSubmit" (Indicator: "password"; Source: "00000000-00000372.00000000.292779.008C8000.00000004.mdmp, 00000000-00000372.00000001.294700.008C8000.00000004.mdmp, 00000000-00000372.00000002.296621.008C8000.00000004.mdmp") Found string "passwordPrompt" (Indicator: "password"; Source: "00000000-00000372.00000000.292779.008C8000.00000004.mdmp, 00000000-00000372.00000001.294700.008C8000.00000004.mdmp, 00000000-00000372.00000002.296621.008C8000.00000004.mdmp") Found string "passwordInvalid" (Indicator: "password"; Source: "00000000-00000372.00000000.292779.008C8000.00000004.mdmp, 00000000-00000372.00000001.294700.008C8000.00000004.mdmp, 00000000-00000372.00000002.296621.008C8000.00000004.mdmp") Found string "Incorrect password" (Indicator: "password"; Source: "00000000-00000372.00000000.292779.008C8000.00000004.mdmp, 00000000-00000372.00000001.294700.008C8000.00000004.mdmp, 00000000-00000372.00000002.296621.008C8000.00000004.mdmp") Found string "passwordDialogTitle" (Indicator: "password"; Source: "00000000-00000372.00000000.292779.008C8000.00000004.mdmp, 00000000-00000372.00000001.294700.008C8000.00000004.mdmp, 00000000-00000372.00000002.296621.008C8000.00000004.mdmp") Found string "enter a password." (Indicator: "password"; Source: "00000000-00000372.00000001.294700.00900000.00000004.mdmp, 00000000-00000372.00000002.296621.00900000.00000004.mdmp") Found string "This document is password protected. Please enter a password." (Indicator: "password"; Source: "00000000-00000372.00000001.294700.00900000.00000004.mdmp, 00000000-00000372.00000002.296621.00900000.00000004.mdmp") Found string "cannot-have-username-password-port" (Indicator: "password"; Source: "00000000-00000372.00000002.296621.0050C000.00000004.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00000372.00000002.296621.0050C000.00000004.mdmp") Found string "Manage passwords" (Indicator: "password"; Source: "00000000-00001392.00000001.296113.62960000.00000002.mdmp") Found string "Scan new cardShow all saved passwordsShow cards from your Google AccountAutofill" (Indicator: "password"; Source: "00000000-00001392.00000001.296113.62960000.00000002.mdmp") Found string "=1 {1 password (for $1)}" (Indicator: "password"; Source: "00000000-00001392.00000001.296113.62960000.00000002.mdmp") Found string "=2 {2 passwords (for $1)}" (Indicator: "password"; Source: "00000000-00001392.00000001.296113.62960000.00000002.mdmp") Found string "other {# passwords (for $1)}}{COUNT, plural," (Indicator: "password"; Source: "00000000-00001392.00000001.296113.62960000.00000002.mdmp") Found string "=1 {1 password (for $1, synced)}" (Indicator: "password"; Source: "00000000-00001392.00000001.296113.62960000.00000002.mdmp") Found string "=2 {2 passwords (for $1, synced)}" (Indicator: "password"; Source: "00000000-00001392.00000001.296113.62960000.00000002.mdmp") Found string "other {# passwords (for $1, synced)}}{COUNT, plural," (Indicator: "password"; Source: "00000000-00001392.00000001.296113.62960000.00000002.mdmp") Found string "=1 {1 password in your account (for $1)}" (Indicator: "password"; Source: "00000000-00001392.00000001.296113.62960000.00000002.mdmp") Found string "other {# passwords in your account (for $1)}}{COUNT, plural," (Indicator: "password"; Source: "00000000-00001392.00000001.296113.62960000.00000002.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00001392.00000001.296113.62960000.00000002.mdmp") Found string "=0 {A data breach on a site or app exposed your saved password for {0}. Chrome recommends changing your password on {0} now.}" (Indicator: "password"; Source: "00000000-00001392.00000001.296113.62960000.00000002.mdmp") Found string "=1 {A data breach on a site or app exposed your saved password for {0} and one other site. Chrome recommends checking your saved passwords now.}" (Indicator: "password"; Source: "00000000-00001392.00000001.296113.62960000.00000002.mdmp")4d:T2719,Found string "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Temp\is-PBGOKJDIR9.tmp\Certificado_20392302026.tmp" (Indicator: "\Device\"; Source: "00000000-00002196-00000BC0-3543722668") Found string "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\boosten.exe" (Indicator: "\Device\"; Source: "00000000-00005564-00000BC0-3569827770") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00000372.00000000.292779.00058000.00000004.mdmp, 00000000-00000372.00000000.292779.00118000.00000004.mdmp, 00000000-00000372.00000000.292779.70FA0000.00000004.mdmp, 00000000-00000372.00000000.292779.72D30000.00000004.mdmp, 00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000001.294700.70FA0000.00000004.mdmp, 00000000-00000372.00000001.294700.72D30000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00118000.00000004.mdmp, 00000000-00000372.00000002.296621.70FA0000.00000004.mdmp, 00000000-00000372.00000002.296621.72D30000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00000372.00000000.292779.00058000.00000004.mdmp, 00000000-00000372.00000000.292779.00118000.00000004.mdmp, 00000000-00000372.00000000.292779.70FA0000.00000004.mdmp, 00000000-00000372.00000000.292779.72D30000.00000004.mdmp, 00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000001.294700.70FA0000.00000004.mdmp, 00000000-00000372.00000001.294700.72D30000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00118000.00000004.mdmp, 00000000-00000372.00000002.296621.70FA0000.00000004.mdmp, 00000000-00000372.00000002.296621.72D30000.00000004.mdmp") Found string "NDOWS\system32\drivers\etc\hosts" (Indicator: "\drivers\"; Source: "00000000-00000372.00000000.292779.00078000.00000004.mdmp, 00000000-00000372.00000001.294700.00078000.00000004.mdmp, 00000000-00000372.00000002.296621.00078000.00000004.mdmp") Found string "NDOWS\system32\drivers\etc\hosts" (Indicator: "system32\drivers"; Source: "00000000-00000372.00000000.292779.00078000.00000004.mdmp, 00000000-00000372.00000001.294700.00078000.00000004.mdmp, 00000000-00000372.00000002.296621.00078000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\etc\hosts" (Indicator: "\drivers\"; Source: "00000000-00000372.00000000.292779.00078000.00000004.mdmp, 00000000-00000372.00000001.294700.00078000.00000004.mdmp, 00000000-00000372.00000002.296621.00078000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\etc\hosts" (Indicator: "system32\drivers"; Source: "00000000-00000372.00000000.292779.00078000.00000004.mdmp, 00000000-00000372.00000001.294700.00078000.00000004.mdmp, 00000000-00000372.00000002.296621.00078000.00000004.mdmp") Found string "NDOWS\system32\drivers\etc" (Indicator: "\drivers\"; Source: "00000000-00000372.00000000.292779.00078000.00000004.mdmp, 00000000-00000372.00000001.294700.00078000.00000004.mdmp, 00000000-00000372.00000002.296621.00078000.00000004.mdmp, 00000000-00000372.00000002.296621.008C8000.00000004.mdmp") Found string "NDOWS\system32\drivers\etc" (Indicator: "system32\drivers"; Source: "00000000-00000372.00000000.292779.00078000.00000004.mdmp, 00000000-00000372.00000001.294700.00078000.00000004.mdmp, 00000000-00000372.00000002.296621.00078000.00000004.mdmp, 00000000-00000372.00000002.296621.008C8000.00000004.mdmp") Found string "WS\system32\drivers\etc\hosts" (Indicator: "\drivers\"; Source: "00000000-00000372.00000000.292779.00078000.00000004.mdmp, 00000000-00000372.00000001.294700.00078000.00000004.mdmp, 00000000-00000372.00000002.296621.00078000.00000004.mdmp, 00000000-00000372.00000002.296621.008C8000.00000004.mdmp") Found string "WS\system32\drivers\etc\hosts" (Indicator: "system32\drivers"; Source: "00000000-00000372.00000000.292779.00078000.00000004.mdmp, 00000000-00000372.00000001.294700.00078000.00000004.mdmp, 00000000-00000372.00000002.296621.00078000.00000004.mdmp, 00000000-00000372.00000002.296621.008C8000.00000004.mdmp") Found string "C:\WINDOWS\system32\spool\drivers\color\sRGB Color Space Profile.icm" (Indicator: "\drivers\"; Source: "00000000-00000372.00000000.292779.0008C000.00000004.mdmp, 00000000-00000372.00000001.294700.0008C000.00000004.mdmp, 00000000-00000372.00000002.296621.0008C000.00000004.mdmp") Found string "NDOWS\system32\spool\drivers\color\sRGB Color Space Profile.icm" (Indicator: "\drivers\"; Source: "00000000-00000372.00000000.292779.0008C000.00000004.mdmp, 00000000-00000372.00000001.294700.0008C000.00000004.mdmp, 00000000-00000372.00000002.296621.0008C000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Users\HAPUBWS\AppData\Local\AutoMaxwareUltraPlusly\boosten.exe" (Indicator: "\Device\"; Source: "00000000-00000372.00000000.292779.70FA0000.00000004.mdmp, 00000000-00000372.00000001.294700.70FA0000.00000004.mdmp, 00000000-00000372.00000002.296621.70FA0000.00000004.mdmp") Found string ":\windows\system32\spool\drivers\color\photo.gmmp" (Indicator: "\drivers\"; Source: "00000000-00000372.00000000.292779.70FA0000.00000004.mdmp, 00000000-00000372.00000001.294700.70FA0000.00000004.mdmp") Found string ":\windows\system32\spool\drivers\color\d65.camp" (Indicator: "\drivers\"; Source: "00000000-00000372.00000000.292779.70FA0000.00000004.mdmp") Found string "??\C:\WINDOWS\system32\spool\drivers\color\Photo.gmmp" (Indicator: "\drivers\"; Source: "00000000-00000372.00000000.292779.70FA0000.00000004.mdmp") Found string ":\WINDOWS\system32\spool\drivers\color" (Indicator: "\drivers\"; Source: "00000000-00000372.00000000.292779.70FA0000.00000004.mdmp, 00000000-00000372.00000001.294700.70FA0000.00000004.mdmp, 00000000-00000372.00000002.296621.70FA0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000372.00000000.292779.70FA0000.00000004.mdmp, 00000000-00000372.00000001.294700.70FA0000.00000004.mdmp, 00000000-00000372.00000002.296621.70FA0000.00000004.mdmp") Found string "??\c:\windows\system32\spool\drivers\color\srgb color space profile.icm" (Indicator: "\drivers\"; Source: "00000000-00000372.00000000.292779.70FA0000.00000004.mdmp, 00000000-00000372.00000001.294700.70FA0000.00000004.mdmp, 00000000-00000372.00000002.296621.70FA0000.00000004.mdmp") Found string ":\WINDOWS\system32\spool\drivers\color\sRGB Colo" (Indicator: "\drivers\"; Source: "00000000-00000372.00000000.292779.70FA0000.00000004.mdmp, 00000000-00000372.00000001.294700.70FA0000.00000004.mdmp, 00000000-00000372.00000002.296621.70FA0000.00000004.mdmp") Found string "??\C:\WINDOWS\system32\spool\drivers\color\sRGB Color Space Profile.icm" (Indicator: "\drivers\"; Source: "00000000-00000372.00000001.294700.70FA0000.00000004.mdmp") Found string "INDOWS\system32\drivers\etc\hosts" (Indicator: "\drivers\"; Source: "00000000-00000372.00000002.296621.00078000.00000004.mdmp") Found string "INDOWS\system32\drivers\etc\hosts" (Indicator: "system32\drivers"; Source: "00000000-00000372.00000002.296621.00078000.00000004.mdmp") Found string "INDOWS\system32\spool\drivers\color\sRGB Color Space Profile.icm" (Indicator: "\drivers\"; Source: "00000000-00000372.00000002.296621.0008C000.00000004.mdmp") Found string ":\windows\system32\drivers\etc\hosts" (Indicator: "\drivers\"; Source: "00000000-00000372.00000002.296621.70FA0000.00000004.mdmp") Found string ":\windows\system32\drivers\etc\hosts" (Indicator: "system32\drivers"; Source: "00000000-00000372.00000002.296621.70FA0000.00000004.mdmp") Found string ":\windows\system32\drivers\etc" (Indicator: "\drivers\"; Source: "00000000-00000372.00000002.296621.70FA0000.00000004.mdmp") Found string ":\windows\system32\drivers\etc" (Indicator: "system32\drivers"; Source: "00000000-00000372.00000002.296621.70FA0000.00000004.mdmp") Found string "??\C:\WINDOWS\system32\drivers\etc" (Indicator: "\drivers\"; Source: "00000000-00000372.00000002.296621.70FA0000.00000004.mdmp") Found string "??\C:\WINDOWS\system32\drivers\etc" (Indicator: "system32\drivers"; Source: "00000000-00000372.00000002.296621.70FA0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001392.00000000.294191.00048000.00000004.mdmp, 00000000-00001392.00000000.294191.60840000.00000004.mdmp, 00000000-00001392.00000000.294191.626A0000.00000004.mdmp, 00000000-00001392.00000001.296113.00048000.00000004.mdmp, 00000000-00001392.00000001.296113.60840000.00000004.mdmp, 00000000-00001392.00000001.296113.626A0000.00000004.mdmp, 00000000-00001392.00000002.298031.00048000.00000004.mdmp, 00000000-00001392.00000002.298031.60840000.00000004.mdmp, 00000000-00001392.00000002.298031.626A0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001392.00000000.294191.00048000.00000004.mdmp, 00000000-00001392.00000000.294191.60840000.00000004.mdmp, 00000000-00001392.00000000.294191.626A0000.00000004.mdmp, 00000000-00001392.00000001.296113.00048000.00000004.mdmp, 00000000-00001392.00000001.296113.60840000.00000004.mdmp, 00000000-00001392.00000001.296113.626A0000.00000004.mdmp, 00000000-00001392.00000002.298031.00048000.00000004.mdmp, 00000000-00001392.00000002.298031.60840000.00000004.mdmp, 00000000-00001392.00000002.298031.626A0000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\etc\hosts" (Indicator: "\drivers\"; Source: "00000000-00001392.00000000.294191.0006C000.00000004.mdmp, 00000000-00001392.00000001.296113.0006C000.00000004.mdmp, 00000000-00001392.00000002.298031.0006C000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\etc\hosts" (Indicator: "system32\drivers"; Source: "00000000-00001392.00000000.294191.0006C000.00000004.mdmp, 00000000-00001392.00000001.296113.0006C000.00000004.mdmp, 00000000-00001392.00000002.298031.0006C000.00000004.mdmp")4e:Tb3b,"Certificado_20392302026.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IS-PBGOKJDIR9.TMP\CERTIFICADO_20392302026.TMP"; Value: "") "Certificado_20392302026.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\USERS\HAPUBWS\APPDATA\LOCAL\AUTOMAXWAREULTRAPLUSLY\BOOSTEN.EXE"; Value: "") "boosten.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "boosten.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "boosten.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "boosten.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "boosten.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "boosten.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "boosten.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "boosten.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "boosten.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "boosten.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "boosten.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "boosten.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "boosten.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")4f:T7b0,"libGLESv2.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\libGLESv2.dll]- [targetUID: 00000000-00007504] "boosten.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 12 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\boosten.exe]- [targetUID: 00000000-00000372] "vk_swiftshader.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\vk_swiftshader.dll]- [targetUID: 00000000-00005564] "d3dcompiler_47.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\d3dcompiler_47.dll]- [targetUID: 00000000-00007504] "libGLESv2_526df8.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\libGLESv2_526df8.dll]- [targetUID: 00000000-00005564] "ffmpeg.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\ffmpeg.dll]- [targetUID: 00000000-00000372] "vulkan-1.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\vulkan-1.dll]- [targetUID: 00000000-00005564] "libEGL_15e52e.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\libEGL_15e52e.dll]- [targetUID: 00000000-00005564] "libEGL.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\libEGL.dll]- [targetUID: 00000000-00007504] "Certificado_20392302026.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-PBGOKJDIR9.tmp\Certificado_20392302026.tmp]- [targetUID: 00000000-00002196] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00005564]50:Ta2e,Found string "GetLogicalProcessorInformation" (Source: Certificado_20392302026.exe, API is part of module: KERNELBASE.DLL) Found string "GetThreadPreferredUILanguages" (Source: Certificado_20392302026.exe, API is part of module: KERNELBASE.DLL) Found string "SetThreadPreferredUILanguages" (Source: Certificado_20392302026.exe, API is part of module: KERNELBASE.DLL) Found string "GetThreadUILanguage" (Source: Certificado_20392302026.exe, API is part of module: KERNELBASE.DLL) Found string "GetLongPathNameW" (Source: Certificado_20392302026.exe, API is part of module: KERNELBASE.DLL) Found string "SetEvent" (Source: Certificado_20392302026.exe, API is part of module: KERNELBASE.DLL) Found string "ResetEvent" (Source: Certificado_20392302026.exe, API is part of module: KERNELBASE.DLL) Found string "VariantChangeTypeEx" (Source: Certificado_20392302026.exe, API is part of module: OLEAUT32.DLL) Found string "VarNeg" (Source: Certificado_20392302026.exe, API is part of module: OLEAUT32.DLL) Found string "VarNot" (Source: Certificado_20392302026.exe, API is part of module: OLEAUT32.DLL) Found string "VarAdd" (Source: Certificado_20392302026.exe, API is part of module: OLEAUT32.DLL) Found string "VarSub" (Source: Certificado_20392302026.exe, API is part of module: OLEAUT32.DLL) Found string "VarMul" (Source: Certificado_20392302026.exe, API is part of module: OLEAUT32.DLL) Found string "VarDiv" (Source: Certificado_20392302026.exe, API is part of module: OLEAUT32.DLL) Found string "VarIdiv" (Source: Certificado_20392302026.exe, API is part of module: OLEAUT32.DLL) Found string "VarMod" (Source: Certificado_20392302026.exe, API is part of module: OLEAUT32.DLL) Found string "VarAnd" (Source: Certificado_20392302026.exe, API is part of module: OLEAUT32.DLL) Found string "VarOr" (Source: Certificado_20392302026.exe, API is part of module: OLEAUT32.DLL) Found string "VarXor" (Source: Certificado_20392302026.exe, API is part of module: OLEAUT32.DLL) Found string "VarCmp" (Source: Certificado_20392302026.exe, API is part of module: OLEAUT32.DLL) Found string "VarI4FromStr" (Source: Certificado_20392302026.exe, API is part of module: OLEAUT32.DLL) Found string "VarR4FromStr" (Source: Certificado_20392302026.exe, API is part of module: OLEAUT32.DLL) Found string "VarR8FromStr" (Source: Certificado_20392302026.exe, API is part of module: OLEAUT32.DLL) Found string "VarDateFromStr" (Source: Certificado_20392302026.exe, API is part of module: OLEAUT32.DLL) Found string "VarCyFromStr" (Source: Certificado_20392302026.exe, API is part of module: OLEAUT32.DLL)51:T847,"POST /e702da9c5a58/o/ HTTP/1.1 Content-Type: application/json Host: oficiospolicia.com Connection: close Transfer-Encoding: chunked" with payload::==> "["l67qno3o","hVJwiPTIEpM4QrW","teDq73p"]" HTTP/1.1 522 Date: Tue 17 Mar 2026 21:59:48 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: close Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=19277 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Server: cloudflare CF-RAY: 9ddf43d7bb767ab2-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6572726F7220636F64653A20353232....... "POST /e702da9c5a58/o/ HTTP/1.1 Content-Type: application/json Host: oficiospolicia.com Connection: close Transfer-Encoding: chunked" with payload::==> "["l67qno3o","hVJwiPTIEpM4QrW","teDq73p"]" HTTP/1.1 522 Date: Tue 17 Mar 2026 22:00:38 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: close Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=19611 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Server: cloudflare CF-RAY: 9ddf450c2a0349d2-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6572726F7220636F64653A20353232....... "POST /e702da9c5a58/o/ HTTP/1.1 Content-Type: application/json Host: oficiospolicia.com Connection: close Transfer-Encoding: chunked" with payload::==> "["l67qno3o","hVJwiPTIEpM4QrW","teDq73p"]" HTTP/1.1 522 Date: Tue 17 Mar 2026 22:01:27 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: close Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=19254 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Server: cloudflare CF-RAY: 9ddf46429a52cc90-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6572726F7220636F64653A20353232.......52:T7b0,"libGLESv2.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\libGLESv2.dll]- [targetUID: 00000000-00007504] "boosten.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 12 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\boosten.exe]- [targetUID: 00000000-00000372] "vk_swiftshader.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\vk_swiftshader.dll]- [targetUID: 00000000-00005564] "d3dcompiler_47.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\d3dcompiler_47.dll]- [targetUID: 00000000-00007504] "libGLESv2_526df8.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\libGLESv2_526df8.dll]- [targetUID: 00000000-00005564] "ffmpeg.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\ffmpeg.dll]- [targetUID: 00000000-00000372] "vulkan-1.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\vulkan-1.dll]- [targetUID: 00000000-00005564] "libEGL_15e52e.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\libEGL_15e52e.dll]- [targetUID: 00000000-00005564] "libEGL.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\libEGL.dll]- [targetUID: 00000000-00007504] "Certificado_20392302026.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-PBGOKJDIR9.tmp\Certificado_20392302026.tmp]- [targetUID: 00000000-00002196] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-38DALNPB3K.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00005564]53:T43b,"boosten.exe" called "Process32FirstW with parameter [System Process]" (UID: 00000000-00001392) "boosten.exe" called "Process32NextW with parameter System" (UID: 00000000-00001392) "boosten.exe" called "Process32NextW with parameter Registry" (UID: 00000000-00001392) "boosten.exe" called "Process32NextW with parameter smss.exe" (UID: 00000000-00001392) "boosten.exe" called "Process32NextW with parameter csrss.exe" (UID: 00000000-00001392) "boosten.exe" called "Process32NextW with parameter wininit.exe" (UID: 00000000-00001392) "boosten.exe" called "Process32NextW with parameter winlogon.exe" (UID: 00000000-00001392) "boosten.exe" called "Process32NextW with parameter services.exe" (UID: 00000000-00001392) "boosten.exe" called "Process32NextW with parameter lsass.exe" (UID: 00000000-00001392) "boosten.exe" called "Process32NextW with parameter svchost.exe" (UID: 00000000-00001392) "boosten.exe" called "Process32NextW with parameter fontdrvhost.exe" (UID: 00000000-00001392) "boosten.exe" called "Process32NextW with parameter dwm.exe" (UID: 00000000-00001392)54:T4d4,Dropped file: "json2xml.js" - Location: [%TEMP%\is-38DALNPB3K.tmp\json2xml.js]- [targetUID: 00000000-00005564] Dropped file: "windowsExecutableCodeSignatureVerifier.js" - Location: [%TEMP%\is-38DALNPB3K.tmp\windowsExecutableCodeSignatureVerifier.js]- [targetUID: 00000000-00005564] Dropped file: "node2json_str.js" - Location: [%TEMP%\is-38DALNPB3K.tmp\node2json_str.js]- [targetUID: 00000000-00005564] Dropped file: "packageJson.js" - Location: [%TEMP%\is-38DALNPB3K.tmp\packageJson.js]- [targetUID: 00000000-00005564] Dropped file: "node2json.js" - Location: [%TEMP%\is-38DALNPB3K.tmp\node2json.js]- [targetUID: 00000000-00005564] Dropped file: "packageJson.spec.js" - Location: [%TEMP%\is-38DALNPB3K.tmp\packageJson.spec.js]- [targetUID: 00000000-00005564] Dropped file: "json.js" - Location: [%TEMP%\is-38DALNPB3K.tmp\json.js]- [targetUID: 00000000-00005564] Dropped file: "output-json.js" - Location: [%TEMP%\is-38DALNPB3K.tmp\output-json.js]- [targetUID: 00000000-00005564] Dropped file: "output-json-sync.js" - Location: [%TEMP%\is-38DALNPB3K.tmp\output-json-sync.js]- [targetUID: 00000000-00005564] Dropped file: "jsonfile.js" - Location: [%TEMP%\is-38DALNPB3K.tmp\jsonfile.js]- [targetUID: 00000000-00005564]55:T739,"Certificado_20392302026.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-PBGOKJDIR9.tmp\Certificado_20392302026.tmp" (Handle: 592) "boosten.exe" wrote 000011C0 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\boosten.exe" (Handle: 1704) "boosten.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\boosten.exe" (Handle: 1704) "boosten.exe" wrote 000000BC bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\boosten.exe" (Handle: 1704) "boosten.exe" wrote 00000020 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\boosten.exe" (Handle: 1704) "boosten.exe" wrote 00000010 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\boosten.exe" (Handle: 1704) "boosten.exe" wrote 000000D8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\boosten.exe" (Handle: 1704) "boosten.exe" wrote 000000C0 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\boosten.exe" (Handle: 1704) "boosten.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\boosten.exe" (Handle: 1704) "boosten.exe" wrote 000011C0 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\boosten.exe" (Handle: 2000) "boosten.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\boosten.exe" (Handle: 2000) "boosten.exe" wrote 000011C0 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\boosten.exe" (Handle: 1344) "boosten.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\AutoMaxwareUltraPlusly\boosten.exe" (Handle: 1344)56:T8be,Spawned process "Certificado_20392302026.exe" (UID: 00000000-00002196) Spawned process "Certificado_20392302026.tmp" with commandline "/SL5="$7031A 70433714 893440 C:\\Certificado_20392302026.exe"" (UID: 00000000-00005564) Spawned process "boosten.exe" (UID: 00000000-00000372) Spawned process "boosten.exe" with commandline "--type=gpu-process --field-trial-handle=1528,10361849404774865725,17333420879949050146,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1548 /prefetch:2" (UID: 00000000-00007504) Spawned process "boosten.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1528,10361849404774865725,17333420879949050146,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1932 /prefetch:8" (UID: 00000000-00001392) Spawned process "boosten.exe" with commandline "--type=gpu-process --field-trial-handle=1528,10361849404774865725,17333420879949050146,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22621.1194 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1500 /prefetch:2" (UID: 00000000-00003300)57:T42c,Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00000492.00000000.152536.00662000.00000004.mdmp, 00000000-00000492.00000002.156375.00662000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00000492.00000000.152536.00662000.00000004.mdmp, 00000000-00000492.00000002.156375.00662000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00000492.00000000.152536.00662000.00000004.mdmp, 00000000-00000492.00000002.156375.00662000.00000004.mdmp") Found reference to API "function FindWindowByWindowName(const WindowName: String): HWND;" (Indicator: "FindWindow"; Source: "00000000-00000492.00000000.152536.04D20000.00000004.mdmp, 00000000-00000492.00000001.154458.04D20000.00000004.mdmp") Found reference to API "function FindWindowByClassName(const ClassName: String): HWND;" (Indicator: "FindWindow"; Source: "00000000-00000492.00000000.152536.04D20000.00000004.mdmp, 00000000-00000492.00000001.154458.04D20000.00000004.mdmp")58:Taec,Dropped file: "boosten.exe" - Location: [%LOCALAPPDATA%\AutoMaxwareUltraPlusly\boosten.exe]- [targetUID: 00000000-00004836] Dropped file: "vk_swiftshader.dll" - Location: [%LOCALAPPDATA%\AutoMaxwareUltraPlusly\vk_swiftshader.dll]- [targetUID: 00000000-00000492] Dropped file: "libGLESv2.dll" - Location: [%LOCALAPPDATA%\AutoMaxwareUltraPlusly\swiftshader\libGLESv2.dll]- [targetUID: 00000000-00000492] Dropped file: "ffmpeg.dll" - Location: [%LOCALAPPDATA%\AutoMaxwareUltraPlusly\ffmpeg.dll]- [targetUID: 00000000-00004836] Dropped file: "libEGL.dll" - Location: [%LOCALAPPDATA%\AutoMaxwareUltraPlusly\swiftshader\libEGL.dll]- [targetUID: 00000000-00000492] Dropped file: "LICENSES.chromium.html" - Location: [%LOCALAPPDATA%\AutoMaxwareUltraPlusly\LICENSES.chromium.html]- [targetUID: 00000000-00000492] Dropped file: "MacUpdater.js.map" - Location: [%LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\node_modules\electron-updater\out\MacUpdater.js.map]- [targetUID: 00000000-00000492] Dropped file: "Provider.js.map" - Location: [%LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\node_modules\electron-updater\out\providers\Provider.js.map]- [targetUID: 00000000-00000492] Dropped file: "AppImageUpdater.js.map" - Location: [%LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\node_modules\electron-updater\out\AppImageUpdater.js.map]- [targetUID: 00000000-00000492] Dropped file: "BaseUpdater.js.map" - Location: [%LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\node_modules\electron-updater\out\BaseUpdater.js.map]- [targetUID: 00000000-00000492] Dropped file: "util.js.map" - Location: [%LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\node_modules\electron-updater\out\util.js.map]- [targetUID: 00000000-00000492] Dropped file: "index.js.map" - Location: [%LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\node_modules\builder-util-runtime\out\index.js.map]- [targetUID: 00000000-00000492] Dropped file: "node2json.js" - Location: [%LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\node_modules\fast-xml-parser\src\node2json.js]- [targetUID: 00000000-00000492] Dropped file: "index.html" - Location: [%LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\compiled\index.html]- [targetUID: 00000000-00000492] Dropped file: "NoOpLogger.js.map" - Location: [%LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\node_modules\electron-updater\out\NoOpLogger.js.map]- [targetUID: 00000000-00000492] Dropped file: "output-json-sync.js" - Location: [%LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\node_modules\fs-extra\lib\json\output-json-sync.js]- [targetUID: 00000000-00000492] Dropped file: "jsonfile.js" - Location: [%LOCALAPPDATA%\AutoMaxwareUltraPlusly\resources\app\node_modules\fs-extra\lib\json\jsonfile.js]- [targetUID: 00000000-00000492]59:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP//////////////////AAD//////////////////wAA//////////////////8AAP//////////////////AAD//////////////////wAA//////////////////8AAP//////////////////AAD///////+Hj////3d3/wAA///////4Zmj///93d/8AAP//////hmZmj///////AAD/////+GZmZmj//////wAAAAAAAHZmBgZmcAAAAAAAAAAAAABmYAYAZmAAAAAAAAAAAAAGZgAGAAZmAAAAAAAAAAAAZmAABgAAZmAAAAAAAAAABmYAAAYAAAZmAAAAAAAAAABgAAAGAAAAYAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAYAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAYAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAYAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////4AAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYACgAH/xsf//47j//8e8f/+Pvj//379///+/////v////7////+/////v////7////+/////v////7////+/////v///////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"2336ef2777274c5ebffa98e86a6085d8de354267fe85f9ee9ea74fd92c051724","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790703179627,"unified_at":"2026-09-29T17:32:59.627Z","metadata":{"hashes":{"sha256":"2336ef2777274c5ebffa98e86a6085d8de354267fe85f9ee9ea74fd92c051724","sha1":"35f31963b792e30a5b75474112bf388d15533219","md5":"3dd68f18d6ce7e157ae6210ab06d640f","sha512":"af0f6c51d21a37a1a69f8da952bfeea3227fa5182eebb6c7e067cd39609f331572d454a4b2eaeeeb0d7355830297a088641b05838b931846fd79d1be6af44b80","ssdeep":"1572864:Sibp32FzeZjKmqyQvJOhcnU3LODgOlh2C5xIme:mFCWm4hG4U3L3OOT","ssdeep_chunks":["1572864:Sibp32F","1572864:ibp32Fz","1572864:bp32Fze","1572864:p32FzeZ","1572864:32FzeZj","1572864:2FzeZjK","1572864:FzeZjKm","1572864:zeZjKmq","1572864:eZjKmqy","1572864:ZjKmqyQ","1572864:jKmqyQv","1572864:KmqyQvJ","1572864:mqyQvJO","1572864:qyQvJOh","1572864:yQvJOhc","1572864:QvJOhcn","1572864:vJOhcnU","1572864:JOhcnU3","1572864:OhcnU3L","1572864:hcnU3LO","1572864:cnU3LOD","1572864:nU3LODg","1572864:U3LODgO","1572864:3LODgOl","1572864:LODgOlh","1572864:ODgOlh2","1572864:DgOlh2C","1572864:gOlh2C5","1572864:Olh2C5x","1572864:lh2C5xI","1572864:h2C5xIm","1572864:2C5xIme","3145728:Sibp32F","3145728:ibp32Fz","3145728:bp32Fze","3145728:p32FzeZ","3145728:32FzeZj","3145728:2FzeZjK","3145728:FzeZjKm","3145728:zeZjKmq","3145728:eZjKmqy","3145728:ZjKmqyQ","3145728:jKmqyQv","3145728:KmqyQvJ","3145728:mqyQvJO","3145728:qyQvJOh","3145728:yQvJOhc","3145728:QvJOhcn","3145728:vJOhcnU","3145728:JOhcnU3","3145728:OhcnU3L","3145728:hcnU3LO","3145728:cnU3LOD","3145728:nU3LODg","3145728:U3LODgO","3145728:3LODgOl","3145728:LODgOlh","3145728:ODgOlh2","3145728:DgOlh2C","3145728:gOlh2C5","3145728:Olh2C5x","3145728:lh2C5xI","3145728:h2C5xIm","3145728:2C5xIme","1572864:mFCWm4h","1572864:FCWm4hG","1572864:CWm4hG4","1572864:Wm4hG4U","1572864:m4hG4U3","1572864:4hG4U3L","1572864:hG4U3L3","1572864:G4U3L3O","1572864:4U3L3OO","1572864:U3L3OOT"],"imphash":"Unknown"},"file_info":{"file_name":"Certificado_20392302026.exe","file_type":["compressed","innosetup"],"file_type_id":"innosetup","file_size":71705352,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1773781252000,"last_seen":1773784661000,"last_multi_scan":1773784661000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["wacatac","phonzy","wacapew","malicious","new_domain"]},"stats":{"av":{"malicious_count":2,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":82},"sandbox_signatures":{"informative_count":192,"suspicious_count":19,"malicious_count":5,"total":216},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"TrojanDldr.OffLoader.gen.mgln","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.DelphGen.JIR","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"TrojanDldr.OffLoader.gen","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"malicious","value":"Recently registered domain detected"},{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Tries to save executable or command in registry"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Persistence","technique":"Installer Packages","attack_id":"T1546.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/016","identifiers":[{"type":"informative","value":"Attempts to launch the Installer package binary"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"},{"type":"informative","value":"Possible DLL sideloading"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Contains a Wine emulator-related string"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Able to decrypt/decode data"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"suspicious","value":"Drops PE files with different extensions"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Creates file in AppData directory"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Queries volume information"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"suspicious","value":"Attempts to retrieve geographical location information"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"},{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Creates directory on disk"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"suspicious","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"suspicious","value":"Command line contains long Base64-encoded string"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains reference to OpenSSL library string"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops script files inside temp directory"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"},{"type":"malicious","value":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"},{"type":"informative","value":"References hosts file in file/memory"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"suspicious","value":"Writes multiple files with double extensions (often indicator of ransomware infection)"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"The input sample dropped a large number of files"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"},{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"NtOpenThreadTokenEx\" (Indicator: \"OpenThread\"; Source: \"00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp\")\n Found reference to API \"NtOpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp\")\n Found reference to API \"NtOpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"Certificado_20392302026.exe\" called \"FindResourceW\" with parameter \"11111\" - (UID: 00000000-00002196)\n \"Certificado_20392302026.tmp\" called \"FindResourceW\" with parameter \"46961740\" - (UID: 00000000-00005564)\n \"boosten.exe\" called \"FindResourceW\" with parameter \"1\" - (UID: 00000000-00000372)\n \"boosten.exe\" called \"FindResourceW\" with parameter \"29100\" - (UID: 00000000-00000372)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"Certificado_20392302026.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '14710320'}\" (UID: 00000000-00002196)\n \"Certificado_20392302026.tmp\" called \"LoadResource with parameter {'hModule': '9437184', 'hResInfo': '13741712'}\" (UID: 00000000-00005564)\n \"boosten.exe\" called \"LoadResource with parameter {'hModule': '140701445521408', 'hResInfo': '140701579299584'}\" (UID: 00000000-00000372)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; File: \"Certificado_20392302026.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"NtOpenThreadTokenEx\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp\")\n Found reference to API \"NtOpenProcessTokenEx\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp\")\n Found reference to API \"NtOpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryEx failed\" (Indicator: \"LoadLibrary\"; File: \"Certificado_20392302026.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"file/memory contains long string with (Indicator: \"ConvertTo-Json\"; File: \"windowsExecutableCodeSignatureVerifier.js\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"SHA384\"; Source: \"00000000-00000372.00000002.296621.08080000.00000004.mdmp\")\n Found reference to \"TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256\" (Indicator: \"SHA384\"; Source: \"00000000-00000372.00000002.296621.08080000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005564.00000002.294947.00CCC000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$27","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"boosten.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at E7EB0000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$28","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$29","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"Certificado_20392302026.tmp\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"Certificado_20392302026.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"StringFromCharCode\" (Indicator: \"fromcharcode\"; Source: \"00000000-00000372.00000000.292779.00498000.00000004.mdmp\")\n Found reference to API \"fromCharCodeM\"\" (Indicator: \"fromcharcode\"; Source: \"00000000-00000372.00000002.296621.08200000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00000372.00000000.292779.70FA0000.00000004.mdmp, 00000000-00000372.00000001.294700.70FA0000.00000004.mdmp, 00000000-00000372.00000002.296621.70FA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"TStrongRandom: BCryptGenRandom failed (0x%x)\" (Indicator: \"BCryptGenRandom\"; File: \"Certificado_20392302026.exe\")\n Found api reference \"TStrongRandom: BCryptGenRandom failed (0x%x)\" (Indicator: \"CryptGenRandom\"; File: \"Certificado_20392302026.exe\")\n Found api reference \"TStrongRandom: Failed to get address of BCryptGenRandom\" (Indicator: \"BCryptGenRandom\"; File: \"Certificado_20392302026.exe\")\n Found api reference \"TStrongRandom: Failed to get address of BCryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"Certificado_20392302026.exe\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00000372.00000000.292779.70FA0000.00000004.mdmp, 00000000-00000372.00000001.294700.70FA0000.00000004.mdmp, 00000000-00000372.00000002.296621.70FA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2a","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Able to import cryptographic keys (seen in ransomware)\n Matched sigs: Command line contains long Base64-encoded string\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Able to decrypt/decode data\n Matched sigs: YARA signature match – Encryption algorithm\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2b","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"github.com\"; File: \"MacUpdater.js.map\")\n file/memory contains long string with (Indicator: \"github.com\"; File: \"AppImageUpdater.js.map\")\n file/memory contains long string with (Indicator: \"github.com\"; File: \"windowsExecutableCodeSignatureVerifier.js\")\n file/memory contains long string with (Indicator: \"github.com\"; File: \"electronHttpExecutor.js.map\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000372-00000C2C-3571288177\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000372-00000C2C-3571288177\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"_setup64.tmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"Certificado_20392302026.exe\")\n file/memory contains long string with (Indicator: \"AllocateAndInitializeSid\"; File: \"_setup64.tmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"Certificado_20392302026.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"Certificado_20392302026.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoReqWrap\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00000372.00000002.296621.003BC000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"8238833817,4132,115,,GetMonitorInfoW,user32.dll,\"01:16:13.406\",RX=0,PX=0\" in \"00000000-00000372.00000000.292779.70FA0000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"Certificado_20392302026.exe\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00000372-00000C2C-3571877185\")\n Found reference to API \"postMessage\" (Indicator: \"postmessage\"; Source: \"00000000-00000372.00000000.292779.08080000.00000004.mdmp, 00000000-00000372.00000001.294700.08080000.00000004.mdmp, 00000000-00000372.00000002.296621.08080000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"boosten.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00000372)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"Certificado_20392302026.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002196)\n \"Certificado_20392302026.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00002196)\n \"Certificado_20392302026.tmp\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00005564)\n \"Certificado_20392302026.tmp\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00005564)\n \"Certificado_20392302026.tmp\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005564)\n \"Certificado_20392302026.tmp\" called \"QueryPerformanceCounter\" (UID: 00000000-00005564)\n \"boosten.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00000372)\n \"boosten.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00000372)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"Certificado_20392302026.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002196)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"boosten.exe\" called \"IsWow64Process\" with parameter \"372\" - (UID: 00000000-00000372)\n \"boosten.exe\" called \"IsWow64Process\" with parameter \"7504\" - (UID: 00000000-00007504)\n \"boosten.exe\" called \"IsWow64Process\" with parameter \"1392\" - (UID: 00000000-00001392)\n \"boosten.exe\" called \"IsWow64Process\" with parameter \"3300\" - (UID: 00000000-00003300)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"Certificado_20392302026.tmp\" called \"EnumWindows\" with parameter \"5240468\" - (UID: 00000000-00005564)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"Certificado_20392302026.tmp\" called \"GetActiveWindow\" (UID: 00000000-00005564)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Certificado_20392302026.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002196)\n \"Certificado_20392302026.tmp\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005564)\n \"boosten.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000372)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"Certificado_20392302026.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002196)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Contains a Wine emulator-related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\"; File: \"Certificado_20392302026.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":5,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Certificado_20392302026.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Certificado_20392302026.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"Certificado_20392302026.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Certificado_20392302026.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"boosten.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"boosten.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: Certificado_20392302026.exe","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Creates file in AppData directory","description":"\"boosten.exe\" writes to a file \"%APPDATA%\\temp.txt\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-322","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %LOCALAPPDATA%\\AUTOMAXWAREULTRAPLUSLY\\SWIFTSHADER\\LIBGLESV2.DLL\n D3DCOMPILER_47.DLL\n %LOCALAPPDATA%\\AUTOMAXWAREULTRAPLUSLY\\SWIFTSHADER\\LIBEGL.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"Certificado_20392302026.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")\n \"Certificado_20392302026.tmp\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"boosten.exe\" queries volume information of \"C:\\\" at 00000000-00000372-00000C17-3572388154\n \"boosten.exe\" queries volume information of \"C:\\\" at 00000000-00000372-00000C17-3572429201","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Certificado_20392302026.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Certificado_20392302026.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"boosten.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"_setup64.tmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"$30","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$31","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"Certificado_20392302026.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\is-PBGOKJDIR9.tmp\\Certificado_20392302026.tmp\" /SL5=\"$7031A\n70433714\n893440\nC:\\Certificado_20\" - (UID: 00000000-00002196), \"Certificado_20392302026.tmp\" called \"CreateProcessW\" with parameter \"\"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\boosten.exe\"\" - (UID: 00000000-00005564), \"boosten.exe\" called \"CreateProcessW\" with parameter \"\"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\boosten.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService\" - (UID: 00000000-00000372), \"boosten.exe\" called \"CreateProcessW\" with parameter \"\"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\boosten.exe\" --type=gpu-process --field-trial-handle=1528\n10361849404774865\" - (UID: 00000000-00000372)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"boosten.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\mojo.372.3084.4933576897186665892\" - (UID: 00000000-00000372)\n \"boosten.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\mojo.372.3084.15722411674982097320\" - (UID: 00000000-00000372)\n \"boosten.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\mojo.372.3084.4048354836079393760\" - (UID: 00000000-00000372)\n \"boosten.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\mojo.372.3084.12392617998749887\" - (UID: 00000000-00000372)\n \"boosten.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\mojo.372.3084.233555069607852517\" - (UID: 00000000-00000372)\n \"boosten.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\mojo.372.3084.12521501588355689063\" - (UID: 00000000-00000372)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"oficiospolicia.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.21.67.57:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"52265536789,6224,3143,,CreateProcessW,kernel32.dll,\"01:16:31.734\",RX=0,PX=0\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000372.00000001.294700.70FA0000.00000004.mdmp, 00000000-00000372.00000002.296621.70FA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"NtOpenFile\" (Indicator: \"NtOpenFile\"; Source: \"00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp\")\n Found reference to API \"NtCreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp\")\n Found reference to API \"NtCreateFile\" (Indicator: \"NtCreateFile\"; Source: \"00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"8052848480,4348,3140,,FindResourceW,kernel32.dll,\"01:16:13.328\",RX=0,PX=0\" (Indicator: \"FindResource\"; Source: \"00000000-00000372.00000000.292779.70FA0000.00000004.mdmp, 00000000-00000372.00000001.294700.70FA0000.00000004.mdmp, 00000000-00000372.00000002.296621.70FA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"NtOpenThreadTokenEx\" (Indicator: \"OpenThread\"; Source: \"00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp\")\n Found reference to API \"NtOpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp\")\n Found reference to API \"NtOpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"NtOpenProcessTokenEx\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp\")\n Found reference to API \"NtOpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp\")\n Found reference to API \"tOpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000372.00000001.294700.70FA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$34","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"$35","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$36","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$37","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"boosten.exe\" failed to load missing module \"D3DCompiler_47.dll\" - [base:0; Status:c000000d]\n \"boosten.exe\" failed to load missing module \"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\swiftshader\\libGLES_CM.dll\" - [base:0; Status:c0000135]\n \"boosten.exe\" failed to load missing module \"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\swiftshader\\libGLES_CM_translator.dll\" - [base:0; Status:c0000135]\n \"boosten.exe\" failed to load missing module \"d3d11.dll\" - [base:0; Status:c000000d]\n \"boosten.exe\" failed to load missing module \"d3d12.dll\" - [base:0; Status:c000000d]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$38","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"info@e-szigno.hu\"\n Pattern match: \"info@izenpe.com\"\n Pattern match: \"pki@sk.ee\"\n Pattern match: \"a@ol.numtasksbeforedetach.browser.background\"\n Pattern match: \"ec_acc@catcert.net\"\n Pattern match: \"fluke8259@gmail.com\"\n Pattern match: \"accv@accv.eslqmvvkjm\"\n Pattern match: \"accv@accv.es\"\n Pattern match: \"i@mojom.backgroundtracingagentprovider\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) BoostNote-Local/0.23.0 Chrome/89.0.4389.128 Electron/12.0.14 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00000372.00000001.294700.003A4000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\mojo.372.3084.4933576897186665892\n Found string - \\\\.\\pipe\\mojo.372.3084.15722411674982097320\n Found string - \\\\.\\pipe\\mojo.372.3084.4048354836079393760\n Found string - \\\\.\\pipe\\mojo.372.3084.12392617998749887\n Found string - \\\\.\\pipe\\mojo.372.3084.233555069607852517\n Found string - \\\\.\\pipe\\mojo.372.3084.12521501588355689063","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$39","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Certificado_20392302026.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 731C0000\n \"Certificado_20392302026.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75F80000\n \"Certificado_20392302026.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75F80000\n \"Certificado_20392302026.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 731C0000\n \"boosten.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at F2EE0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Certificado_20392302026.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75E20000\n \"Certificado_20392302026.tmp\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75E20000\n \"boosten.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at F3D70000\n \"boosten.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 60BF0000\n \"boosten.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at ED3A0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a00000000002042a8f2fb7f0000@ntdll.dll\"\n \"22002300000000004042a8f2fb7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$3b","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"boosten.exe\" touched \"TF_ThreadMgr\" (Path: \"HKCU\\CLSID\\{529A9E6B-6587-4F23-AB9E-9C7D683E3C50}\")\n \"boosten.exe\" touched \"TF_CategoryMgr\" (Path: \"HKCU\\CLSID\\{A4B544A1-438D-4B41-9325-869523E2D6C7}\\TREATAS\")\n \"boosten.exe\" touched \"TF_DisplayAttributeMgr\" (Path: \"HKCU\\CLSID\\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\\TREATAS\")\n \"boosten.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{144C71F2-7F10-4AB2-BB07-C38F5B9AE05E}\\TREATAS\")\n \"boosten.exe\" touched \"MMDeviceEnumerator class\" (Path: \"HKCU\\CLSID\\{BCDE0395-E52F-467C-8E3D-C4579291692E}\\TREATAS\")\n \"boosten.exe\" touched \"Windows.Media\" (Path: \"HKCU\\CLSID\\{0B4C227F-2394-43FF-BA59-BC762F5C46EA}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"Certificado_20392302026.tmp\" (UID: 00000000-00005564) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-8LD9T6N\"\"\n Process \"Certificado_20392302026.tmp\" (UID: 00000000-00005564) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"boosten.exe\" (UID: 00000000-00007504) was launched with new environment variables: \"ORIGINAL_XDG_CURRENT_DESKTOP=\"undefined\"\"\n Process \"boosten.exe\" (UID: 00000000-00007504) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"boosten.exe\" (UID: 00000000-00007504) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"oficiospolicia.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"Certificado_20392302026.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"Certificado_20392302026.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Certificado_20392302026.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"Certificado_20392302026.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"Certificado_20392302026.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Certificado_20392302026.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"boosten.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"boosten.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"boosten.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"LOCALENAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"file/memory contains long string with (Indicator: \"text/javascript\"; File: \"index.html\")","origin":"File/Memory","mitre_attack_id":"T1059.007","relevance":1,"id":"string-626","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\bcrypt.dll\" [Source: 00000000-00002196-00000C2B-3543100161]\n Observed system executable string:\"%WINDIR%\\system32\\shell32.dll\" [Source: 00000000-00005564-00000C2B-3545105837]\n Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00005564-00000C2B-3545231923]\n Observed system executable string:\"%WINDIR%\\system32\\shfolder.dll\" [Source: 00000000-00005564-00000C2B-3545756440]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"Certificado_20392302026.tmp\" with commandline \"/SL5=\"$7031A\n70433714\n893440\nC:\\\\Certificado_20392302026.exe\"\" (UID: 00000000-00005564)\n Spawned process \"boosten.exe\" (UID: 00000000-00000372)\n Spawned process \"boosten.exe\" with commandline \"--type=gpu-process --field-trial-handle=1528,1036184940477486572 ...\" (UID: 00000000-00007504)\n Spawned process \"boosten.exe\" with commandline \"--type=utility --utility-sub-type=network.mojom.NetworkService - ...\" (UID: 00000000-00001392)\n Spawned process \"boosten.exe\" with commandline \"--type=gpu-process --field-trial-handle=1528,1036184940477486572 ...\" (UID: 00000000-00003300)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"Certificado_20392302026.tmp\" with commandline \"/SL5=\"$7031A\n70433714\n893440\nC:\\\\Certificado_20392302026.exe\"\" (UID: 00000000-00005564)\n Spawned process \"boosten.exe\" (UID: 00000000-00000372)\n Spawned process \"boosten.exe\" with commandline \"--type=gpu-process --field-trial-handle=1528,1036184940477486572 ...\" (UID: 00000000-00007504)\n Spawned process \"boosten.exe\" with commandline \"--type=utility --utility-sub-type=network.mojom.NetworkService - ...\" (UID: 00000000-00001392)\n Spawned process \"boosten.exe\" with commandline \"--type=gpu-process --field-trial-handle=1528,1036184940477486572 ...\" (UID: 00000000-00003300)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=E8, O=Let's Encrypt, C=US\" (SHA1: E2:FD:D4:10:89:48:65:B3:2D:3F:8F:EC:2F:99:36:F5:BF:92:FD:A3; see report for more information)\n The input sample is signed with a certificate issued by \"CN=ISRG Root X1, O=Internet Security Research Group, C=US\" (SHA1: 54:31:7E:B0:76:5F:0B:C6:74:85:51:84:EB:83:74:B4:19:9E:46:55; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"Certificado_20392302026.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-PBGOKJDIR9.tmp\\Certificado_20392302026.tmp\"\n \"Certificado_20392302026.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-38DALNPB3K.tmp\\_isetup\\_setup64.tmp\"\n \"Certificado_20392302026.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-38DALNPB3K.tmp\\boosten.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts to launch the Installer package binary","description":"Process \"Certificado_20392302026.tmp\" with commandline \"/SL5=\"$7031A\n70433714\n893440\nC:\\\\Certificado_20392302026.exe\"\" (UID: 00000000-00005564)","origin":"Monitored Target","mitre_attack_id":"T1546.016","relevance":3,"id":"target-670","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryEx failed\" (Indicator: \"LoadLibrary\"; File: \"Certificado_20392302026.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"boosten.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$3c","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"Certificado_20392302026.tmp\" has type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections\" - Location: [%TEMP%\\is-PBGOKJDIR9.tmp\\Certificado_20392302026.tmp]\n \"_setup64.tmp\" has type \"PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections\" - Location: [%TEMP%\\is-38DALNPB3K.tmp\\_isetup\\_setup64.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$3e","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"Certificado_20392302026.exe\" queries basic process information of the \"C:\\Certificado_20392302026.exe\" (UID: 2196)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"Certificado_20392302026.exe\" reads file \"c:\\certificado_20392302026.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains a Wine emulator-related string\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"Certificado_20392302026.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\imm32.dll\"\n \"Certificado_20392302026.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ole32.dll\"\n \"Certificado_20392302026.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"\n \"Certificado_20392302026.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\fltLib.dll\"\n \"Certificado_20392302026.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\cryptsp.dll\"\n \"Certificado_20392302026.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\netapi32.dll\"\n \"Certificado_20392302026.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\winhttp.dll\"\n \"Certificado_20392302026.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mpr.dll\"\n \"Certificado_20392302026.exe\" trying to touch file \"C:\\windows\\temp\\VxOle32.dll\"\n \"Certificado_20392302026.exe\" trying to touch file \"C:\\Windows\\Temp\\VxOle32.dll\"\n \"Certificado_20392302026.exe\" trying to touch file \"C:\\WINDOWS\\system32\\netapi32.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"Certificado_20392302026.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-pbgokjdir9.tmp\\certificado_20392302026.tmp\"\n \"Certificado_20392302026.exe\" writes file \"%temp%\\is-pbgokjdir9.tmp\\certificado_20392302026.tmp\"\n \"Certificado_20392302026.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-38dalnpb3k.tmp\\_isetup\\_setup64.tmp\"\n \"Certificado_20392302026.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-38dalnpb3k.tmp\\boosten.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"Certificado_20392302026.tmp\" writes a file \"%TEMP%\\is-38DALNPB3K.tmp\\icudtl.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"87096902807,7652,3149,,GetComputerNameExW,kernel32.dll,\"01:16:46.250\",RX=0,PX=0\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00000372.00000002.296621.70FA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"POST /e702da9c5a58/o/\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Network Related","name":"Contains reference to OpenSSL library string","description":"Found string \"--use-openssl-ca\" (Indicator: \"openssl-\"; Source: \"00000000-00000372.00000000.292779.00058000.00000004.mdmp, 00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp\")\n Found string \"I--openssl-config\" (Indicator: \"openssl-\"; Source: \"00000000-00000372.00000000.292779.00058000.00000004.mdmp, 00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp\")\n Found string \"--use-openssl-ca\" (Indicator: \"openssl-\"; Source: \"00000000-00001392.00000000.294191.00048000.00000004.mdmp, 00000000-00001392.00000001.296113.00048000.00000004.mdmp, 00000000-00001392.00000002.298031.00048000.00000004.mdmp\")\n Found string \"I--openssl-config\" (Indicator: \"openssl-\"; Source: \"00000000-00001392.00000000.294191.00048000.00000004.mdmp, 00000000-00001392.00000001.296113.00048000.00000004.mdmp, 00000000-00001392.00000002.298031.00048000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-494","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"127.0.0.1\" found in string \"activate inspector on host:port (default: 127.0.0.1:9229)\"\n \"127.0.0.1\"\n \"104.21.67.57\"\n \"172.67.214.147\"\n \"192.168.0.2\"\n Potential IP \"4.1.0.7\" found in string \"OpenGL ES 3.0 SwiftShader 4.1.0.7\"\n Potential IP \"8.9.255.25\" found in string \"}8.9.255.25-electron.0\"\n \"0.0.0.0\"\n \"0.23.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$43","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$44","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$45","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://jrsoftware.org\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"oficiospolicia.com\" (5 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Network Related","name":"References hosts file in file/memory","description":"$46","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-479","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS POST request to https://oficiospolicia.com/e702da9c5a58/o/","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"oficiospolicia.com\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.21.67.57\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"libGLESv2.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00007504\"\n YARA signature for encryption algorithm file \"d3dcompiler_47.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE9DBB0540E12BE4A367518DB80202]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000372.00000000.292779.70FA0000.00000004.mdmp, 00000000-00000372.00000001.294700.70FA0000.00000004.mdmp, 00000000-00000372.00000002.296621.70FA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00000372.00000000.292779.70FA0000.00000004.mdmp, 00000000-00000372.00000001.294700.70FA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Certificado_20392302026.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Certificado_20392302026.tmp\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"boosten.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"boosten.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"Certificado_20392302026.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"Certificado_20392302026.tmp\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"boosten.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$49","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"file/memory contains long string with (Indicator: \"ForEach-Object\"; File: \"windowsExecutableCodeSignatureVerifier.js\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"9269446501,4348,3121,,CreateToolhelp32Snapshot,kernel32.dll,\"01:16:13.828\",RX=0,PX=0\" (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"00000000-00000372.00000000.292779.70FA0000.00000004.mdmp, 00000000-00000372.00000001.294700.70FA0000.00000004.mdmp\")\n Found reference to API \"7961197190,7376,3121,,CreateToolhelp32Snapshot,kernel32.dll,\"01:16:13.281\",RX=0,PX=0\" (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"00000000-00000372.00000000.292779.70FA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempDir: GetTempPath failed (%u, %u)\" (Indicator: \"GetTempPath\"; File: \"Certificado_20392302026.exe\")\n Found reference to API \"GetCurrentDirectory\" (Indicator: \"GetCurrentDirectory\"; File: \"Certificado_20392302026.exe\")\n Found reference to API \"NtQueryAttributesFile\" (Indicator: \"QueryAttributesFile\"; Source: \"00000000-00000372.00000001.294700.00058000.00000004.mdmp, 00000000-00000372.00000002.296621.00058000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-AuthenticodeSignature\"; File: \"windowsExecutableCodeSignatureVerifier.js\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"87096902807,7652,3149,,GetComputerNameExW,kernel32.dll,\"01:16:46.250\",RX=0,PX=0\" (Indicator: \"GetComputerName\"; Source: \"00000000-00000372.00000002.296621.70FA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00000372.00000000.292779.003C8000.00000004.mdmp\")\n Found reference to API \"_getsocknamea \"[\"2c0h8l3u\",\"DESKTOP-FVVF82A\",\"HAPUBWS\"]\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":34,"imported_dlls_count":108,"dropped_files_count":0,"extracted_files_count":29,"files_written_count":555,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":1,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["wacatac","phonzy","wacapew","malicious","new_domain"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"69b9ce54961b33c9a409d633","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"TrojanDldr.OffLoader.gen","submit_name":"Certificado_20392302026.exe","analysis_start_time":"2026-03-17T21:57:46+00:00","indicators_count":{"informative":160,"suspicious":35,"malicious":5},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"69b9c9e34766bcfefd00c389","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"TrojanDldr.OffLoader.gen","submit_name":"2336ef2777274c5ebffa98e86a6085d8de354267fe85f9ee9ea74fd92c051724.bin","analysis_start_time":"2026-03-17T21:38:48+00:00","indicators_count":{"informative":173,"suspicious":33,"malicious":6},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.21.67.57","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]}],"dns_resolutions":[{"domain":"oficiospolicia.com","address":"104.21.67.57","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]}],"http_requests":[{"host":"oficiospolicia.com","host_ip":"104.21.67.57:443","url":"/e702da9c5a58/o/","method":"POST","response_code":"522","response_phrase":"","header":"POST /e702da9c5a58/o/ HTTP/1.1\nContent-Type: application/json\nHost: oficiospolicia.com\nConnection: close\nTransfer-Encoding: chunked","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}],"processes":[{"pid":2196,"ppid":0,"name":"Certificado_20392302026.exe","command_line":"","sha256":"2336ef2777274c5ebffa98e86a6085d8de354267fe85f9ee9ea74fd92c051724","normalized_path":"C:\\Certificado_20392302026.exe","uid":"00000000-00002196","icon":"$59"},{"pid":5564,"ppid":2196,"name":"Certificado_20392302026.tmp","command_line":"/SL5=\"$7031A,70433714,893440,C:\\Certificado_20392302026.exe\"","sha256":"8ba1802689c16b502d264e08bc8675ec4c10c7c588bb1b990aaf1cbeb88a3dcb","normalized_path":"%TEMP%\\is-PBGOKJDIR9.tmp\\Certificado_20392302026.tmp","parent_uid":"00000000-00002196","uid":"00000000-00005564"},{"pid":372,"ppid":5564,"name":"boosten.exe","command_line":"","sha256":"7c9b6a01b11ed1c5b5be2354cee78d4750df4939f230b35ac7a770f67432ff68","normalized_path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\boosten.exe","parent_uid":"00000000-00005564","uid":"00000000-00000372"},{"pid":7504,"ppid":372,"name":"boosten.exe","command_line":"--type=gpu-process --field-trial-handle=1528,10361849404774865725,17333420879949050146,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1548 /prefetch:2","sha256":"7c9b6a01b11ed1c5b5be2354cee78d4750df4939f230b35ac7a770f67432ff68","normalized_path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\boosten.exe","parent_uid":"00000000-00000372","uid":"00000000-00007504"},{"pid":1392,"ppid":372,"name":"boosten.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1528,10361849404774865725,17333420879949050146,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1932 /prefetch:8","sha256":"7c9b6a01b11ed1c5b5be2354cee78d4750df4939f230b35ac7a770f67432ff68","normalized_path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\boosten.exe","parent_uid":"00000000-00000372","uid":"00000000-00001392"},{"pid":3300,"ppid":372,"name":"boosten.exe","command_line":"--type=gpu-process --field-trial-handle=1528,10361849404774865725,17333420879949050146,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22621.1194 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1500 /prefetch:2","sha256":"7c9b6a01b11ed1c5b5be2354cee78d4750df4939f230b35ac7a770f67432ff68","normalized_path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\boosten.exe","parent_uid":"00000000-00000372","uid":"00000000-00003300"}],"all_imported_dlls":["umpdc.dll","msmpeg2vdec.dll","ntdll.dll","wow64cpu.dll","msctf.dll","TextInputFramework.dll","sspicli.dll","ResourcePolicyClient.dll","libGLESv2.dll","dwmapi.dll","ole32.dll","UIAutomationCore.dll","secur32.dll","VxSSL64.dll","powrprof.dll","mswsock.dll","directxdatabasehelper.dll","kernel32.dll","imm32.dll","cryptbase.dll","IPHLPAPI.DLL","MMDevAPI.dll","d3d11.dll","D3D12.dll","user32.dll","combase.dll","comdlg32.dll","version.dll","CoreMessaging.dll","dhcpcsvc6.dll","dxgi.dll","mfh264enc.dll","wow64base.dll","ucrtbase.dll","bcrypt.dll","uxtheme.dll","kernel.appcore.dll","clbcatq.dll","mf.dll","d3dcompiler_47.dll","advapi32.dll","oleaut32.dll","mfplat.dll","ddraw.dll","libEGL.dll","CompPkgSup.dll","rpcrt4.dll","gdi32.dll","mpr.dll","wow64con.dll","KernelBase.dll","comctl32.dll","sechost.dll","gdi32full.dll","dnsapi.dll","FWPUCLNT.DLL","Windows.UI.dll","msvcrt.dll","crypt32.dll","userenv.dll","profapi.dll","cfgmgr32.dll","dciman32.dll","ffmpeg.dll","nlansp_c.dll","Windows.Media.dll","d3d10warp.dll","dbghelp.dll","msvcp_win.dll","apphelp.dll","winsta.dll","WinTypes.dll","CoreUIComponents.dll","dhcpcsvc.dll","mscms.dll","wow64.dll","VxSSL32.dll","cryptsp.dll","DWrite.dll","rasadhlp.dll","DXCore.dll","RTWorkQ.dll","mfperfhelper.dll","winmm.dll","windows.storage.dll","ntmarta.dll","devobj.dll","D3D12Core.dll","wow64win.dll","ws2_32.dll","SHCore.dll","shell32.dll","winhttp.dll","shfolder.dll","nsi.dll","win32u.dll","fltLib.dll","shlwapi.dll","wtsapi32.dll","msimg32.dll","dxva2.dll","msvproc.dll","bcryptprimitives.dll","propsys.dll","msvcp110_win.dll","nlaapi.dll","winmmbase.dll","msasn1.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"boosten.exe","sha256":"ac25206ef129cc6f4f4152ae1c371751eaaa17e5c5ef97f8abfb83f322913090","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"_setup64.tmp","sha256":"388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"name":"d3dcompiler_47.dll","sha256":"44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"ffmpeg.dll","sha256":"eae1cb62d87421bc43db881edbdebb200e2140f9062b4b783e41d20e46a8e55b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"libEGL_15e52e.dll","sha256":"7f61e185edc90a5f813c9e183b15dd120f25f29a42ad8495686ff0df67f9300f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"name":"libGLESv2.dll","sha256":"7cb905ee0a001cef6e9a8376bf7839a281d55506aad681fc8804f88da200d654","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"libGLESv2_526df8.dll","sha256":"0796e6d84d4cf5c251ceb713ce69109507dfd94464a5b335b1dc859c9a1765f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"name":"vk_swiftshader.dll","sha256":"eb1f78d09a68d724dfb68bf1c9548c4012d6e8ce25ec1d8fb521ffcf09c68244","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"vulkan-1.dll","sha256":"fb04ccab61ffeb781e4990f9318b25c3590c15330f0206c6a9cd4dbf824198ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"AppImageUpdater.js.map","sha256":"69d793dce82bce2bc744acf3ae7bc31c93673dd1be6017bd04e0b26d5c7695ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"AppUpdater.js.map","sha256":"e86d9294d953d280786d98080f25f2e2bf597e96176c7d0fde48dc171c3b7682","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"BaseUpdater.js.map","sha256":"fc7e5dab38ce7147e38c208108292f91e61aa4a73b0648b24f5af88bc1b419fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"CancellationToken.js.map","sha256":"627a5f0d29adcef5926a52b93e5eb29613b45b0d814ab079285940f57f3b149f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"DataSplitter.js.map","sha256":"c12e7a4c19dead6707c08df2c0d6ccea619988dc31f3f10637ef1a3098fa4861","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"FileWithEmbeddedBlockMapDifferentialDownloader.js.map","sha256":"54d9412c57882c7c26712383b913a2d2a5aa437d410aa3ea979079e9b9651714","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"name":"LICENSES.chromium.html","sha256":"a6692be8af33d0673504a5d2bd519f4738aa872595eccc0434f5921185c0d56d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"MacUpdater.js.map","sha256":"bee57b39aa7028ec63772fff6dc6ee17f729e8b97159de80da6db7271095524e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"NoOpLogger.js.map","sha256":"cbd3bf7c3c5dd451f2fe9359d870f9ae45f3723e9bb58c0bbda2e704cc459301","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"Provider.js.map","sha256":"4cbe10beeb921c4ee78b03e7931791f296e32d847a1de0a1a49cf3823a812843","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"electronHttpExecutor.js.map","sha256":"ad1bcafba43a8a4c4d129c9718eef999b856e3446e809af6d70f09d0c2094c23","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"name":"index.html","sha256":"b70763d9fdf188ec87d1eb100f32832a0f74770ccb2122996a7f20d6c6699c68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"index.js.map","sha256":"8adca35d874a76642f3a1c9322fe3182d7bb673e763e9ef3c41e5a83bce172fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"json.js","sha256":"aa53e414f077035b4d477d19095ac01e60d9df73af716a188fd2772314041f92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"name":"json2xml.js","sha256":"878b02205788207fe58227b1f1a9ee15ad23c60403d69373de729f736dbc4ecd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"name":"jsonfile.js","sha256":"a986ad3c13166f3bf8f30b18140bfc8ea1754760ab3802aa7c8c3780d54f07ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"libEGL.dll","sha256":"372139bb9e1cbcd1669ec5b3c1abbb969129fc558c70fe6c55ebb9a9f6d40eea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"util.js.map","sha256":"fdf43475e6321ffd37845690957b7b13550c3ade6152f8ca635d1224f22374f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"node2json.js","sha256":"27b4edac03051962acc344ebe94bb6f4f4d7bbe556cd83c6c8428e6a83483644","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"output-json-sync.js","sha256":"7e84f5c478c02d8507238dc355ed5fe649fe61959bdc100da7c2a29599bcb714","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-PBGOKJDIR9.tmp\\Certificado_20392302026.tmp","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\boosten.exe","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\boosten.exe","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\chrome_100_percent.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\chrome_100_percent.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\chrome_200_percent.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\chrome_200_percent.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\d3dcompiler_47.dll","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\d3dcompiler_47.dll","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\ffmpeg.dll","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\ffmpeg.dll","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\icudtl.dat","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\icudtl.dat","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\libEGL.dll","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\libEGL.dll","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\libGLESv2.dll","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\libGLESv2.dll","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\LICENSE.electron.txt","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\LICENSE.electron.txt","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\LICENSES.chromium.html","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\LICENSES.chromium.html","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\resources.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\snapshot_blob.bin","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\snapshot_blob.bin","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\v8_context_snapshot.bin","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\v8_context_snapshot.bin","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\vk_swiftshader.dll","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\vk_swiftshader.dll","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\vk_swiftshader_icd.json","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\vk_swiftshader_icd.json","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\vulkan-1.dll","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\vulkan-1.dll","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\boostnote.json","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\a\\boostnote.json","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\jj2ZkYwtsV.json","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\a\\notes\\jj2ZkYwtsV.json","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\p1Jo8DYL_.json","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\a\\notes\\p1Jo8DYL_.json","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\XV6ER1EEs.json","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\a\\notes\\XV6ER1EEs.json","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\am.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\am.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\ar.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\ar.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\bg.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\bg.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\bn.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\bn.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\ca.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\ca.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\cs.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\cs.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\da.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\da.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\de.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\de.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\el.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\el.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\en-GB.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\en-GB.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\en-US.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\en-US.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\es-419.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\es-419.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\es.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\es.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\et.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\et.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\fa.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\fa.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\fi.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\fi.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\fil.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\fil.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\fr.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\fr.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\gu.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\gu.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\he.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\he.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\hi.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\hi.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\hr.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\hr.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\hu.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\hu.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\id.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\id.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\it.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\it.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\ja.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\ja.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\kn.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\kn.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\ko.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\ko.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\lt.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\lt.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\lv.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\lv.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\ml.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\ml.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\mr.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\mr.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\ms.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\ms.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\nb.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\nb.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\nl.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\nl.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\pl.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\pl.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\pt-BR.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\pt-BR.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\pt-PT.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\pt-PT.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\ro.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\ro.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\ru.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\ru.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\sk.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\sk.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\sl.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\sl.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\sr.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\sr.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\sv.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\sv.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\sw.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\sw.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\ta.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\ta.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\te.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\te.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\th.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\th.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\tr.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\tr.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\uk.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\uk.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\vi.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\vi.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\zh-CN.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\zh-CN.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\zh-TW.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\locales\\zh-TW.pak","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\app-update.yml","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app-update.yml","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\index.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\index.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\package.json","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\package.json","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\0.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\0.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\1.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\1.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\10.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\10.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\100.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\100.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\101.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\101.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\102.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\102.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\103.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\103.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\104.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\104.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\105.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\105.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\106.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\106.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\107.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\107.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\108.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\108.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\109.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\109.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\11.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\11.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\110.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\110.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\111.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\111.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\112.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\112.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\113.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\113.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\114.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\114.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\115.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\115.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\116.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\116.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\117.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\117.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\12.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\12.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\13.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\13.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\14.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\14.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\15.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\15.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\16.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\16.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\17.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\17.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\18.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\18.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\19.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\19.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\2.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\2.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\20.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\20.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\21.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\21.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\22.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\22.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\23.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\23.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\24.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\24.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\25.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\25.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\26.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\26.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\27.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\27.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\28.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\28.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\29.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\29.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\30.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\30.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\31.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\31.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\32.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\32.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\33.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\33.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\34.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\34.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\35.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\35.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\36.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\36.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\37.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\37.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\38.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\38.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\39.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\39.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\4.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\4.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\40.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\40.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\41.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\41.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\42.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\42.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\43.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\43.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\44.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\44.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\45.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\45.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\46.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\46.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\47.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\47.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\48.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\48.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\49.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\49.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\5.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\5.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\50.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\50.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\51.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\51.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\52.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\52.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\53.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\53.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\54.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\54.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\55.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\55.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\56.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\56.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\57.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\57.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\58.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\58.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\59.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\59.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\6.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\6.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\60.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\60.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\61.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\61.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\62.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\62.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\63.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\63.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\64.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\64.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\65.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\65.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\66.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\66.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\67.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\67.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\68.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\68.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\69.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\69.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\7.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\7.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\70.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\70.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\71.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\71.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\72.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\72.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\73.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\73.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\74.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\74.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\75.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\75.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\76.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\76.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\77.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\77.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\78.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\78.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\79.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\79.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\8.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\8.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\80.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\80.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\81.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\81.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\82.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\82.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\83.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\83.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\84.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\84.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\85.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\85.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\86.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\86.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\87.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\87.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\88.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\88.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\89.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\89.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\9.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\9.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\90.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\90.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\91.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\91.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\92.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\92.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\93.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\93.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\94.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\94.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\95.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\95.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\96.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\96.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\97.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\97.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\98.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\98.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\99.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\99.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\index.html","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\index.html","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\3024-day.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\3024-day.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\3024-night.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\3024-night.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\abcdef.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\abcdef.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\ambiance-mobile.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\ambiance-mobile.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\ambiance.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\ambiance.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\ayu-dark.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\ayu-dark.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\ayu-mirage.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\ayu-mirage.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\base16-dark.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\base16-dark.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\base16-light.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\base16-light.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\bespin.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\bespin.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\blackboard.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\blackboard.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\cobalt.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\cobalt.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\codemirror.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\codemirror.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\colorforth.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\colorforth.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\darcula.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\darcula.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\dracula.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\dracula.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\duotone-dark.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\duotone-dark.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\duotone-light.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\duotone-light.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\eclipse.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\eclipse.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\elegant.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\elegant.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\erlang-dark.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\erlang-dark.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\gruvbox-dark.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\gruvbox-dark.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\hopscotch.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\hopscotch.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\icecoder.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\icecoder.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\idea.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\idea.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\isotope.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\isotope.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\lesser-dark.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\lesser-dark.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\liquibyte.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\liquibyte.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\lucario.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\lucario.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\material-darker.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%LOCALAPPDATA%\\AutoMaxwareUltraPlusly\\resources\\app\\compiled\\app\\codemirror\\theme\\material-darker.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-38DALNPB3K.tmp\\material-ocean.css","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%APPDATA%\\temp.txt","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"pipe\\mojo.372.3084.4933576897186665892","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"pipe\\mojo.372.3084.15722411674982097320","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\sslkey.txt","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"pipe\\mojo.372.3084.4048354836079393760","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"pipe\\mojo.372.3084.12392617998749887","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"pipe\\mojo.372.3084.233555069607852517","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"pipe\\mojo.372.3084.12521501588355689063","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"path":"%TEMP%\\is-UTXVL4FFWC.tmp\\2336ef2777274c5ebffa98e86a6085d8de354267fe85f9ee9ea74fd92c051724.bin.tmp","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\boosten.exe","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\chrome_100_percent.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\chrome_200_percent.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\d3dcompiler_47.dll","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\ffmpeg.dll","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\icudtl.dat","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\libEGL.dll","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\libGLESv2.dll","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\LICENSE.electron.txt","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\LICENSES.chromium.html","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\resources.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\snapshot_blob.bin","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\v8_context_snapshot.bin","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\vk_swiftshader.dll","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\vk_swiftshader_icd.json","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\vulkan-1.dll","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\boostnote.json","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\jj2ZkYwtsV.json","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\p1Jo8DYL_.json","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\XV6ER1EEs.json","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\am.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\ar.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\bg.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\bn.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\ca.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\cs.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\da.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\de.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\el.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\en-GB.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\en-US.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\es-419.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\es.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\et.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\fa.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\fi.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\fil.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\fr.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\gu.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\he.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\hi.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\hr.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\hu.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\id.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\it.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\ja.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\kn.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\ko.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\lt.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\lv.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\ml.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\mr.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\ms.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\nb.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\nl.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\pl.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\pt-BR.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\pt-PT.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\ro.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\ru.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\sk.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\sl.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\sr.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\sv.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\sw.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\ta.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\te.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\th.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\tr.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\uk.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\vi.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\zh-CN.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\zh-TW.pak","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\app-update.yml","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\index.js","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\package.json","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\0.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\1.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\10.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"%TEMP%\\is-50WRKOPEO7.tmp\\100.bundle.js","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"pipe\\mojo.1672.3564.12139589413352698277","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"pipe\\mojo.1672.3564.9567258447118977130","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"pipe\\mojo.1672.3564.4694908962796548062","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"pipe\\mojo.1672.3564.12243080866883086088","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"pipe\\mojo.1672.3564.12470640194607516721","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"path":"pipe\\mojo.1672.3564.12160943327441897669","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\STARTUPAPPROVED\\RUN\\","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"},{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\STARTUPAPPROVED\\RUN\\ELECTRON.APP.BOOST NOTE - LOCAL\\ELECTRON.APP.BOOST NOTE - LOCAL","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5564:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5564:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"name":"SM0:5564:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"name":"Local\\SM0:5564:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:372:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"name":"Local\\SM0:372:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"name":"SM0:372:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:372:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7504:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7504:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7504:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"name":"Local\\SM0:7504:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"name":"SM0:7504:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"name":"Local\\SM0:7504:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3300:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"name":"Local\\SM0:3300:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9ce54961b33c9a409d633"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:492:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"Local\\SM0:492:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1672:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1672:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"Local\\SM0:1672:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"SM0:1672:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3772:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3772:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"SM0:3772:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"Local\\SM0:3772:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6216:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6216:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"SM0:6216:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"Local\\SM0:6216:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4836:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4836:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"SM0:4836:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]},{"name":"Local\\SM0:4836:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9c9e34766bcfefd00c389"}]}]}},"report_ids":{"sandbox_job_ids":["69b9ce54961b33c9a409d633","69b9c9e34766bcfefd00c389"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious TrojanDldr.OffLoader.gen Sample 2336ef277727… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2336ef277727…. Malware family: TrojanDldr.OffLoader.gen. Threat score 100/100. 2/26 AV engines flagged this file. 5 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2336ef2777274c5ebffa98e86a6085d8de354267fe85f9ee9ea74fd92c051724"}],["$","meta","4",{"property":"og:title","content":"Malicious TrojanDldr.OffLoader.gen Sample 2336ef277727… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2336ef277727…. Malware family: TrojanDldr.OffLoader.gen. Threat score 100/100. 2/26 AV engines flagged this file. 5 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2336ef2777274c5ebffa98e86a6085d8de354267fe85f9ee9ea74fd92c051724"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious TrojanDldr.OffLoader.gen Sample 2336ef277727… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2336ef277727…. Malware family: TrojanDldr.OffLoader.gen. Threat score 100/100. 2/26 AV engines flagged this file. 5 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5a","11",{}]]