26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 77:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TrojanRansom.Foreign.oecl Sample 3515de6eccfc… — Score 88/100 — Hybrid Analysis","description":"Malicious verdict for sample 3515de6eccfc…. Malware family: TrojanRansom.Foreign.oecl. Threat score 88/100. 4/26 AV engines flagged this file. 5 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592","keywords":["Malicious","TrojanRansom.Foreign.oecl","malware analysis","sandbox report","threat intelligence","3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592"],"about":{"@type":"SoftwareApplication","name":"Kyd.exe","applicationCategory":["compressed","7zip"],"identifier":"3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592","additionalType":"Malicious sample"},"threatScore":88,"malwareFamily":"TrojanRansom.Foreign.oecl","antivirusDetections":{"malicious":4,"total":26},"behavioralIndicators":{"malicious":5,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T973,Found reference string "powershell -Command "Add-MpPreference -ExclusionPath \"%LOCALAPPDATA%\""" (Indicator: "add-mppreference"; Source: "00000000-00007524-00000C46-2558041044") Found reference string "powershell -Command "Add-MpPreference -ExclusionPath \"%PROGRAMFILES%\(x86)\savvy\""" (Indicator: "add-mppreference"; Source: "00000000-00007524-00000C46-31954529888") Found reference string "powershell -Command "Add-MpPreference -ExclusionPath \"%PROGRAMFILES%\(x86)\Grinstead\""" (Indicator: "add-mppreference"; Source: "00000000-00007524-00000C46-59727246660") Found reference string "powershell -Command "Add-MpPreference -ExclusionPath \"%TEMP%\nsn40C.tmp\""" (Indicator: "add-mppreference"; Source: "00000000-00007524-00000C46-86624852044") Found reference string "Add-MpPreference -ExclusionPath "C:\Users\HAPUBWS\AppData\Local"" (Indicator: "add-mppreference"; File: "AMSI") Found reference string "Add-MpPreference -ExclusionPath "C:\Program Files (x86)\savvy"" (Indicator: "add-mppreference"; File: "AMSI") Found reference string "Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Grinstead"" (Indicator: "add-mppreference"; File: "AMSI") Found reference string "Add-MpPreference -ExclusionPath "C:\Users\HAPUBWS\AppData\Local\Temp\nsn40C.tmp"" (Indicator: "add-mppreference"; File: "AMSI") Found reference string "Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Grinstead"" (Indicator: "add-mppreference"; Source: "00000000-00004604.00000000.136141.02A80000.00000004.mdmp, 00000000-00004604.00000000.136141.02AE0000.00000004.mdmp, 00000000-00004604.00000000.136141.02BB6000.00000004.mdmp, 00000000-00004604.00000001.136518.02A80000.00000004.mdmp, 00000000-00004604.00000001.136518.02AE0000.00000004.mdmp, 00000000-00004604.00000001.136518.02BB6000.00000004.mdmp, 00000000-00004604.00000001.136518.08C60000.00000004.mdmp") Found reference string "powershell -Command "Add-MpPreference -ExclusionPath \"C:\Program Files (x86)\Grinstead\""" (Indicator: "add-mppreference"; Source: "00000000-00004604.00000000.136141.02AE0000.00000004.mdmp, 00000000-00004604.00000001.136518.02AE0000.00000004.mdmp") Found reference string "HostApplication=powershell -Command Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Grinstead"" (Indicator: "add-mppreference"; Source: "00000000-00004604.00000001.136518.02AE0000.00000004.mdmp, 00000000-00004604.00000001.136518.08C60000.00000004.mdmp")28:T58d,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "nsExec.dll") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004460.00000000.139120.00407000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00004460.00000000.139120.00407000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004604.00000000.136141.71E75000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004604.00000000.136141.71E75000.00000002.mdmp")29:T5a9,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "SelfDel.dll") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004460.00000000.139120.00407000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004460.00000000.139120.00407000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004460.00000000.139120.00407000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004604.00000000.136141.71E75000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004604.00000000.136141.71E75000.00000002.mdmp")2a:T7f9,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D1EB23A46D17D68FD92564C2F1F1601764D8E349") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D23209AD23D314232174E40D7F9D62139786633A") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D23209AD23D314232174E40D7F9D62139786633A") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D4DE20D05E66FC53FE1A50882C78DB2852CAE474") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D4DE20D05E66FC53FE1A50882C78DB2852CAE474") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D69B561148F01C77C54578C10926DF5B856976AD") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D69B561148F01C77C54578C10926DF5B856976AD") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D8C5388AB7301B1B6ED47AE645253A6F9F1A2761") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D8C5388AB7301B1B6ED47AE645253A6F9F1A2761") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DAC9024F54D8F6DF94935FB1732638CA6AD77C13") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DAC9024F54D8F6DF94935FB1732638CA6AD77C13") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4")2b:Ta21,"" (Indicator: "enumchildwindows"; Source: "00000000-00004460.00000000.139120.02F40000.00000004.mdmp")30:T1ba2,"", Potential IP "4.0.0.0" found in string "rsion=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f1", Potential IP "4.0.0.0" found in string "=4.0.0.0 Culture=neutq", Potential IP "4.0.0.0" found in string "4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a" allowLocation="false" />" Potential IP "4.0.0.0" found in string "sion=4.0.0.0," Potential IP "4.0.0.0" found in string "on=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />", "4.0.0.0", Potential IP "4.0.0.0" found in string "ystem.Core 4.0.0.0 b77a5c561934e089 MSIL", Potential IP "4.0.0.0" found in string "ccessibility 4.0.0.0 b03f5f7f11d50a3a MSIL", Potential IP "4.0.0.0" found in string "ersion=4.0.0.0 Culture=neutral PublicKb", Potential IP "4.0.0.0" found in string "4.0.0.0 C", Potential IP "4.0.0.0" found in string "=4.0.0.0 ", Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources 3.0.0.0 en-US 31bf3856ad364e35", "2.5.29.17", "2.5.29.1", "2.5.29.31", "2.5.4.3", "2.5.29.32", "2.5.29.15", "2.5.29.14", "2.5.29.19", Potential IP "2.5.29.35" found in string "#2.5.29.35", Potential IP "2.5.29.37" found in string "%2.5.29.37", Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources 3.0.0.0 en-US 31bf3856ad364e35", "1.3.6.1", "2.5.29.10", "2.5.29.16", "2.5.4.8", "2.5.4.10", "2.5.4.11", "2.5.4.7", "2.5.4.5", "2.5.4.6", Potential IP "4.0.0.0" found in string "rsion=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089"55:T1936,Pattern match: "http://nsis.sf.net/nsis_error" Heuristic match: ",k.bz" Heuristic match: "!33.sv" Heuristic match: "#:.gt" Heuristic match: "=o?{b.bv" Heuristic match: "g%.ax" Pattern match: "www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0slr=tx" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0?6d~tn/tx0#p8ny8apl[g6a&washington1redmond1microsoft" Pattern match: "http://nsis.sf.net/nsis_errorerror" Pattern match: "www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0m" Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "ystem.drawing.ni" Heuristic match: "ystem.windows.fo" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "https://www.nirsoft.net/" Heuristic match: "soft.net" Heuristic match: "orlib.ni" Heuristic match: "m.web.co" Heuristic match: "m.windows.fo" Heuristic match: "e;.jo" Heuristic match: "

9iqmgvw,czcthawte," - Source: "00000000-00004604.00000000.136141.02BB6000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00004604.00000000.136141.02BB6000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004604.00000000.136141.02BB6000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004604.00000000.136141.02BB6000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert" - Source: "00000000-00004604.00000000.136141.02BB6000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004604.00000000.136141.02BB6000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004604.00000000.136141.02BB6000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004604.00000000.136141.02BB6000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004604.00000000.136141.02BB6000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00004604.00000000.136141.02BB6000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00004604.00000000.136141.02BB6000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00004604.00000000.136141.02BB6000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004604.00000000.136141.07060000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004604.00000000.136141.07060000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004604.00000000.136141.07060000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004604.00000000.136141.07060000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f9iqmgvw,czcthawte," - Source: "00000000-00004604.00000001.136518.02BB6000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00004604.00000001.136518.02BB6000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004604.00000001.136518.02BB6000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004604.00000001.136518.02BB6000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert" - Source: "00000000-00004604.00000001.136518.02BB6000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004604.00000001.136518.02BB6000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004604.00000001.136518.02BB6000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004604.00000001.136518.02BB6000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004604.00000001.136518.02BB6000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00004604.00000001.136518.02BB6000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00004604.00000001.136518.02BB6000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00004604.00000001.136518.02BB6000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004604.00000001.136518.07060000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004604.00000001.136518.070A5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004604.00000001.136518.070A5000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004604.00000001.136518.070A5000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0washington1redmond1microsoft" - Source: "00000000-00004604.00000001.136518.070F6000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!20531151" - Source: "00000000-00004604.00000001.136518.070F6000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0washington1redmond1microsoft" - Source: "00000000-00004604.00000001.136518.07114000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06" - Source: "00000000-00004604.00000001.136518.07114000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00004604.00000001.136518.08C60000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f" - Source: "00000000-00004604.00000001.136518.71E61000.00000020.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00004916.00000000.134617.033D0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?emgvw,czc%wvfglobalsign" - Source: "00000000-00004916.00000000.134617.033D0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00004916.00000000.134617.033D0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00004916.00000000.134617.033D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004916.00000000.134617.034AE000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00004916.00000000.134617.034AE000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004916.00000000.134617.034AE000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004916.00000000.134617.034AE000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00004916.00000000.134617.034AE000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00004916.00000000.134617.034AE000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00004916.00000000.134617.034AE000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%ydigicert" - Source: "00000000-00004916.00000000.134617.034AE000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004916.00000000.134617.034AE000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004916.00000000.134617.034AE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00004916.00000000.134617.034AE000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004916.00000000.134617.034AE000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004916.00000000.134617.034AE000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004916.00000000.134617.034AE000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004916.00000000.134617.034AE000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004916.00000000.134617.034AE000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00004916.00000000.134617.034AE000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004916.00000000.134617.034AE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004916.00000000.134617.034AE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004916.00000000.134617.034AE000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lpl1" - Source: "00000000-00004916.00000000.134617.034AE000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00004916.00000000.134617.081B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004916.00000000.134617.081B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004916.00000000.134617.081B0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00004916.00000000.134617.71E41000.00000020.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00004916.00000001.135058.033D0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?emgvw,czc%wvfglobalsign" - Source: "00000000-00004916.00000001.135058.033D0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00004916.00000001.135058.033D0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00004916.00000001.135058.033D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004916.00000001.135058.034AE000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00004916.00000001.135058.034AE000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004916.00000001.135058.034AE000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004916.00000001.135058.034AE000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00004916.00000001.135058.034AE000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00004916.00000001.135058.034AE000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00004916.00000001.135058.034AE000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%ydigicert" - Source: "00000000-00004916.00000001.135058.034AE000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004916.00000001.135058.034AE000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004916.00000001.135058.034AE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00004916.00000001.135058.034AE000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004916.00000001.135058.034AE000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004916.00000001.135058.034AE000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004916.00000001.135058.034AE000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004916.00000001.135058.034AE000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004916.00000001.135058.034AE000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00004916.00000001.135058.034AE000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004916.00000001.135058.034AE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004916.00000001.135058.034AE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004916.00000001.135058.034AE000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lpl1" - Source: "00000000-00004916.00000001.135058.034AE000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00004916.00000001.135058.081B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004916.00000001.135058.081B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004916.00000001.135058.08229000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00004916.00000001.135058.08229000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0pmm" - Source: "00000000-00004916.00000001.135058.094C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!xphpxp0oxp" - Source: "00000000-00004916.00000001.135058.094C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06" - Source: "00000000-00004916.00000001.135058.09535000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt015!_)7q_)jr" - Source: "00000000-00004916.00000001.135058.09535000.00000004.mdmp") Found URL "http://www.microsoft.com/wi20170929063406.466z0washington1dmond1microsoft" - Source: "00000000-00004916.00000001.135058.09557000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00007076.00000000.136859.02BE1000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%yusername=hapubwsprocessor_revision=4f00sessionname=consolewindir=c:\windowshomepath=\users\hapubwsnumber_of_processors=8systemroot=c:\windowsprocessor_level=6public=c:\users\public" - Source: "00000000-00007076.00000000.136859.02BE1000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007076.00000000.136859.02BE1000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007076.00000000.136859.02BE1000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007076.00000000.136859.02BE1000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007076.00000000.136859.02BE1000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007076.00000000.136859.02BE1000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007076.00000000.136859.02BE1000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007076.00000000.136859.02BE1000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007076.00000000.136859.02BE1000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0com/" - Source: "00000000-00007076.00000000.136859.02BE1000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007076.00000000.136859.06FD0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00007076.00000000.136859.06FD0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007076.00000000.136859.06FD0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00007076.00000000.136859.06FD0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00007076.00000000.136859.06FD0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lvxeolwdo%b+h/@9." - Source: "00000000-00007076.00000000.136859.06FD0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l250905/^g(o-cejy" - Source: "00000000-00007076.00000000.136859.06FD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pk!miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007076.00000000.136859.06FD0000.00000004.mdmp") Found URL "http://crl.microsoft.col/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0xppk" - Source: "00000000-00007076.00000000.136859.06FD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007076.00000000.136859.06FD0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e8;3" - Source: "00000000-00007076.00000001.137234.02B92000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007076.00000001.137234.02BE1000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007076.00000001.137234.02BE1000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007076.00000001.137234.02BE1000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007076.00000001.137234.02BE1000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007076.00000001.137234.02BE1000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007076.00000001.137234.02BE1000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007076.00000001.137234.02BE1000.00000004.mdmp") Found URL "http://crl.gl4geotrust" - Source: "00000000-00007076.00000001.137234.02BEC000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00007076.00000001.137234.02BEC000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00007076.00000001.137234.02BEC000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%yusername=hapubwsprocessor_revision=4f00sessionname=consolewindir=c:\windowshomepath=\users\hapubwsnumber_of_processors=8systemroot=c:\windowsprocessor_level=6public=c:\users\public" - Source: "00000000-00007076.00000001.137234.02BEC000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007076.00000001.137234.02BEC000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007076.00000001.137234.02BEC000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007076.00000001.137234.02BEC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007076.00000001.137234.02BEC000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007076.00000001.137234.02BEC000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007076.00000001.137234.02BEC000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007076.00000001.137234.02BEC000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007076.00000001.137234.02BEC000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0com/" - Source: "00000000-00007076.00000001.137234.02BEC000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007076.00000001.137234.06FD0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00007076.00000001.137234.06FD0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007076.00000001.137234.06FD0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00007076.00000001.137234.06FD0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00007076.00000001.137234.06FD0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lvxeolwdo%b+h/@9." - Source: "00000000-00007076.00000001.137234.06FD0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00007076.00000001.137234.06FD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00007076.00000001.137234.06FD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpcxppk" - Source: "00000000-00007076.00000001.137234.06FD0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007076.00000001.137234.06FD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007076.00000001.137234.06FD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!p0.0.ultu934e@epboy65mtjuklr" - Source: "00000000-00007076.00000001.137234.06FD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0mond" - Source: "00000000-00007076.00000001.137234.08BE0000.00000004.mdmp") Found URL "http://wd\(qrnameproprnameproprnameproprnameprop10070121362rnamepropo0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-2,6n526n5,6n5.6n5(6n5$>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@ation1&0microsoft" - Source: "00000000-00007076.00000001.137234.08BE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0microsoft.management.infrastructure.userfilteredexceptionhandlingrefemit_inmemorymanifestmodulemscorlibsystem.diagnosticsdebuggableattributedebuggingmodes.ctorsystem.runtime.compilerservicesruntimecompatibilityattributesystemobjectuserfilteredexceptionhandlingexceptionactioninvokefunc" - Source: "00000000-00007076.00000001.137234.08C3E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06" - Source: "00000000-00007076.00000001.137234.08C3E000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007236.00000001.139695.1F680000.00000004.mdmp") Found URL "https://docs.microsoft.com/en-us/dotnet/api/microsoft.web.webview2.core.corewebview2.processfailedebview2_default_background_colorebview2vs_version_infovarfileinfotranslationstringfileinfo000004b0companynamemicrosoftfiledescriptionmicrosoft.web.webview2.winformsfileversion1.0.1054.31internalnamemicrosoft.web.webview2.winforms.dlllegalcopyrightcopyright" - Source: "00000000-00007236.00000001.139695.1F912000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json01/29" - Source: "00000000-00007236.00000001.139695.1FBA0000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,001/29" - Source: "00000000-00007236.00000001.139695.1FBA0000.00000002.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalroot" - Source: "00000000-00007236.00000001.139695.218A0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007236.00000001.139695.218A0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007236.00000001.139695.218A0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007236.00000002.141613.1F680000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json01/29" - Source: "00000000-00007236.00000002.141613.1FBA0000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,001/29" - Source: "00000000-00007236.00000002.141613.1FBA0000.00000002.mdmp") Found URL "https://docs.microsoft.com/microsoft-edge/webview2/concepts/versioningnable" - Source: "00000000-00007236.00000002.141613.1FC12000.00000002.mdmp") Found URL "https://docs.microsoft.com/microsoft-edge/webview2/concepts/versioningorewebview2" - Source: "00000000-00007236.00000002.141613.1FC12000.00000002.mdmp") Found URL "https://docs.microsoft.com/microsoft-edge/webview2/concepts/versioning60a417ca-f1ab-4307-801b-f96003f8938b" - Source: "00000000-00007236.00000002.141613.1FC12000.00000002.mdmp") Found URL "https://docs.microsoft.com/microsoft-edge/webview2/concepts/versioningnet" - Source: "00000000-00007236.00000002.141613.1FC12000.00000002.mdmp") Found URL "https://docs.microsoft.com/microsoft-edge/webview2/concepts/versioningostreamriginouldn't" - Source: "00000000-00007236.00000002.141613.1FC12000.00000002.mdmp") Found URL "https://docs.microsoft.com/microsoft-edge/webview2/concepts/versioning6.0.1054.3160a417ca-f1ab-4307-801b-f96003f8938b" - Source: "00000000-00007236.00000002.141613.1FC12000.00000002.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalroot" - Source: "00000000-00007236.00000002.141613.218A0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007236.00000002.141613.218A0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007236.00000002.141613.218A0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=247104.&click" - Source: "00000000-00007236.00000002.141613.3E080000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=291337%@font-face" - Source: "00000000-00007236.00000002.141613.3E080000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=291257the" - Source: "00000000-00007236.00000002.141613.3E080000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=291257.the" - Source: "00000000-00007236.00000002.141613.3E080000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=291257.s'<0s>'" - Source: "00000000-00007236.00000002.141613.3E080000.00000002.mdmp") Found URL "http://www.w3.org/xml/1998/namespace" - Source: "00000000-00007236.00000002.141613.3E080000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008052.00000000.135401.03300000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008052.00000000.135401.03300000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00008052.00000000.135401.03412000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00008052.00000000.135401.03412000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00008052.00000000.135401.03412000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00008052.00000000.135401.07920000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00008052.00000000.135401.07920000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?emgvw,czc%wvfamsiglobalsign" - Source: "00000000-00008052.00000000.135401.07920000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00008052.00000000.135401.07920000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00008052.00000000.135401.07920000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00008052.00000000.135401.07920000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00008052.00000000.135401.07920000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%ydigicert" - Source: "00000000-00008052.00000000.135401.07920000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00008052.00000000.135401.07920000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00008052.00000000.135401.07920000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00008052.00000000.135401.07920000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008052.00000000.135401.07920000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0k1" - Source: "00000000-00008052.00000000.135401.07920000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00008052.00000000.135401.07920000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00008052.00000000.135401.07920000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00008052.00000000.135401.07920000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00008052.00000000.135401.07920000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008052.00000000.135401.07920000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00008052.00000000.135401.07920000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00008052.00000000.135401.07920000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00008052.00000000.135401.07920000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00008052.00000000.135401.07920000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008052.00000000.135401.07920000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00008052.00000000.135401.07920000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008052.00000000.135401.07920000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00008052.00000001.135804.07920000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%ydigicert" - Source: "00000000-00008052.00000001.135804.07920000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00008052.00000001.135804.07920000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00008052.00000001.135804.07920000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00008052.00000001.135804.07920000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008052.00000001.135804.07920000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0k1" - Source: "00000000-00008052.00000001.135804.07920000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00008052.00000001.135804.07920000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00008052.00000001.135804.07920000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00008052.00000001.135804.07920000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00008052.00000001.135804.07920000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008052.00000001.135804.07920000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00008052.00000001.135804.07920000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00008052.00000001.135804.07920000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00008052.00000001.135804.07920000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00008052.00000001.135804.07920000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008052.00000001.135804.07920000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00008052.00000001.135804.07920000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00008052.00000001.135804.07920000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00008052.00000001.135804.07920000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0microsoft.powershell.cmdletization.generatedtypesrefemit_inmemorymanifestmodulemscorlibsystemenummapsreportingtypemicrosoft.powershell.cmdletization.generatedtypes.mppreferencevalue__disabledbasicadvancedsubmitsamplesconsenttypenonealwaysnevereverydaysundaymondaytuesdaywednesdaythursdayfridaysaturdayscantypequickscanfullscanscandirectionbothincomingoutcomingthreatseverityunknownmoderatehighseverethreatactioncleanquarantineremoveallowuserdefinednoactionblockpuaprotectiontypeenabledauditmodecloudblockleveltypedefaulthighpluszerotoleranceasrruleactiontypemicrosoft.powershell.cmdletization.generatedtypes.mpscancustomscanupdatesourcemicrosoft.powershell.cmdletization.generatedtypes.mpsignatureinternaldefinitionupdateservermicrosoftupdateservermmpcfilesharespme" - Source: "00000000-00008052.00000001.135804.07920000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06" - Source: "00000000-00008052.00000001.135804.07920000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr" (Indicator: "GetDC"; Source: "00000000-00004460.00000000.139120.02F40000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004460.00000000.139120.02F40000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004460.00000000.139120.02F40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004460.00000000.139120.02F40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004460.00000000.139120.02F40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004460.00000000.139120.02F40000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004460.00000000.139120.02F40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004460.00000000.139120.02F40000.00000004.mdmp")5d:T9f1,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00004460.00000000.139120.00407000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00004460.00000000.139120.00407000.00000002.mdmp") Found reference to API "3419727230,5524,3117,,FindFirstFileA,kernel32.dll,"00:36:10.390",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00004460.00000000.139120.02F40000.00000004.mdmp") Found reference to API "3670133812,5524,3117,,FindFirstFileA,kernel32.dll,"00:36:10.484",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00004460.00000000.139120.02F40000.00000004.mdmp") Found reference to API "3421750414,5524,3117,,FindFirstFileA,kernel32.dll,"00:36:10.390",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00004460.00000000.139120.02F40000.00000004.mdmp") Found reference to API "3422446340,5524,3117,,FindFirstFileA,kernel32.dll,"00:36:10.390",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00004460.00000000.139120.02F40000.00000004.mdmp") Found reference to API "3419179696,5524,3117,,FindFirstFileA,kernel32.dll,"00:36:10.390",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00004460.00000000.139120.02F40000.00000004.mdmp") Found reference to API "3424375432,5524,3119,,FindNextFileA,kernel32.dll,"00:36:10.390",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00004460.00000000.139120.02F40000.00000004.mdmp") Found reference to API "3423367150,5524,3117,,FindFirstFileA,kernel32.dll,"00:36:10.390",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00004460.00000000.139120.02F40000.00000004.mdmp") Found reference to API "10130739328,6740,3118,,FindFirstFileW,kernel32.dll,"00:35:26.625",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00004604.00000000.136141.07060000.00000004.mdmp") Found reference to API "10239080820,3780,3120,,FindNextFileW,kernel32.dll,"00:35:26.671",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00004604.00000000.136141.07060000.00000004.mdmp") Found reference to API "10238241804,3780,3118,,FindFirstFileW,kernel32.dll,"00:35:26.671",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00004604.00000000.136141.07060000.00000004.mdmp")5e:Teeb,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "nsExec.dll") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "nsExec.dll") Found reference to API "GetModuleHandle failed" (Indicator: "GetModuleHandle"; File: "00000000-00004888.00000000.138779.00A51000.00000020.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "Module32First" (Indicator: "Module32First"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "Module32Next" (Indicator: "Module32Next"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "82007171548,1508,3125,,Process32NextW,kernel32.dll,"00:36:22.203",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00002724.00000001.139694.02840000.00000004.mdmp") Found reference to API "153843297876,1508,3125,,Process32NextW,kernel32.dll,"00:36:52.140",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00002724.00000002.141614.02840000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004460.00000000.139120.00407000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004460.00000000.139120.00407000.00000002.mdmp") Found reference to API "2363600572,5524,3121,,CreateToolhelp32Snapshot,kernel32.dll,"00:36:09.937",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004460.00000000.139120.02F40000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004604.00000000.136141.71E75000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004604.00000000.136141.71E75000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004604.00000000.136141.71E75000.00000002.mdmp")5f:T44a,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "nsExec.dll") Found reference to API "GetModuleHandle failed" (Indicator: "GetModuleHandle"; File: "00000000-00004888.00000000.138779.00A51000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004460.00000000.139120.00407000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004604.00000000.136141.71E75000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004604.00000000.136141.71E75000.00000002.mdmp")60:T1023,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin") file/memory contains long string with (Indicator: "GetTempFileName"; File: "nsExec.dll") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00004460.00000000.139120.00407000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00004460.00000000.139120.00407000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00004460.00000000.139120.00407000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00004460.00000000.139120.00407000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00004460.00000000.139120.00407000.00000002.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00004460.00000000.139120.00407000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004460.00000000.139120.00407000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004460.00000000.139120.00407000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004460.00000000.139120.00407000.00000002.mdmp")61:Tfe0,Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; File: "3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00002724.00000001.139694.00416000.00000002.mdmp") Found reference to API "82073566628,1508,111,,GetSystemMetrics,user32.dll,"00:36:22.234",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002724.00000001.139694.02840000.00000004.mdmp") Found reference to API "82070707936,1508,111,,GetSystemMetrics,user32.dll,"00:36:22.234",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002724.00000001.139694.02840000.00000004.mdmp") Found reference to API "82073706888,1508,111,,GetSystemMetrics,user32.dll,"00:36:22.234",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002724.00000001.139694.02840000.00000004.mdmp") Found reference to API "82067945584,1508,111,,GetSystemMetrics,user32.dll,"00:36:22.234",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002724.00000001.139694.02840000.00000004.mdmp") Found reference to API "82073262130,1508,111,,GetSystemMetrics,user32.dll,"00:36:22.234",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002724.00000001.139694.02840000.00000004.mdmp") Found reference to API "82072993192,1508,111,,GetSystemMetrics,user32.dll,"00:36:22.234",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002724.00000001.139694.02840000.00000004.mdmp") Found reference to API "82073827598,1508,111,,GetSystemMetrics,user32.dll,"00:36:22.234",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002724.00000001.139694.02840000.00000004.mdmp") Found reference to API "82067810684,1508,111,,GetSystemMetrics,user32.dll,"00:36:22.234",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002724.00000001.139694.02840000.00000004.mdmp") Found reference to API "82070084284,1508,111,,GetSystemMetrics,user32.dll,"00:36:22.234",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002724.00000001.139694.02840000.00000004.mdmp") Found reference to API "153871423980,1508,111,,GetSystemMetrics,user32.dll,"00:36:52.140",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002724.00000002.141614.02840000.00000004.mdmp") Found reference to API "153870618636,1508,111,,GetSystemMetrics,user32.dll,"00:36:52.140",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002724.00000002.141614.02840000.00000004.mdmp") Found reference to API "153871705080,1508,111,,GetSystemMetrics,user32.dll,"00:36:52.140",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002724.00000002.141614.02840000.00000004.mdmp") Found reference to API "153870846906,1508,111,,GetSystemMetrics,user32.dll,"00:36:52.140",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002724.00000002.141614.02840000.00000004.mdmp") Found reference to API "153870558448,1508,111,,GetSystemMetrics,user32.dll,"00:36:52.140",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002724.00000002.141614.02840000.00000004.mdmp") Found reference to API "153867829864,1508,111,,GetSystemMetrics,user32.dll,"00:36:52.140",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002724.00000002.141614.02840000.00000004.mdmp") Found reference to API "153871476434,1508,111,,GetSystemMetrics,user32.dll,"00:36:52.140",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002724.00000002.141614.02840000.00000004.mdmp") Found reference to API "153871639714,1508,111,,GetSystemMetrics,user32.dll,"00:36:52.140",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002724.00000002.141614.02840000.00000004.mdmp") Found reference to API "153871175794,1508,111,,GetSystemMetrics,user32.dll,"00:36:52.140",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002724.00000002.141614.02840000.00000004.mdmp") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00004460.00000000.139120.00407000.00000002.mdmp")62:T52f,Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00004604.00000000.136141.08440000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00004604.00000000.136141.08440000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00004604.00000000.136141.08650000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00004604.00000000.136141.08650000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00004604.00000000.136141.08790000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00004604.00000000.136141.08790000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00004604.00000000.136141.08790000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00004604.00000001.136518.02AE0000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00004604.00000001.136518.02AE0000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00004604.00000001.136518.02AE0000.00000004.mdmp")63:T59e,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00000204.00000000.139509.D1790000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002724.00000001.139694.02840000.00000004.mdmp, 00000000-00002724.00000002.141614.02840000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00003800.00000000.139310.23AD0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00004456.00000000.139359.56C00000.00000004.mdmp") Found string "NDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004460.00000000.139120.02F40000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00004468.00000000.140007.C9E90000.00000004.mdmp") Found string "NDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004492.00000000.139765.036C0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004604.00000000.136141.02AE0000.00000004.mdmp, 00000000-00004604.00000001.136518.02AE0000.00000004.mdmp")64:T889,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004460.00000000.139120.02F40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00004460.00000000.139120.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00003800-00000BC0-1060345193\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00004604.00000000.136141.02AE0000.00000004.mdmp, 00000000-00004604.00000000.136141.07060000.00000004.mdmp, 00000000-00004604.00000001.136518.07060000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004916.00000000.139858.0078D000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007236.00000002.141613.3E080000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"powershell.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin\")\n file/memory contains long string with (Indicator: \"GetTickCount\"; File: \"nsExec.dll\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00004604.00000000.136141.08440000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00004468.00000000.140007.C9E90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00003800.00000000.139310.23AD0000.00000004.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00004468.00000000.140007.C9E90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$2c","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00004604.00000000.136141.08440000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00004604.00000001.136518.08620000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.99682","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Able to import cryptographic keys (seen in ransomware)\n Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: YARA signature match – Encryption algorithm\n Matched sigs: Calls an API typically used to import cryptographic keys into a CSP\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2d","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"pran.exe\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004916-00000C2C-994034502\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004916-00000C2C-994809970\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002724.00000001.139694.00416000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00002724.00000001.139694.04A10000.00000004.mdmp, 00000000-00002724.00000002.141614.04A51000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00002724.00000001.139694.04A10000.00000004.mdmp, 00000000-00002724.00000002.141614.04A51000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"pran.exe\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004916-00000C2C-994034502\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004916-00000C2C-994809970\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002724.00000001.139694.00416000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"WebView2Loader.dll\")\n file/memory contains long string with (Indicator: \"GetCursorPos\"; File: \"pran.exe\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"baghdad.exe\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"nsExec.dll\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00007236-00000C2C-1042746722\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00002724.00000001.139694.00416000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004460.00000000.139120.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004916-00000C2C-993060835\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004916-00000C2C-993061272\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004916-00000C2C-995402713\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004916-00000C2C-995402735\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; File: \"3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00004460.00000000.139120.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"3UMi\" (Indicator: \"\"; File: \"3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"Signee.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"select * from Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; File: \"00000000-00004888.00000000.138779.00A51000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueA\" in file \"3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin\"\n Found registry deletion API: \"RegDeleteKeyA\" in file \"3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin\"\n Found registry deletion API: \"RegDeleteKeyExA\" in file \"3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin\"\n Found registry deletion API: \"RegDeleteValueA\" in \"00000000-00004460.00000000.139120.00407000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyA\" in \"00000000-00004460.00000000.139120.00407000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin\")\n file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"pran.exe\")\n file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"baghdad.exe\")\n file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"SelfDel.dll\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004916-00000C2C-994284778\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004916-00000C2C-994285127\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004916-00000C2C-994285150\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002724.00000001.139694.00416000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004916)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00008052)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004604)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007076)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$63","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; File: \"3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin\")\n file/memory contains long string with (Indicator: \"DeleteFile\"; File: \"nsExec.dll\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002724.00000001.139694.00416000.00000002.mdmp\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004460.00000000.139120.00407000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00004460.00000000.139120.00407000.00000002.mdmp\")\n Found reference to API \"3671916598,5524,3136,,RemoveDirectoryA,kernel32.dll,\"00:36:10.484\",RX=0,PX=0\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00004460.00000000.139120.02F40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify Windows Defender preferences (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-275","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin\")\n Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; File: \"3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin\")\n Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin\")\n file/memory contains long string with (Indicator: \"SeShutdownPrivilege\"; File: \"SelfDel.dll\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00004460.00000000.139120.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00004460.00000000.139120.00407000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"file/memory contains long string with (Indicator: \"InitializeSecurityDescriptor\"; File: \"nsExec.dll\")\n file/memory contains long string with (Indicator: \"SetSecurityDescriptorDacl\"; File: \"nsExec.dll\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin\")\n file/memory contains long string with (Indicator: \"ExitProcess\"; File: \"nsExec.dll\")\n file/memory contains long string with (Indicator: \"TerminateProcess\"; File: \"nsExec.dll\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002724.00000001.139694.00416000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004460.00000000.139120.00407000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004604.00000000.136141.71E75000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002724.00000001.139694.00416000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004460.00000000.139120.00407000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004604.00000000.136141.71E75000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"697bcb2878f009396d0ccb65"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"