24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 4c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Midie.Generic Sample 3e492bc5784a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3e492bc5784a…. Malware family: Midie.Generic. Threat score 100/100. 21/28 AV engines flagged this file. 9 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","keywords":["Malicious","Midie.Generic","malware analysis","sandbox report","threat intelligence","3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Midie.Generic","antivirusDetections":{"malicious":21,"total":28},"behavioralIndicators":{"malicious":9,"suspicious":25},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T209a,Found reference to API (Indicator: "GetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessIoCounters"; Source: "sample.bin"), Found reference to API (Indicator: "OpenThreadToken"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "LocalHandle"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "AddAtomA"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleAliasesLengthA"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetVolumeInformationW"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleAliasExesLengthA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetActiveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcatW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedDecrement"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyIcon"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleCP"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSetInformation"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetTapePosition"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleOutputCharacterA"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessWindowStation"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseSemaphore"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "CreateNamedPipeW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "EnumDateFormatsW"; Source: "sample.bin"), Found reference to API (Indicator: "SetActiveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "SetHandleCount"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "DecodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "DebugActiveProcessStop"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "HeapCreate"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetAce"; Source: "sample.bin"), Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastActivePopup"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "FatalAppExitW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedIncrement"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetComputerNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "ReplaceFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin")26:T474,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp")27:Tab7,"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\B1BC968BD4F49D622AA89A81F2150152A41D829C") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\B31EB1B740E36C8402DADC37D44DF5D4674952F9") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\B31EB1B740E36C8402DADC37D44DF5D4674952F9") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\CA3AFBCF1240364B44B216208880483919937CF7") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\CA3AFBCF1240364B44B216208880483919937CF7") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\CABD2A79A1076A31F21D253635CB039D4329A5E8") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\CABD2A79A1076A31F21D253635CB039D4329A5E8") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D1EB23A46D17D68FD92564C2F1F1601764D8E349") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D1EB23A46D17D68FD92564C2F1F1601764D8E349") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D23209AD23D314232174E40D7F9D62139786633A") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D23209AD23D314232174E40D7F9D62139786633A")28:T641,Found api reference "CryptStringToBinaryA" (Indicator: "CryptStringToBinaryA"; Source: "00000000-00005824.00000001.79813.001F0000.00000004.mdmp") Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "00000000-00005824.00000001.79813.001F0000.00000004.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00005824.00000001.79813.001F0000.00000004.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00005824.00000001.79813.001F0000.00000004.mdmp") Found api reference "CryptBinaryToStringA" (Indicator: "CryptBinaryToStringA"; Source: "00000000-00005824.00000001.79813.001F0000.00000004.mdmp") Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "00000000-00005824.00000001.79813.001F0000.00000004.mdmp") Found api reference "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp") Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp") Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp")29:T620,Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00005824-00000C2C-245852748") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00005824-00000C2C-245852820") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00005824-00000C2C-245852891") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00005824-00000C2C-245853027") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00005824-00000C2C-245853096") Found reference to API "BCryptImportKeyPair" (Indicator: "BCryptImportKey"; Source: "00000000-00005824-00000C2C-251984651") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00005824.00000001.79813.001F0000.00000004.mdmp") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp")2a:T4c0,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Found Crypto currency wallets related strings Matched sigs: Contains CRYPTO related strings Matched sigs: Contains reference to crypto DLLs Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains reference to cryptographic keys Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly]2b:T182e,"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000000000000bcca120058af8569e0d2120092e084694e1b4a8dfeffffff74d112004c9c8469680c000090d112005f9c8469000000000000000000000000000000000000000000000000acd2120001000000a0d1120001000000c0d11200935c207740832777d4a01f7712ea2777acd2120001000000 (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000000000000d4cc120000000000c4ff120092e084694e1b4a8d (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000120040674e0234b8120080f43e7500004e020000000089f43e75ff88dde602000000a8b81200a4b812009cb71200a0b7120050b9120095e11b77c2272a00f8b71200c83a48756cb81200d58c4075a8b812003cb8120042a43e75a80248757cb81200d2f43e75080000006ef53e7544f53e75b788dde60200000070aadb710000130026bbdb7150b81200020000000000130070aadb7180b8120042a43e75a8024875c4b8120010a9db7108000000e6a8db71fa5bdedc0200000070aadb710000130026bbdb7174674e0240674e0290b812008050e77150b91200f9f2df71d64b17ad (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001cb11200000000008e0000006cb11200fefffffff4b01200cf002077d6002077268b27778e000000470000006cb1120000000000c8b012000000000030b1120095e11b77ca3d2a00feffffffd60020772f7b0d75010000003200bc06167b0d753cdfdde6 (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000001f00987c29006dd1d876bcc1dde66cae97760000000000000000200200006a54003ec4001f000100000000001f0050011f000c000000987c29000000000002000000180000002c00000048af12000000000000000000030000000caf12003c6e1f77000000000000000000000000e0062300c075e076e006230000000000c075e07628af120079dad876000000000200000080af1200dbd2d87600000000e2d2d87624c1dde66a540000ff2b1f771a9427770000000004021f0000001f008cae120028af12003300c2000a000000da292a00feffffffe0631f7716641f77 (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001f7750591f7734020000400200008a053c0088053c001000000080000000ff2b1f7706de507f20a3ff6dac011f0000001f000100000018bf26000600de000500000000d17373ac011f0000001f0088053c000700d9000500000005000000bcee1f77606f1f0000003c00200000000800d40000000000087d2600506c1f00706d1f00b8a5290018711f0000003c0050e56508087d2600d0e6650895e11b77c2272a00feffffffff2b1f779a2a1f7720a3ff6d10a3ff6d0000000034008a000300000000000000bce66508b8784e024ce6650880f43e7500004e020000000089f43e75 (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000fbc400310301000000e7d8d876020000000c00000010083103100831030b083103000000000000000000003103d8067b0130f3c11f0000000048fac11f95e11b77fa292a00feffffff435c1f7750591f770c000000180000000a0831030808310330342a0010d48f690400000076a6747664f4c11fc1c30ef978f4c11f3ba77476f01f2a0064f4c11f53a37476f0f4c11fd8f4c11f219a7476d41f2a001700000002000000d41f2a00d8f4c11f8fed7676fcf4c11f80f4c11f4fb0767684f4c11fdc338f6914083103f9a37676bc77867601180000001800002aa37676bc778676 (UID: 00000000-00005824)2c:T50e,"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000d4120000000000000000000000000014d412000000000000000000000000004e3cdde408d41200186d0d7508d412002a6d0d751c5c1e7743790d75ffffffff0c0000004c621e771f790d75ffffffff0c0000001cd4120004000000000400000100000030d41200210e2f0000000000 (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005824)2d:T970,"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")2e:T865,"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")2f:T40d,"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00005824)30:T1f72,"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter msvcr100.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter rstrtmgr.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter dbghelp.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "LoadLibrary" with a parameter OLEAUT32 (UID: 00000000-00005824)31:Tcd69,"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter strchr (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter _EH_prolog (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter __CxxFrameHandler3 (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter ??_U@YAPAXI@Z (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter strncpy (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter _wtoi64 (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter atexit (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter ??_V@YAXPAX@Z (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter memmove (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter memchr (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter strtok_s (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter strcpy_s (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter memset (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter VirtualQueryEx (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter FileTimeToSystemTime (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetDriveTypeA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetLogicalDriveStringsA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetStringTypeW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter LCMapStringW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetCPInfo (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter InterlockedIncrement (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter InterlockedDecrement (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter IsValidCodePage (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter TlsSetValue (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CharToOemA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetCurrentHwProfileA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter lstrcatA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter OpenEventA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetUserDefaultLangID (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter VirtualAllocExNuma (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetComputerNameA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter lstrcpyA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetSystemTime (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SystemTimeToFileTime (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CreateDCA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CryptStringToBinaryA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter sscanf (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GlobalSize (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter Process32Next (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetSystemPowerStatus (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetVolumeInformationA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetWindowsDirectoryA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter Process32First (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetLocaleInfoA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter FindNextFileA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter FindFirstFileA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CopyFileA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformationEx (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter lstrcpynA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GdipGetImageEncodersSize (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GdipGetImageEncoders (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromHBITMAP (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GdiplusShutdown (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GdipSaveImageToStream (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GdipFree (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetHGlobalFromStream (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter BCryptGenerateSymmetricKey (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter BCryptCloseAlgorithmProvider (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter BCryptDecrypt (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter BCryptSetProperty (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CloseWindow (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter wsprintfA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetKeyboardLayoutList (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CharToOemW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter wsprintfW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter RegEnumKeyExA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter RegEnumValueA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CryptBinaryToStringA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CryptUnprotectData (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter ShellExecuteExA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter InternetOpenUrlA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter InternetConnectA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter InternetCloseHandle (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter InternetOpenA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter HttpSendRequestA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter HttpOpenRequestA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter InternetCrackUrlA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter HttpQueryInfoA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter InternetSetOptionA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter StrCmpCA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter StrStrA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter StrCmpCW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter PathMatchSpecA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetModuleFileNameExA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter RmRegisterResources (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter RmEndSession (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SymMatchString (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter WinHttpCreateProxyResolver (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter NotifyIpInterfaceChange (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter NotifyUnicastIpAddressChange (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CoInternetCreateZoneManager (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetAddrInfoExW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter WSASocketA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CertControlStore (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter InitializeSecurityContextA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SslOpenProvider (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SslIncrementProviderReferenceCount (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SslImportKey (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetCipherInterface (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter QueryContextAttributesA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter ObjectStublessClient10 (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter HTTPSCertificateTrust (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter HTTPSFinalProv (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SoftpubInitialize (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SoftpubLoadMessage (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SoftpubLoadSignature (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SoftpubCheckCert (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SoftpubCleanup (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetAsymmetricEncryptionInterface (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter BCryptImportKeyPair (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter BCryptVerifySignature (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SslLookupCipherSuiteInfo (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SslLookupCipherLengths (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SealMessage (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SslEncryptPacket (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter UnsealMessage (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SslDecryptPacket (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetRngInterface (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SxsOleAut32MapIIDToProxyStubCLSID (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SxsOleAut32MapIIDToTLBPath (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SxsOleAut32MapConfiguredClsidToReferenceClsid (UID: 00000000-00005824) "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" called "GetProcAddress" with a parameter SxsOleAut32RedirectTypeLibrary (UID: 00000000-00005824)32:Ta2b,"Select * From Win32_OperatingSystem" (Source: 00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp, Indicator: "select * from win32_operatingsystem") "Select * From AntiVirusProduct" (Source: 00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.0025C000.00000004.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp, Indicator: "select * from antivirusproduct") "SELECT target_path, tab_url from downloads" (Source: 00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp, Indicator: "select target_path, tab_url from downloads") "SELECT service, encrypted_token FROM token_service" (Source: 00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp, Indicator: "select service, encrypted_token from token_service") "SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies" (Source: 00000000-00005824.00000001.79813.001F0000.00000004.mdmp, Indicator: "select host_key, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800 name encrypted_value from cookies"), "SELECT origin_url username_value password_value FROM logins" (Source: 00000000-00005824.00000001.79813.001F0000.00000004.mdmp, Indicator: "select origin_url username_value password_value from logins"), "SELECT host isHttpOnly path isSecure expiry name value FROM moz_cookies" (Source: 00000000-00005824.00000001.79813.0023E000.00000040.mdmp, Indicator: "select host ishttponly path issecure expiry name value from moz_cookies"), "SELECT name value FROM autofill" (Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp, Indicator: "select name value from autofill"), "SELECT url FROM moz_places LIMIT 1000" (Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp, Indicator: "select url from moz_places limit 1000"), "SELECT fieldname value FROM moz_formhistory" (Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp, Indicator: "select fieldname value from moz_formhistory"), "SELECT url FROM urls LIMIT 1000" (Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp, Indicator: "select url from urls limit 1000"), "SELECT name_on_card expiration_month expiration_year card_number_encrypted FROM credit_cards" (Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp, Indicator: "select name_on_card expiration_month expiration_year card_number_encrypted from credit_cards")33:Td80,"SOFTWARE\monero-project" in Source: 00000000-00005824.00000000.78995.0023E000.00000040.mdmp 00000000-00005824.00000001.79813.0023E000.00000040.mdmp "SOFTWARE\monero-project\monero-core" in Source: 00000000-00005824.00000000.78995.002F0000.00000040.mdmp 00000000-00005824.00000001.79813.002F0000.00000040.mdmp "Software\Martin Prikryl\WinSCP 2\Configuration" in Source: 00000000-00005824.00000000.78995.002F0000.00000040.mdmp 00000000-00005824.00000001.79813.002F0000.00000040.mdmp "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 00000000-00005824.00000000.78995.002F0000.00000040.mdmp 00000000-00005824.00000001.79813.002F0000.00000040.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00005824.00000000.78995.002F0000.00000040.mdmp 00000000-00005824.00000001.79813.002F0000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp "Software\Microsoft\Office" in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp "Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp "Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp "Software\Valve\Steam" in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner" in Source: 00000000-00005824.00000001.79813.03760000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00005824.00000001.79813.03760000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00005824.00000001.79813.03760000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|RegisteredOrganization" in Source: 00000000-00005824.00000001.79813.03760000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\ProductOptions|ProductSuite" in Source: 00000000-00005824.00000001.79813.03760000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId" in Source: 00000000-00005824.00000001.79813.03760000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00005824.00000001.79813.03760000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|ProductId" in Source: 00000000-00005824.00000001.79813.03760000.00000004.mdmp34:Te76,"SOFTWARE\monero-project" in Source: 00000000-00005824.00000000.78995.0023E000.00000040.mdmp "SOFTWARE\monero-project\monero-core" in Source: 00000000-00005824.00000000.78995.002F0000.00000040.mdmp "Software\Martin Prikryl\WinSCP 2\Configuration" in Source: 00000000-00005824.00000000.78995.002F0000.00000040.mdmp "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 00000000-00005824.00000000.78995.002F0000.00000040.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00005824.00000000.78995.002F0000.00000040.mdmp "SOFTWARE\monero-project" in Source: 00000000-00005824.00000001.79813.0023E000.00000040.mdmp "Software\Microsoft\Office" in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp "Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp "Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp "Software\Valve\Steam" in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp "SOFTWARE\monero-project\monero-core" in Source: 00000000-00005824.00000001.79813.002F0000.00000040.mdmp "Software\Martin Prikryl\WinSCP 2\Configuration" in Source: 00000000-00005824.00000001.79813.002F0000.00000040.mdmp "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 00000000-00005824.00000001.79813.002F0000.00000040.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00005824.00000001.79813.002F0000.00000040.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner" in Source: 00000000-00005824.00000001.79813.03760000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00005824.00000001.79813.03760000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00005824.00000001.79813.03760000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|RegisteredOrganization" in Source: 00000000-00005824.00000001.79813.03760000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\ProductOptions|ProductSuite" in Source: 00000000-00005824.00000001.79813.03760000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId" in Source: 00000000-00005824.00000001.79813.03760000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00005824.00000001.79813.03760000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|ProductId" in Source: 00000000-00005824.00000001.79813.03760000.00000004.mdmp35:T2255,"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "MSIMG32.DLL" at base 6e8c0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "KERNEL32.DLL" at base 76d40000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "MSVCRT.DLL" at base 753e0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "USER32.DLL" at base 76650000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "ADVAPI32.DLL" at base 758e0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "OLE32.DLL" at base 76720000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "OLEAUT32.DLL" at base 75840000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "SHLWAPI.DLL" at base 77330000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "MSVCR100.DLL" at base 69750000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "GDI32.DLL" at base 76920000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "CRYPT32.DLL" at base 75130000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "NTDLL.DLL" at base 771a0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "SSPICLI.DLL" at base 74f30000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "RPCRT4.DLL" at base 756d0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "GDIPLUS.DLL" at base 73a00000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "BCRYPT.DLL" at base 74bc0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75290000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "WININET.DLL" at base 76ef0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "SHELL32.DLL" at base 75a00000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "PSAPI.DLL" at base 759f0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "RSTRTMGR.DLL" at base 69d70000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "DBGHELP.DLL" at base 71db0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "SECUR32.DLL" at base 74dd0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "PROFAPI.DLL" at base 750b0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 713f0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 752e0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "WS2_32.DLL" at base 772f0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "WINHTTP.DLL" at base 71180000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74a70000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74a60000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "IPHLPAPI.DLL" at base 733f0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "USERENV.DLL" at base 75270000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77390000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "URLMON.DLL" at base 76970000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 72cc0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "DNSAPI.DLL" at base 74930000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "CRYPTBASE.DLL" at base 74fa0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "CLBCATQ.DLL" at base 75780000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6dfc0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "DHCPCSVC6.DLL" at base 732c0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 745d0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "DHCPCSVC.DLL" at base 732a0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "RASADHLP.DLL" at base 6dca0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73320000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "COMCTL32.DLL" at base 73f70000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77390000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 772f0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "CRYPTSP.DLL" at base 74ab0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74840000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "CREDSSP.DLL" at base 74770000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 748b0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "RPCRTREMOTE.DLL" at base 75040000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6daf0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 75840000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "NCRYPT.DLL" at base 74be0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74780000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 76ef0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "WINTRUST.DLL" at base 752f0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "GPAPI.DLL" at base 74680000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 77390000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 77390000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76d40000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6ec70000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 72ed0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 71ad0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d10000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 698f0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 758e0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "SXS.DLL" at base 74fb0000 "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" loaded module "OLEAUT32" at base 7584000036:T79b,"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\LOCALSERVER32") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" touched "WBEM Locator" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" touched "WBEM Scripting DateTime" (Path: "HKCU\CLSID\{47DFBE54-CF76-11D3-B38F-00105A1F473A}\TREATAS") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" touched "PSDispatch" (Path: "HKCU\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" touched "PSOAInterface" (Path: "HKCU\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS")37:T949,"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: ""; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: ""; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: ""; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: ""; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE"; Key: ""; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}"; Key: ""; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}"; Key: ""; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\TREATAS"; Key: ""; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\TREATAS"; Key: ""; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\PROGID"; Key: ""; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\PROGID"; Key: ""; Value: "")38:T1007,"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPV6DOMAIN"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE"; Key: "BIND"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\PROGID"; Key: ""; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}"; Key: ""; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\INPROCSERVER32"; Key: ""; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{B06B0CE5-689B-4AFD-B326-0A08A1A647AF}\PROXYSTUBCLSID32"; Key: ""; Value: "")39:Tbe5,"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to touch file "C:\FLTLIB.DLL" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to touch file "C:\MSVCP140.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to touch file "C:\VCRUNTIME140.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to touch file "C:\ucrtbase.DLL" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll"3a:T5c5,"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\JZLF99B5.txt" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies\JZLF99B5.txt"3b:Tcf7,"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to access non-existent file "C:\FLTLIB.DLL" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to access non-existent file "C:\MSVCP140.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to access non-existent file "C:\ucrtbase.DLL" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"3c:T822,Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00005824-00000C2C-245854379") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00005824-00000C2C-245854449") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00005824-00000C2C-245854590") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00005824-00000C2C-245854655") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00005824-00000C2C-245854723") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00005824-00000C2C-245854793") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00005824-00000C2C-245854929") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00005824-00000C2C-249775742") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00005824-00000C2C-249776080") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp")3d:Taf2,Found URL "https://t.me/n@l!/2sq.dl" - Source: "00000000-00005824.00000000.78995.0023E000.00000040.mdmp") Found URL "https://t.me/neoschatssqlm.dllsqlm.dllupdate.zipspr1nupdate.zipmozilla/5.0" - Source: "00000000-00005824.00000000.78995.002F0000.00000040.mdmp") Found URL "https://steamcommunity.com/profiles/76561199644883218spr1nmozilla/5.0" - Source: "00000000-00005824.00000000.78995.002F0000.00000040.mdmp") Found URL "https://t.me/n@l!/2sq.dl" - Source: "00000000-00005824.00000001.79813.0023E000.00000040.mdmp") Found URL "http://ocsp.godaddy.com/0@4http://certificates.godaddy.com/repository/gdig2.crt0*.t.met.me0h+go0?rg" - Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/76561199644883218" - Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp") Found URL "https://web.telegram.orgcontent-security-policy:" - Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp") Found URL "https://web.telegram.orgstrict-transport-security:" - Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp") Found URL "https://web.telegram.org');" - Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp") Found URL "https://telegram.org/img/t_logo_2x.png" - Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp") Found URL "https://t.me/neoschats" - Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp") Found URL "http://www.w3.org/2000/svg" - Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp") Found URL "https://t.me/neoschatssqlm.dllsqlm.dllupdate.zipspr1nupdate.zipmozilla/5.0" - Source: "00000000-00005824.00000001.79813.002F0000.00000040.mdmp") Found URL "https://steamcommunity.com/profiles/76561199644883218spr1nmozilla/5.0" - Source: "00000000-00005824.00000001.79813.002F0000.00000040.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005824.00000001.79813.03240000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig2s1-66226.crl0]v0t00907+http://certificates.godaddy.com/repository/0vj0h0$http://ocsp.godaddy.com/0@4http://certificates.godaddy.com/repository/gdig2.crt0*.t.met.me0h+go0?rg" - Source: "00000000-00005824.00000001.79813.03240000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005824.00000001.79813.03240000.00000004.mdmp")3e:T421,Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp") Found string "I+ncalrpc:[OLE3F428298FB65456291E21E7E9D85]" (Indicator: "ncalrpc"; Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp") Found string "+ncalrpc:[OLE83309A1D85874AC29EEF94E15CCD]" (Indicator: "ncalrpc"; Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp") Found string "+ncalrpc:[OLE40946089B8214EF3843C7CC6E920]" (Indicator: "ncalrpc"; Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp") Found string "+ncalrpc:[OLEDECDD864F89849C680DB794361E0]" (Indicator: "ncalrpc"; Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp") Found string "+ncalrpc:[OLE3F428298FB65456291E21E7E9D85]" (Indicator: "ncalrpc"; Source: "00000000-00005824.00000001.79813.0025C000.00000004.mdmp") Found string "B+ncalrpc:[OLE40946089B8214EF3843C7CC6E920]" (Indicator: "ncalrpc"; Source: "00000000-00005824.00000001.79813.03760000.00000004.mdmp")3f:Tff4,"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPV6DOMAIN"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE"; Key: "BIND"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "")40:Tf1d,"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{2424D572-AAF3-4742-A7C8-03C89CDD7BB0}"; Key: "WPADDECISIONREASON"; Value: "0100000000") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{2424D572-AAF3-4742-A7C8-03C89CDD7BB0}"; Key: "WPADDECISIONTIME"; Value: "A2EA4218AD32DD0100") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{2424D572-AAF3-4742-A7C8-03C89CDD7BB0}"; Key: "WPADDECISION"; Value: "0000000000") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{2424D572-AAF3-4742-A7C8-03C89CDD7BB0}"; Key: "WPADNETWORKNAME"; Value: "Network 8") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-97-85"; Key: "WPADDECISIONREASON"; Value: "0100000000") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-97-85"; Key: "WPADDECISIONTIME"; Value: "A2EA4218AD32DD0100") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-97-85"; Key: "WPADDECISION"; Value: "0000000000") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT"; Key: "CACHEPREFIX"; Value: "000000") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES"; Key: "CACHEPREFIX"; Value: "Cookie:") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY"; Key: "CACHEPREFIX"; Value: "Visited:") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "0000000000") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS"; Key: "SAVEDLEGACYSETTINGS"; Value: "460000000E0200000900000000000000000000000000000004000000000000003071E4E2286CD3010000000000000000000000000100000002000000C0A8F1FC00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0000000000") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0100000000") "3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\137\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US")41:T7a4,Found string "floor" (Source: 3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf, API is part of module: MSVCR100.DLL) Found string "log10" (Source: 3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf, API is part of module: MSVCR100.DLL) Found string "FlsFree" (Source: 3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: 3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: 3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf, API is part of module: KERNELBASE.DLL) Found string "FlsAlloc" (Source: 3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf, API is part of module: KERNELBASE.DLL) Found string "frexp" (Source: 3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf, API is part of module: MSVCR100.DLL) Found string "ldexp" (Source: 3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf, API is part of module: MSVCR100.DLL) Found string "atan2" (Source: 3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf, API is part of module: MSVCR100.DLL) Found string "GetProcessWindowStation" (Source: 3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf, API is part of module: USER32.DLL) Found string "GetUserObjectInformationW" (Source: 3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf, API is part of module: USER32.DLL) Found string "GetLastActivePopup" (Source: 3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf, API is part of module: USER32.DLL) Found string "GetActiveWindow" (Source: 3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf, API is part of module: USER32.DLL) Found string "MessageBoxW" (Source: 3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf, API is part of module: USER32.DLL)42:T13a5,Contains base64 string in header "2B3ahq1OMCAxvnFQ" in header "GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "Keep" in header "GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "User" in header "GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "ocsp" in header "GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "2BMDwwOjAJBgUrDgMCGgUABBQdI2" in header "GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "Keep" in header "GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "User" in header "GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "ocsp" in header "GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "Keep" in header "GET /gdroot-g2.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.godaddy.com" Contains base64 string in header "User" in header "GET /gdroot-g2.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.godaddy.com" Contains base64 string in header "Keep" in header "GET //MEkwRzBFMEMwQTAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCDxp2lE7ehLK HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "User" in header "GET //MEkwRzBFMEMwQTAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCDxp2lE7ehLK HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "ocsp" in header "GET //MEkwRzBFMEMwQTAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCDxp2lE7ehLK HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "/gdig2s1" in header "GET /gdig2s1-9858.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.godaddy.com" Contains base64 string in header "9858" in header "GET /gdig2s1-9858.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.godaddy.com" Contains base64 string in header "Keep" in header "GET /gdig2s1-9858.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.godaddy.com" Contains base64 string in header "User" in header "GET /gdig2s1-9858.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.godaddy.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"43:T4a4,Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "file") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "file") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00005416.00000000.66583.00210000.00000004.mdmp, 00000000-00005416.00000001.68085.00210000.00000004.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00005416.00000000.66583.00210000.00000004.mdmp, 00000000-00005416.00000001.68085.00210000.00000004.mdmp") Found reference to API "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_IDEFAULTANSICODEPAGE" (Indicator: "GetLocaleInfo"; Source: "00000000-00005416.00000001.68085.02380000.00000004.mdmp") Found reference to API "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ICOUNTRY" (Indicator: "GetLocaleInfo"; Source: "00000000-00005416.00000001.68085.02380000.00000004.mdmp") Found reference to API "Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ILANGUAGE" (Indicator: "GetLocaleInfo"; Source: "00000000-00005416.00000001.68085.02380000.00000004.mdmp")44:T96d,"file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")45:T1322,"GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.godaddy.com" Response ==> HTTP/1.1 200 OK Server: Sucuri/Cloudproxy Date: Mon 26 Feb 2024 15:34:07 GMT Content-Type: application/ocsp-response Content-Length: 2030 Connection: keep-alive X-Sucuri-ID: 11022 Content-Transfer-Encoding: Binary Cache-Control: public no-transform must-revalidate Last-Modified: Mon 26 Feb 2024 00:25:56 GMT Expires: Tue 27 Feb 2024 00:25:56 GMT ETag: "f7ad05ac3218a4c43695414201f164230c4888a4" P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" X-Sucuri-Cache: HIT with response body ==>308207EA0A0100A08207E3308207DF06092B0601050507300101048207D0308207CC3081D8A15D305B310B3009060355040613025553311A3018060355040A13....... "GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.godaddy.com" Response ==> HTTP/1.1 200 OK Server: Sucuri/Cloudproxy Date: Mon 26 Feb 2024 15:34:08 GMT Content-Type: application/ocsp-response Content-Length: 2061 Connection: keep-alive X-Sucuri-ID: 11022 Content-Transfer-Encoding: Binary Cache-Control: public no-transform must-revalidate Last-Modified: Mon 26 Feb 2024 07:56:22 GMT Expires: Tue 27 Feb 2024 07:56:22 GMT ETag: "09afe95bf1a58f0e1f179f8b8b919f8018a6c649" P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" X-Sucuri-Cache: HIT with response body ==>308208090A0100A0820802308207FE06092B0601050507300101048207EF308207EB3081D6A15D305B310B3009060355040613025553311A3018060355040A13....... "GET /gdroot-g2.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.godaddy.com" Response ==> HTTP/1.1 200 OK Server: Sucuri/Cloudproxy Date: Mon 26 Feb 2024 15:34:09 GMT Content-Type: application/x-pkcs7-crl Content-Length: 514 Connection: keep-alive X-Sucuri-ID: 11036 Last-Modified: Thu 05 Oct 2023 22:05:06 GMT ETag: "202-606ff510c8e39" Cache-Control: public no-transform must-revalidate Expires: Fri 12 Jan 2024 05:00:19 GMT P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" X-Sucuri-Cache: HIT Accept-Ranges: bytes with response body ==>308201FE3081E7020101300D06092A864886F70D01010B0500308183310B30090603550406130255533110300E060355040813074172697A6F6E613113301106....... "GET //MEkwRzBFMEMwQTAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCDxp2lE7ehLK HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.godaddy.com" Response ==> HTTP/1.1 200 OK Server: Sucuri/Cloudproxy Date: Mon 26 Feb 2024 15:34:09 GMT Content-Type: application/ocsp-response Content-Length: 2107 Connection: keep-alive X-Sucuri-ID: 11022 Content-Transfer-Encoding: Binary Cache-Control: public no-transform must-revalidate Last-Modified: Mon 26 Feb 2024 03:49:08 GMT Expires: Tue 27 Feb 2024 03:49:08 GMT ETag: "4c89a3a80f9057047020e2e325f6d97da73730b0" P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" X-Sucuri-Cache: HIT with response body ==>308208370A0100A08208303082082C06092B06010505073001010482081D308208193081D8A1583056310B3009060355040613025553311A3018060355040A13....... "GET /gdig2s1-9858.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.godaddy.com" Response ==> HTTP/1.1 200 OK Server: Sucuri/Cloudproxy Date: Mon 26 Feb 2024 15:34:10 GMT Content-Type: application/x-pkcs7-crl Content-Length: 28140 Connection: keep-alive X-Sucuri-ID: 11036 Last-Modified: Sun 25 Feb 2024 03:53:27 GMT ETag: "6dec-6122cbc4e4554" Cache-Control: public no-transform must-revalidate Expires: Mon 26 Feb 2024 18:19:59 GMT P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" X-Sucuri-Cache: HIT Accept-Ranges: bytes with response body ==>30826DE830826CD0020101300D06092A864886F70D01010B05003081B4310B30090603550406130255533110300E060355040813074172697A6F6E6131133011....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 337 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Mon 26 Feb 2024 15:34:10 GMT Last-Modified: Mon 26 Feb 2024 15:28:33 GMT Server: ECAcc (sac/2507) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32.......46:T1340,Found string "" (Indicator: "text/javascript"; File: "76561199644883218_1_.htm") file/memory contains long string with (Indicator: "text/javascript"; File: "76561199644883218_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199644883218_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199644883218_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199644883218_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199644883218_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199644883218_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199644883218_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199644883218_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199644883218_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199644883218_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199644883218_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199644883218_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199644883218_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199644883218_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199644883218_1_.htm") Found string "" (Indicator: "text/javascript"; File: "76561199644883218_1_.htm") Found string "class="whiteLink">View more info

try{if(window.parent!=null&&window!=window.parent){window.parent.postMessage(JSON.stringify({eventType:'web_app_open_tg_link',eventData:{path_full:\"\\/neoschats\"}}),'https://web.telegram.org');}}catch(e){}\" (Indicator: \"postmessage\"; Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp, 00000000-00005824.00000001.79813.03760000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005824)\n \"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005824)\n \"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00005824)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005824)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" called \"IsWow64Process\" with parameter \"5824\" - (UID: 00000000-00005824)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005824)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00005824)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" called \"GetLocaleInfoW\" with parameter \"0\" - (UID: 00000000-00005824)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005824.00000001.79813.001F0000.00000004.mdmp\")\n Found reference to API \"475658,5820,3150,,IsWow64Process,kernel32.dll,\"252:29:13.164\",RX=0,PX=0\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005824.00000001.79813.03760000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"Select * From Win32_OperatingSystem\" (Indicator: \"select * from \"; Source: \"00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp\")\n Found string \"Select * From AntiVirusProduct\" (Indicator: \"select * from \"; Source: \"00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.0025C000.00000004.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00005824.00000001.79813.001F0000.00000004.mdmp\")\n Found reference to API \"Win32API|System Information Functions|GetWindowsDirectory\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00005824.00000001.79813.03760000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00005824-0000010C-14970095\n \"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00005824-0000010C-14972503","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed Telegram Domain (t .me in TLS SNI)\" (SID: 2041933, Rev: 2, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.0025C000.00000004.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005824.00000001.79813.001F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$2f","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$31","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"149.154.167.99:443\"\n \"23.60.175.16:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$32","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileExW in import section (Source: 3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$33","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process 3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n Process 3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"hapubws@secure-assets.rubiconproject.com\"\n Pattern match: \"info@diginotar.nl\"\n Pattern match: \"cps-requests@verisign.com\"\n Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"Mozilla/5.0 (Linux; Android 11; M2102J20SG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Mobile Safari/537.36 EdgA/97.0.1072.78\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$34","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74BC0000\n \"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74780000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 756D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1800190068e87069@api-ms-win-core-synch-l1-2-0.dll\"\n \"1800190088e87069@api-ms-win-core-synch-l1-2-0.dll\"\n \"0d000e00cc5f7069@ntdll.dll\"\n \"0a000b004ca02f77@mswsock.dll\"\n \"0d000e001094a774@wship6.dll\"\n \"0e000f000094a774@wship6.dll\"\n \"0b000c00f493a774@wship6.dll\"\n \"09000a00e893a774@wship6.dll\"\n \"17001800d093a774@wship6.dll\"\n \"17001800b893a774@wship6.dll\"\n \"12001300a493a774@wship6.dll\"\n \"160017008c93a774@wship6.dll\"\n \"170018007493a774@wship6.dll\"\n \"120013006093a774@wship6.dll\"\n \"120013004c93a774@wship6.dll\"\n \"080009004093a774@wship6.dll\"\n \"08000900dc621477@WS2_32.dll\"\n \"0d000e0054828569@IPHLPAPI.DLL\"\n \"0f001000bc828569@IPHLPAPI.DLL\"\n \"0c000d0014838569@IPHLPAPI.DLL\"\n \"1400150064838569@IPHLPAPI.DLL\"\n \"0c000d00e8838569@IPHLPAPI.DLL\"\n \"1500160020738569@ADVAPI32.dll\"\n \"0e000f00e4738569@ADVAPI32.dll\"\n \"0e000f0050748569@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$36","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf\" file has an entrypoint instructions - \"call\t0x40448d,jmp\t0x4014d0,mov\tedi, edi,push\tebp,mov\tebp, esp,sub\tesp, 0x328,mov\tdword ptr [0x432138], eax,mov\tdword ptr [0x432134], ecx,mov\tdword ptr [0x432130], edx,mov\tdword ptr [0x43212c], ebx,mov\tdword ptr [0x432128], esi,mov\tdword ptr [0x432124], edi,mov\tword ptr [0x432150], ss,mov\tword ptr [0x432144], cs,mov\tword ptr [0x432120], ds,mov\tword ptr [0x43211c], es,mov\tword ptr [0x432118], fs,mov\tword ptr [0x432114], gs,pushfd\t,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".data\" is \"0x1ea800c\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"steamcommunity.com\"\n \"t.me\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\bcryptprimitives.dll\" [Source: 00000000-00005824-00000C2B-250449194]\n Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00005824-00000C2B-253612602]\n Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00005824-00000C2B-254375667]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O=\"GoDaddy.com\n Inc.\", L=Scottsdale, ST=Arizona, C=US\" (SHA1: C2:28:12:7F:8C:B2:D6:C7:3A:96:F0:44:37:DF:F9:9A:E8:C6:84:BC; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Go Daddy Root Certificate Authority - G2, O=\"GoDaddy.com\n Inc.\", L=Scottsdale, ST=Arizona, C=US\" (SHA1: 27:AC:93:69:FA:F2:52:07:BB:26:27:CE:FA:CC:BE:4E:F9:C3:19:B8; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Go Daddy Root Certificate Authority - G2, O=\"GoDaddy.com\n Inc.\", L=Scottsdale, ST=Arizona, C=US\" (SHA1: 47:BE:AB:C9:22:EA:E8:0E:78:78:34:62:A7:9F:45:C2:54:FD:E6:8B; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"JZLF99B5.txt\" has type \"ASCII text\"- Location: [%APPDATA%\\Microsoft\\Windows\\Cookies\\JZLF99B5.txt]- [targetUID: 00000000-00005824]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$37","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$38","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" reads file \"c:\\windows\\system32\\wbem\\wbemdisp.tlb\"\n \"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" reads file \"c:\\windows\\system32\\stdole2.tlb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to perform anti-VM checks using CPUID\n Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Able to identify virtual environment by using web history\n Matched sigs: Reference to an external IP address lookup service identified\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: YARA signature match - References common sandbox DLLs (sandbox evasion)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$3a","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" trying to access non-existent file \"C:\\3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe.Local\\\"\n \"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" trying to access non-existent file \"C:\\3E492BC5784A6FC90242A1CC4604BBAC9D2BA0A68EEA50FDE7E263186CE977CF.EXE.LOCAL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\cookies\\jzlf99b5.txt\"\n \"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" writes file \"%appdata%\\microsoft\\windows\\cookies\\jzlf99b5.txt\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"GET\" object: /neoschats\" - (UID: 00000000-00005824), \"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"GET\" object: /profiles/76561199644883218\" - (UID: 00000000-00005824)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00005824)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" called \"InternetReadFile\" with parameter 1999 (UID: 00000000-00005824)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" called \"InternetOpenA\" (UID: 00000000-00005824)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"Content-Disposition: form-data; name=\"\"; Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\"), Found string \"Content-Type: multipart/form-data; boundary=----\"; Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00005824.00000000.78995.02600000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"www.gmx.net\" [Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp]\n Observed email domain:\"ten.sdapop.evres\" [Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp]\n Observed email domain:\"www.mail.google.com0\" [Source: 00000000-00005824.00000001.79813.03760000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3d","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\")\n Found string \"GET /profiles/76561199644883218 HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\")\n Found string \">HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: e6a4e2358d4eee6122403f3cb835bcbd\n Observed JA3 fingerprint: 5182f54f9c6e99d117d9dde3fa2b4cff","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"149.154.167.99\" on port \"443\"\n HTTPS traffic to \"23.60.175.16\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to SFTP or FTPS file transfer","description":"Found string \"Prikryl\\WinSCP 2\\Configur#&\" (Indicator: \"winscp\"; Source: \"00000000-00005824.00000000.78995.0023E000.00000040.mdmp, 00000000-00005824.00000001.79813.0023E000.00000040.mdmp\")\n Found string \"Software\\Martin Prikryl\\WinSCP 2\\Configuration\" (Indicator: \"winscp\"; Source: \"00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp\")\n Found string \"Software\\Martin Prikryl\\WinSCP 2\\Sessions\" (Indicator: \"winscp\"; Source: \"00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp\")\n Found string \"Soft: WinSCP\" (Indicator: \"winscp\"; Source: \"00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1048.002","relevance":1,"id":"string-724","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"CreateDCA\" (Indicator: \"CreateDC\"; Source: \"00000000-00005824.00000001.79813.001F0000.00000004.mdmp\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00005824.00000001.79813.001F0000.00000004.mdmp\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00005824.00000001.79813.001F0000.00000004.mdmp\")\n Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; Source: \"00000000-00005824.00000001.79813.001F0000.00000004.mdmp\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"00000000-00005824.00000001.79813.001F0000.00000004.mdmp\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00005824.00000001.79813.001F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00005824-00000C2C-243200280\")\n Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegGetValueA\" in \"00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp\"\n Found registry query API: \"RegOpenKeyExA\" in \"00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.0025C000.00000004.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp\"\n Found registry query API: \"RegQueryValueExA\" in \"00000000-00005824.00000001.79813.001F0000.00000004.mdmp\"\n Found registry query API: \"RegEnumKeyExA\" in \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\"\n Found registry query API: \"RegEnumValueA\" in \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp\")\n Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\Certificates\\* (UID: 00000000-00005824)\n \"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00005824)\n \"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\CRLs\\* (UID: 00000000-00005824)\n \"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\CTLs\\* (UID: 00000000-00005824)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"0\"}\n \"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"\" (Indicator: \"base64\"; Source: \"00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp\")\n Found string \"TLS_DHE_RSA_WITH_AES_128_GCM_SHA256\" (Indicator: \"aes\"; Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\")\n Found string \"moc.5432.hcraesgg\" (Indicator: \"aes\"; Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\")\n Found string \"ten.mrofdaes.revres\" (Indicator: \"aes\"; Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\")\n Found string \"moc.hcraeserdracerocs\" (Indicator: \"aes\"; Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\")\n Found string \"ten.mrofdaes\" (Indicator: \"aes\"; Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\")\n Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00005824.00000001.79813.001F0000.00000004.mdmp\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current hardware profile (API string)","description":"Found reference to API \"GetCurrentHwProfileA\" (Indicator: \"GetCurrentHwProfile\"; Source: \"00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-159","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005824.00000001.79813.001F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"Win32API|GetSystemMetrics|SM_DEBUG\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005824.00000001.79813.03760000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"passwords.txt)\" (Indicator: \"password\"; Source: \"00000000-00005824.00000000.78995.0023E000.00000040.mdmp, 00000000-00005824.00000001.79813.0023E000.00000040.mdmp\")\n Found string \"passwords.txt\" (Indicator: \"password\"; Source: \"00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp\")\n Found string \"SELECT origin_url, username_value, password_value FROM logins\" (Indicator: \"password\"; Source: \"00000000-00005824.00000001.79813.001F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"\".0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\\" in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp\n \"Software\\Microsoft\\Office\\13.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\\" in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp\n \"Software\\Microsoft\\Office\\14.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\\" in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp\n \"Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\\" in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp\n \"\\Outlook\\accounts.txt\" in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"HostName\" (Indicator: \"hostname\"; Source: \"00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"Found string \"logins.json\" (Indicator: \"logins.json\"; in Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":1,"id":"string-405","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"Select * From Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp\")\n Found string \"Select * From AntiVirusProduct\" (Indicator: \"antivirusproduct\"; Source: \"00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.0025C000.00000004.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005824.00000001.79813.001F0000.00000004.mdmp\")\n Found string \"Microsoft Windows 7 Professional |C:\\Windows|\\Device\\Harddisk0\\Partition2\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005824.00000001.79813.03760000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005824.00000001.79813.03760000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume1\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005824.00000001.79813.03760000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005824.00000001.79813.03760000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005824.00000001.79813.001F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"System Security","name":"Contains reference to Hijacked CLSID(s)","description":"Observed string: \"CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\" (Indicator: \"{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\") in Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":1,"id":"string-342","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetAce\" which can \"obtain a pointer to an access control entry (ACE) in an access control list (ACL)\" [Source: 3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\"www.credit-agricole.fr\" (Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp, Indicator: \"credit-agricole.fr\")\n \"capitalone.com\" (Source: 00000000-00005824.00000001.79813.0025C000.00000004.mdmp, Indicator: \"capitalone.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"JZLF99B5.txt\" - Location: [%APPDATA%\\Microsoft\\Windows\\Cookies\\JZLF99B5.txt]- [targetUID: 00000000-00005824]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf\" has section name .text with entropy \"7.6723165403377775\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00005824)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 30492-1-0040163D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"Select * From Win32_OperatingSystem\" (Indicator: \" win32_operatingsystem\"; Source: \"00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"20/23 Antivirus vendors marked sample as malicious (86% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 149.154.167.99 on port 443 is sent without HTTP header\n TCP traffic to 23.60.175.16 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - References common sandbox DLLs (sandbox evasion)","description":"YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process \"00000000-00005824\"","origin":"YARA Signature","mitre_attack_id":"T1497.001","relevance":5,"id":"yara-52","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.03760000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"0000000000\")\n \"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleHandleW\n LoadLibraryA\n GetModuleFileNameW\n Sleep\n GetProcAddress\n GetStartupInfoW\n LoadLibraryW\n GetTickCount\n UnhandledExceptionFilter\n TerminateProcess\n CreateFileW\n VirtualProtect\n IsDebuggerPresent\n WriteFile\n CreateDirectoryW\n GetCommandLineW\n GetComputerNameW\n SetKeyboardState","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"20/23 Antivirus vendors marked sample as malicious (86% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Steals sensitive data from browsers","description":"Found string \"SELECT target_path, tab_url from downloads\"; Source: \"00000000-00005824.00000000.78995.002F0000.00000040.mdmp, 00000000-00005824.00000001.79813.002F0000.00000040.mdmp\")\n Found string \"SELECT origin_url, username_value, password_value FROM logins\"; Source: \"00000000-00005824.00000001.79813.001F0000.00000004.mdmp\")\n Found string \"SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies\"; Source: \"00000000-00005824.00000001.79813.0023E000.00000040.mdmp\")\n Found string \"SELECT name, value FROM autofill\"; Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\")\n Found string \"SELECT fieldname, value FROM moz_formhistory\"; Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\")\n Found string \"SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards\"; Source: \"00000000-00005824.00000001.79813.0025C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":10,"id":"string-508","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00005416.00000000.66583.001C0000.00000004.mdmp, 00000000-00005416.00000001.68085.001C0000.00000004.mdmp\")\n Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00005416.00000000.66583.001C0000.00000004.mdmp, 00000000-00005416.00000001.68085.001C0000.00000004.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00005416.00000000.66583.001C0000.00000004.mdmp, 00000000-00005416.00000001.68085.001C0000.00000004.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00005416.00000000.66583.001C0000.00000004.mdmp, 00000000-00005416.00000001.68085.001C0000.00000004.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005416.00000000.66583.002C0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00005416.00000000.66583.001C0000.00000004.mdmp, 00000000-00005416.00000001.68085.001C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$42","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00005416.00000000.66583.001C0000.00000004.mdmp, 00000000-00005416.00000001.68085.001C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"file\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00005416.00000000.66583.001C0000.00000004.mdmp, 00000000-00005416.00000001.68085.001C0000.00000004.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00005416.00000000.66583.002C0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00005416.00000000.66583.001C0000.00000004.mdmp, 00000000-00005416.00000001.68085.001C0000.00000004.mdmp\")\n Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00005416.00000000.66583.00210000.00000004.mdmp, 00000000-00005416.00000001.68085.00210000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"file.exe\" queries volume information of \"C:\\\" at 00000000-00005416-0000010C-24150950\n \"file.exe\" queries volume information of \"C:\\\" at 00000000-00005416-0000010C-26891042","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$44","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ocsp.godaddy.com\"\n \"crl.godaddy.com\"\n \"ocsp.digicert.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005416.00000000.66583.001C0000.00000004.mdmp, 00000000-00005416.00000001.68085.001C0000.00000004.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005416.00000000.66583.00210000.00000004.mdmp, 00000000-00005416.00000000.66583.002C0000.00000040.mdmp, 00000000-00005416.00000001.68085.00210000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"file.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"file.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"\" (Indicator: \"twitter\"; File: \"76561199644883218_1_.htm\")\n Found string \"\" (Indicator: \"twitter\"; File: \"76561199644883218_1_.htm\")\n Found string \"\" (Indicator: \"twitter\"; File: \"76561199644883218_1_.htm\")\n Found string \"\" (Indicator: \"twitter\"; File: \"76561199644883218_1_.htm\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/5.0 (Linux; Android 11; M2102J20SG) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.99 Mobile Safari/537.36 EdgA/97.0.1072.78\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005416-00000C7E-51609632470\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$45","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1059.007","relevance":1,"id":"string-626","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\bcryptprimitives.dll\" [Source: 00000000-00005416-00000C25-54235407]\n Observed system executable string:\"%WINDIR%\\system32\\cryptnet.dll\" [Source: 00000000-00005416-00000C25-55292743]\n Observed system executable string:\"%WINDIR%\\system32\\crypt32.dll\" [Source: 00000000-00005416-00000C25-61664433]\n Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00005416-00000C25-70356280]\n Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00005416-00000C25-70846850]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"file.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Cab1F62.tmp\"\n \"file.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Tar1F63.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"file.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"Tar1F63.tmp\" has type \"data\" - Location: [%TEMP%\\Tar1F63.tmp]\n \"Cab1F62.tmp\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\" - Location: [%TEMP%\\Cab1F62.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"file.exe\" queries basic process information of the \"C:\\Windows\\System32\\cabinet.dll\" (UID: 5416)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D\"\n Found http requests in header \"GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D\"\n Found http requests in header \"GET /gdroot-g2.crl\"\n Found http requests in header \"GET //MEkwRzBFMEMwQTAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCDxp2lE7ehLK\"\n Found http requests in header \"GET /gdig2s1-9858.crl\"\n Found http requests in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$47","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"file.exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\Certificates\\* (UID: 00000000-00005416)\n \"file.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00005416)\n \"file.exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\CRLs\\* (UID: 00000000-00005416)\n \"file.exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\CTLs\\* (UID: 00000000-00005416)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005416.00000000.66583.002C0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00005416.00000000.66583.002C0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegEnumKeyExA\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00005416.00000000.66583.00210000.00000004.mdmp, 00000000-00005416.00000001.68085.00210000.00000004.mdmp\")\n Found reference to API \"RegOpenKeyExA\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00005416.00000000.66583.00210000.00000004.mdmp, 00000000-00005416.00000000.66583.002C0000.00000040.mdmp, 00000000-00005416.00000001.68085.00210000.00000004.mdmp\")\n Found reference to API \"RegEnumValueA\" (Indicator: \"RegEnumValue\"; Source: \"00000000-00005416.00000000.66583.00210000.00000004.mdmp, 00000000-00005416.00000001.68085.00210000.00000004.mdmp\")\n Found reference to API \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00005416.00000000.66583.00210000.00000004.mdmp, 00000000-00005416.00000001.68085.00210000.00000004.mdmp\")\n Found reference to API \"RegGetValueA\" (Indicator: \"RegGetValue\"; Source: \"00000000-00005416.00000000.66583.002C0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"file\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"file\")\n Found reference to API \"GetUserNameA\" (Indicator: \"GetUserName\"; Source: \"00000000-00005416.00000000.66583.001C0000.00000004.mdmp, 00000000-00005416.00000001.68085.001C0000.00000004.mdmp\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; Source: \"00000000-00005416.00000000.66583.002C0000.00000040.mdmp\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00005416.00000000.66583.002C0000.00000040.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00005416.00000000.66583.002C0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text with unusual entropies 7.67231654034","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"1b@ssl.com\"\n Pattern match: \"info@diginotar.nl0\"\n Pattern match: \"cps-requests@verisign.com\"\n Pattern match: \"premium-server@thawte.com0\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"file.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Cab1F62.tmp\" for deletion\n \"file.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Tar1F63.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"file.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Cab1F62.tmp\" with delete access\n \"file.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Tar1F63.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"Cab1F62.tmp\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"- Location: [%TEMP%\\Cab1F62.tmp]- [targetUID: 00000000-00005416]\n \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A \"disallowedcert.stl\" number 1 1 datablock 0x1 compression\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00005416]\n \"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 66791 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00005416]","origin":"Binary File","mitre_attack_id":"T1560","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005800.00000000.66957.04750000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"file.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005800)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"tlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00005800.00000000.66957.04750000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$49","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"file.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\system32\\cmd.exe\" /c timeout /t 5 & del /f /q \"C:\\file.exe\" & del \"%ALLUSERSPROFILE%\\*.dll\"\" & exit\" - (UID: 00000000-00005800), \"cmd.exe\" called \"CreateProcessW\" with parameter \"timeout /t 5\" - (UID: 00000000-00000964)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$4a","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"sqlm_1_.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"sqlm_1_.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x20d400\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\system32\\cmd.exe\" [Source: 00000000-00005800-00000C41-41018225031]\n Observed system executable string:\"\"%WINDIR%\\system32\\cmd.exe\" /c timeout /t 5 & del /f /q \"C:\\file.exe\" & del \"%ALLUSERSPROFILE%\\*.dll\"\" & exit\" [Source: 00000000-00005800-00000C41-41018225031], Observed system executable string:\"%WINDIR%\\SysWOW64\\timeout.exe\" [Source: 00000000-00000964-00000BC0-57172731], Observed system executable string:\"%WINDIR%\\system32\\timeout.exe\" [Source: 00000000-00000964-00000C41-1053487810]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00000000-00000964) was launched with new environment variables: \"FPS_BROWSER_APP_PROFILE_STRING=\"Internet Explorer\", FPS_BROWSER_USER_PROFILE_STRING=\"Default\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"cmd.exe\" (UID: 00000000-00000964) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"timeout.exe\" (UID: 00000000-00003748) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/c timeout /t 5 & del /f /q \"C:\\\\file.exe\" & del \"%ALLUSERSPROFI ...\" (UID: 00000000-00000964), Spawned process \"timeout.exe\" with commandline \"timeout /t 5\" (UID: 00000000-00003748)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"/c timeout /t 5 & del /f /q \"C:\\\\file.exe\" & del \"%ALLUSERSPROFI ...\" (UID: 00000000-00000964), Spawned process \"timeout.exe\" with commandline \"timeout /t 5\" (UID: 00000000-00003748)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"file.exe\" called \"NtQueueApcThread\" (UID: 00000000-00005800)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"file.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"108f91e0\"\n \"lpszHeaders\": \"If-None-Match: \\\"46eef7fb9e77d91:0\\\"If-Modified-Since: Tue, 25 Apr 2023 17:54:30 GMT\"\n \"dwHeadersLength\": \"4294967295\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"file.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"108f91e0\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /neoschats HTTP/1.1Host: t.me\n Connection: Keep-Alive\n Cache-Control: no-cache\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://t.me/neoschats","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"file.exe\" called \"GetComputerNameA\" (UID: 00000000-00005800)\n \"file.exe\" called \"GetComputerNameW\" (UID: 00000000-00005800)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"file.exe\" called \"GetUserNameA\" (UID: 00000000-00005800)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: sqlm_1_.dll]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"file.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0\"; Key: \"PROCESSORNAMESTRING\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"file.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"file.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"file.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"file.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"file.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"file.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"file.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"sqlm_1_.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"file.exe\" wrote 1024 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\T1MM1X3A\\sqlm[1].dll\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"\"file.exe\" called \"Process32FirstW with parameter [System Process]\" (UID: 00000000-00005800)\n \"file.exe\" called \"Process32NextW with parameter System\" (UID: 00000000-00005800)\n \"file.exe\" called \"Process32NextW with parameter smss.exe\" (UID: 00000000-00005800)\n \"file.exe\" called \"Process32NextW with parameter csrss.exe\" (UID: 00000000-00005800)\n \"file.exe\" called \"Process32NextW with parameter wininit.exe\" (UID: 00000000-00005800)\n \"file.exe\" called \"Process32NextW with parameter winlogon.exe\" (UID: 00000000-00005800)\n \"file.exe\" called \"Process32NextW with parameter services.exe\" (UID: 00000000-00005800)\n \"file.exe\" called \"Process32NextW with parameter lsass.exe\" (UID: 00000000-00005800)\n \"file.exe\" called \"Process32NextW with parameter svchost.exe\" (UID: 00000000-00005800)\n \"file.exe\" called \"Process32NextW with parameter fontdrvhost.exe\" (UID: 00000000-00005800)\n \"file.exe\" called \"Process32NextW with parameter dwm.exe\" (UID: 00000000-00005800)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks on FTP client related files","description":"\"file.exe\" opened file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\FILEZILLA\\RECENTSERVERS.XML\"\n \"file.exe\" opened file \"%APPDATA%\\FILEZILLA\\RECENTSERVERS.XML\"","origin":"API Call","mitre_attack_id":"T1005","relevance":8,"id":"api-45","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineW@KERNEL32.dll at 51235-1-0040163D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\"file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"sqlm_1_.dll\" claimed CRC 0 while the actual is CRC 240202","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"file.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\system32\\cmd.exe\" /c timeout /t 5 & del /f /q \"C:\\file.exe\" & del \"%ALLUSERSPROFILE%\\*.dll\"\" & exit\" - (UID: 00000000-00005800)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\timeout.exe\" (Handle: 396)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 88.198.112.251 on port 10050","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Found Putty/Winscp session related registry strings"}],"sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]}],"intel_graph":{"map":{"Adversary:2c7506f6c4aa247d7f6275be52f238ba76ef3f2094a4a826ffba0f00e89549bd":{"type":"Adversary","value":"VICE SPIDER","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Adversary:4836d8b3f07a3cbb115c58849599240d932f0d90963f86bf5ce29d9e1ba7c548":{"type":"Adversary","value":"HOOK SPIDER","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Domain:cdf01902dc74865b319d33563eb35a385ef9dcce31560f5c738f0bc83e264f25":{"type":"Domain","value":"t.me","verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},"Domain:crl.godaddy.com":{"type":"Domain","value":"crl.godaddy.com"},"Domain:ocsp.digicert.com":{"type":"Domain","value":"ocsp.digicert.com"},"Domain:ocsp.godaddy.com":{"type":"Domain","value":"ocsp.godaddy.com"},"Domain:steamcommunity.com":{"type":"Domain","value":"steamcommunity.com"},"File:036a57102385d7f0d7b2deacf932c1c372ae30d924365b7a88f8a26657dd7550":{"type":"File","value":"036a57102385d7f0d7b2deacf932c1c372ae30d924365b7a88f8a26657dd7550"},"File:0b6b5f881a38da76baff3393ccbd19f874f92a848dcadddd37c820eb5aac9ff5":{"type":"File","value":"0b6b5f881a38da76baff3393ccbd19f874f92a848dcadddd37c820eb5aac9ff5"},"File:1c82c681a1102bb6a58a1c33edd431bce62344ef7579d21bf9160332b4a5da83":{"type":"File","value":"1c82c681a1102bb6a58a1c33edd431bce62344ef7579d21bf9160332b4a5da83"},"File:2a571b71dbc7b8b76f65e55fce74e1bbedcd074b071d21558fafc45f0d59fcec":{"type":"File","value":"2a571b71dbc7b8b76f65e55fce74e1bbedcd074b071d21558fafc45f0d59fcec"},"File:314a8d6cd138a32e9a0690f6fd33214372794bd20f99b9489d6bd3e1daf833d9":{"type":"File","value":"314a8d6cd138a32e9a0690f6fd33214372794bd20f99b9489d6bd3e1daf833d9"},"File:3b71bbfe8f25fe8cfa088c49145045d0d0b6bad2389c762a2f23677afa2b4edd":{"type":"File","value":"3b71bbfe8f25fe8cfa088c49145045d0d0b6bad2389c762a2f23677afa2b4edd","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration","Detected relationship with a Threat VidarStealer","confirmed relationship with a Threat","confirmed relationship with an Adversary HOOK SPIDER","confirmed relationship with an Adversary VICE SPIDER"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf":{"type":"File","value":"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat VidarStealer","Dynamic analysis produced likely malicious output file","File reported as dropper by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat VidarStealer","confirmed relationship with an Adversary HOOK SPIDER","confirmed relationship with an Adversary VICE SPIDER"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f":{"type":"File","value":"4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f"},"File:62222525b6b70d3bdf2de5afe848f5788f74b3e40fc49db22bb715620fb5b317":{"type":"File","value":"62222525b6b70d3bdf2de5afe848f5788f74b3e40fc49db22bb715620fb5b317","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration","Detected relationship with a Threat VidarStealer","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat VidarStealer","confirmed relationship with an Adversary HOOK SPIDER","confirmed relationship with an Adversary VICE SPIDER"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:72c54d83573ddd1d68807d8daf51d165a959d80d4937f5edd61a4bd1d44fb1af":{"type":"File","value":"72c54d83573ddd1d68807d8daf51d165a959d80d4937f5edd61a4bd1d44fb1af"},"File:9c0f01dd6dccb1ad1585d5ec9e0998da289a484e5deae6483779674d82878830":{"type":"File","value":"9c0f01dd6dccb1ad1585d5ec9e0998da289a484e5deae6483779674d82878830"},"File:abc2724de3a7d5a42f2cb5900f7ec5120d69881926838f9fc312c9e1df9c2706":{"type":"File","value":"abc2724de3a7d5a42f2cb5900f7ec5120d69881926838f9fc312c9e1df9c2706"},"File:b3e2c15b6f6cc9a628fcb66b8174067ee5cde88feed3de276cbfaaa2313dff8e":{"type":"File","value":"b3e2c15b6f6cc9a628fcb66b8174067ee5cde88feed3de276cbfaaa2313dff8e"},"File:c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d":{"type":"File","value":"c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d"},"File:e63ae44b93ea3b2853b46601f705184cfe5ab78085f5e61be1c9dd1d84e8be9d":{"type":"File","value":"e63ae44b93ea3b2853b46601f705184cfe5ab78085f5e61be1c9dd1d84e8be9d"},"File:e80232b4d18d0bb7e794be263ba937626f383f9917d4b8a737ba893a8f752293":{"type":"File","value":"e80232b4d18d0bb7e794be263ba937626f383f9917d4b8a737ba893a8f752293","verdict":{"verdict":"clean","verdict_source":"Known legitimate files database lookup","reasons":["File found in known legitimate files database"]}},"Ip:149.154.167.99":{"type":"Ip","value":"149.154.167.99"},"Ip:192.124.249.22":{"type":"Ip","value":"192.124.249.22"},"Ip:192.124.249.36":{"type":"Ip","value":"192.124.249.36"},"Ip:192.229.211.108":{"type":"Ip","value":"192.229.211.108"},"Ip:23.59.200.146":{"type":"Ip","value":"23.59.200.146"},"Ip:23.60.175.16":{"type":"Ip","value":"23.60.175.16"},"Ip:88.198.112.251":{"type":"Ip","value":"88.198.112.251"},"Ip:95.217.240.158":{"type":"Ip","value":"95.217.240.158"},"Threat:81f5272cf61469dac849b8f800732474f5623d29bb49baba6056f04ff9872c21":{"type":"Threat","value":"VidarStealer","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat VidarStealer","confirmed relationship with a Threat","confirmed relationship with an Adversary HOOK SPIDER","confirmed relationship with an Adversary VICE SPIDER"]}},"Url://MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D":{"type":"Url","value":"//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D"},"Url://MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D":{"type":"Url","value":"//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D"},"Url://MEkwRzBFMEMwQTAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCDxp2lE7ehLK":{"type":"Url","value":"//MEkwRzBFMEMwQTAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCDxp2lE7ehLK"},"Url:/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D":{"type":"Url","value":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D"},"Url:/gdig2s1-9858.crl":{"type":"Url","value":"/gdig2s1-9858.crl"},"Url:/gdroot-g2.crl":{"type":"Url","value":"/gdroot-g2.crl"},"Url:c14c75ee946069b02d4d87bdb8602e8efc0ce9cb0d66b63ff803961bb41f7b4f":{"type":"Url","value":"https://t.me:443/neoschats","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}},"Url:f7997a6f8ea066b7eb6d933ae3cb255ae500145de346cee3f6fa969d83766b0b":{"type":"Url","value":"https://steamcommunity.com:443/profiles/76561199644883218","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}}},"chains":[{"id":"1543642917635064579","root":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat VidarStealer","Dynamic analysis produced likely malicious output file","File reported as dropper by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat VidarStealer","confirmed relationship with an Adversary HOOK SPIDER","confirmed relationship with an Adversary VICE SPIDER"]}},{"id":"1543642908138254009","root":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","edges":[{"edge_kind":"contacted_domain","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"Domain:cdf01902dc74865b319d33563eb35a385ef9dcce31560f5c738f0bc83e264f25"}],"verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},{"id":"1543642919132712472","root":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"Threat:81f5272cf61469dac849b8f800732474f5623d29bb49baba6056f04ff9872c21"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed relationship with a Threat","confirmed relationship with an Adversary HOOK SPIDER","confirmed relationship with an Adversary VICE SPIDER"]}},{"id":"1543642897456006013","root":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","edges":[{"edge_kind":"memory","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"File:3b71bbfe8f25fe8cfa088c49145045d0d0b6bad2389c762a2f23677afa2b4edd"},{"edge_kind":"is_threat","from_key":"File:3b71bbfe8f25fe8cfa088c49145045d0d0b6bad2389c762a2f23677afa2b4edd","to_key":"Threat:81f5272cf61469dac849b8f800732474f5623d29bb49baba6056f04ff9872c21"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1543642897460200321","root":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","edges":[{"edge_kind":"memory","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"File:3b71bbfe8f25fe8cfa088c49145045d0d0b6bad2389c762a2f23677afa2b4edd"},{"edge_kind":"contains_c2_config","from_key":"File:3b71bbfe8f25fe8cfa088c49145045d0d0b6bad2389c762a2f23677afa2b4edd","to_key":"Url:c14c75ee946069b02d4d87bdb8602e8efc0ce9cb0d66b63ff803961bb41f7b4f"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1543642897456006015","root":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","edges":[{"edge_kind":"memory","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"File:3b71bbfe8f25fe8cfa088c49145045d0d0b6bad2389c762a2f23677afa2b4edd"},{"edge_kind":"contains_c2_config","from_key":"File:3b71bbfe8f25fe8cfa088c49145045d0d0b6bad2389c762a2f23677afa2b4edd","to_key":"Url:f7997a6f8ea066b7eb6d933ae3cb255ae500145de346cee3f6fa969d83766b0b"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1543642909843158646","root":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","edges":[{"edge_kind":"memory","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"File:62222525b6b70d3bdf2de5afe848f5788f74b3e40fc49db22bb715620fb5b317"},{"edge_kind":"is_threat","from_key":"File:62222525b6b70d3bdf2de5afe848f5788f74b3e40fc49db22bb715620fb5b317","to_key":"Threat:81f5272cf61469dac849b8f800732474f5623d29bb49baba6056f04ff9872c21"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1543642897456006016","root":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","edges":[{"edge_kind":"memory","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"File:62222525b6b70d3bdf2de5afe848f5788f74b3e40fc49db22bb715620fb5b317"},{"edge_kind":"contains_c2_config","from_key":"File:62222525b6b70d3bdf2de5afe848f5788f74b3e40fc49db22bb715620fb5b317","to_key":"Url:c14c75ee946069b02d4d87bdb8602e8efc0ce9cb0d66b63ff803961bb41f7b4f"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1543642897456006014","root":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","edges":[{"edge_kind":"memory","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"File:62222525b6b70d3bdf2de5afe848f5788f74b3e40fc49db22bb715620fb5b317"},{"edge_kind":"contains_c2_config","from_key":"File:62222525b6b70d3bdf2de5afe848f5788f74b3e40fc49db22bb715620fb5b317","to_key":"Url:f7997a6f8ea066b7eb6d933ae3cb255ae500145de346cee3f6fa969d83766b0b"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1543642904769361322","root":"File:62222525b6b70d3bdf2de5afe848f5788f74b3e40fc49db22bb715620fb5b317","edges":[],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration","Detected relationship with a Threat VidarStealer","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat VidarStealer","confirmed relationship with an Adversary HOOK SPIDER","confirmed relationship with an Adversary VICE SPIDER"]}},{"id":"1543642903937140742","root":"File:e80232b4d18d0bb7e794be263ba937626f383f9917d4b8a737ba893a8f752293","edges":[],"verdict":{"verdict":"clean","verdict_source":"Known legitimate files database lookup","reasons":["File found in known legitimate files database"]}},{"id":"1543642903351686554","root":"Threat:81f5272cf61469dac849b8f800732474f5623d29bb49baba6056f04ff9872c21","edges":[{"edge_kind":"used_by","from_key":"Threat:81f5272cf61469dac849b8f800732474f5623d29bb49baba6056f04ff9872c21","to_key":"Adversary:2c7506f6c4aa247d7f6275be52f238ba76ef3f2094a4a826ffba0f00e89549bd"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1543642903351686553","root":"Threat:81f5272cf61469dac849b8f800732474f5623d29bb49baba6056f04ff9872c21","edges":[{"edge_kind":"used_by","from_key":"Threat:81f5272cf61469dac849b8f800732474f5623d29bb49baba6056f04ff9872c21","to_key":"Adversary:4836d8b3f07a3cbb115c58849599240d932f0d90963f86bf5ce29d9e1ba7c548"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","edges":[{"edge_kind":"contacted_ip","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"Ip:149.154.167.99"},{"edge_kind":"contacted_ip","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"Ip:23.60.175.16"},{"edge_kind":"contacted_ip","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"Ip:192.124.249.22"},{"edge_kind":"contacted_ip","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"Ip:192.124.249.36"},{"edge_kind":"contacted_ip","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"Ip:23.59.200.146"},{"edge_kind":"contacted_ip","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"Ip:192.229.211.108"},{"edge_kind":"contacted_ip","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"Ip:95.217.240.158"},{"edge_kind":"contacted_ip","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"Ip:88.198.112.251"},{"edge_kind":"contacted_domain","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"Domain:cdf01902dc74865b319d33563eb35a385ef9dcce31560f5c738f0bc83e264f25"},{"edge_kind":"contacted_domain","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"Domain:steamcommunity.com"},{"edge_kind":"resolves_to","from_key":"Domain:steamcommunity.com","to_key":"Ip:23.60.175.16"},{"edge_kind":"contacted_domain","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"Domain:crl.godaddy.com"},{"edge_kind":"resolves_to","from_key":"Domain:crl.godaddy.com","to_key":"Ip:192.124.249.36"},{"edge_kind":"contacted_domain","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"Domain:ocsp.digicert.com"},{"edge_kind":"resolves_to","from_key":"Domain:ocsp.digicert.com","to_key":"Ip:192.229.211.108"},{"edge_kind":"contacted_domain","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"Domain:ocsp.godaddy.com"},{"edge_kind":"resolves_to","from_key":"Domain:ocsp.godaddy.com","to_key":"Ip:192.124.249.36"},{"edge_kind":"contacted_url","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"Url://MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D"},{"edge_kind":"contacted_url","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"Url://MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D"},{"edge_kind":"contacted_url","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"Url:/gdroot-g2.crl"},{"edge_kind":"contacted_url","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"Url://MEkwRzBFMEMwQTAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCDxp2lE7ehLK"},{"edge_kind":"contacted_url","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"Url:/gdig2s1-9858.crl"},{"edge_kind":"contacted_url","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"Url:/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","edges":[{"edge_kind":"extracted","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"File:314a8d6cd138a32e9a0690f6fd33214372794bd20f99b9489d6bd3e1daf833d9"},{"edge_kind":"extracted","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"File:c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d"},{"edge_kind":"extracted","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"File:e63ae44b93ea3b2853b46601f705184cfe5ab78085f5e61be1c9dd1d84e8be9d"},{"edge_kind":"extracted","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"File:b3e2c15b6f6cc9a628fcb66b8174067ee5cde88feed3de276cbfaaa2313dff8e"},{"edge_kind":"extracted","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"File:72c54d83573ddd1d68807d8daf51d165a959d80d4937f5edd61a4bd1d44fb1af"},{"edge_kind":"extracted","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"File:0b6b5f881a38da76baff3393ccbd19f874f92a848dcadddd37c820eb5aac9ff5"},{"edge_kind":"extracted","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"File:1c82c681a1102bb6a58a1c33edd431bce62344ef7579d21bf9160332b4a5da83"},{"edge_kind":"extracted","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"File:abc2724de3a7d5a42f2cb5900f7ec5120d69881926838f9fc312c9e1df9c2706"},{"edge_kind":"extracted","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"File:2a571b71dbc7b8b76f65e55fce74e1bbedcd074b071d21558fafc45f0d59fcec"},{"edge_kind":"extracted","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"File:c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d"},{"edge_kind":"extracted","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"File:4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f"},{"edge_kind":"extracted","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"File:9c0f01dd6dccb1ad1585d5ec9e0998da289a484e5deae6483779674d82878830"},{"edge_kind":"extracted","from_key":"File:3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","to_key":"File:036a57102385d7f0d7b2deacf932c1c372ae30d924365b7a88f8a26657dd7550"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":142,"dropped_files_count":0,"extracted_files_count":13,"files_written_count":36,"files_deleted_count":0,"registry_keys_created_count":11,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":15,"embedded_ips_count":0,"embedded_domains_count":1,"embedded_urls_count":2,"contacted_hosts_count":8,"dns_resolutions_count":5,"contacted_urls_count":6,"http_requests_count":6},"behavior_tags":["commodity","vidarstealer","credentialharvesting","criminal","informationstealer","downloader","evasive","infostealer"],"sample_flags":["Network Traffic","Extracted Files","Sample Crashed","Multi-Process"],"sandbox_reports":[{"id":"6a8a635b301d4d05c40b5c39","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Kryptik.LPW.gen","contacted_countries":["NLD","USA"],"submit_name":"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","analysis_start_time":"2026-08-23T03:05:00+00:00","indicators_count":{"informative":193,"suspicious":43,"malicious":4},"tags":["Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true},{"id":"65dcaed755027e7163048bab","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["DEU","GBR","USA"],"submit_name":"file","analysis_start_time":"2024-02-26T15:31:36+00:00","indicators_count":{"informative":170,"suspicious":44,"malicious":2},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true},{"id":"65dcaecd746cb5af320cff9f","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["DEU","GBR"],"submit_name":"file","analysis_start_time":"2024-02-26T15:31:25+00:00","indicators_count":{"informative":126,"suspicious":43,"malicious":4},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"149.154.167.99","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"address":"23.60.175.16","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"address":"192.124.249.22","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"address":"192.124.249.36","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"address":"23.59.200.146","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"address":"192.229.211.108","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"address":"95.217.240.158","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"address":"88.198.112.251","port":10050,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]}],"dns_resolutions":[{"domain":"t.me","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"domain":"steamcommunity.com","address":"23.60.175.16","ttl":20,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"domain":"crl.godaddy.com","address":"192.124.249.36","ttl":2542,"country":"United States","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"domain":"ocsp.digicert.com","address":"192.229.211.108","ttl":18240,"country":"United States","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"domain":"ocsp.godaddy.com","address":"192.124.249.36","ttl":3115,"country":"United States","registrar_name":"LIQUIDNET LTD.","registrar_organization":"Go Daddy Operating Company, LLC","registrar_name_servers":"A1-245.AKAM.NET","registrar_creation_date":"1999-03-02T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]}],"http_requests":[{"host":"ocsp.godaddy.com","host_ip":"192.124.249.22:80","url":"//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.godaddy.com","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"host":"ocsp.godaddy.com","host_ip":"192.124.249.22:80","url":"//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.godaddy.com","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"host":"crl.godaddy.com","host_ip":"192.124.249.36:80","url":"/gdroot-g2.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gdroot-g2.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.godaddy.com","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"host":"ocsp.godaddy.com","host_ip":"192.124.249.22:80","url":"//MEkwRzBFMEMwQTAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCDxp2lE7ehLK","method":"GET","response_code":"200","response_phrase":"OK","header":"GET //MEkwRzBFMEMwQTAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCDxp2lE7ehLK HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.godaddy.com","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"host":"crl.godaddy.com","host_ip":"192.124.249.36:80","url":"/gdig2s1-9858.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gdig2s1-9858.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.godaddy.com","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"host":"ocsp.digicert.com","host_ip":"192.229.211.108:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.digicert.com","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]}],"embedded_domains":[{"value":"t.me","sources":[{"report_type":"qsp","report_id":""}]}],"embedded_urls":[{"value":"https://t.me:443/neoschats","sources":[{"report_type":"qsp","report_id":""}]},{"value":"https://steamcommunity.com:443/profiles/76561199644883218","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}],"processes":[{"pid":5800,"ppid":0,"name":"file.exe","command_line":"","sha256":"3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf","normalized_path":"C:\\file.exe","uid":"00000000-00005800","icon":"$4b"},{"pid":964,"ppid":5800,"name":"cmd.exe","command_line":"/c timeout /t 5 & del /f /q \"C:\\file.exe\" & del \"%ALLUSERSPROFILE%\\*.dll\"\" & exit","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00005800","uid":"00000000-00000964"},{"pid":3748,"ppid":964,"name":"timeout.exe","command_line":"timeout /t 5","sha256":"35a2d2fc8f5b0baf4dbc489acd24229c0092ff56def50aa3e0043626bc25117f","normalized_path":"%WINDIR%\\SysWOW64\\timeout.exe","parent_uid":"00000000-00000964","uid":"00000000-00003748"}],"all_imported_dlls":["RstrtMgr.dll","usp10.dll","api-ms-win-crt-heap-l1-1-0.dll","ws2_32.dll","ucrtbase.dll","api-ms-win-core-synch-l1-2-0.dll","imm32.dll","KernelBase.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","sspicli.dll","version.dll","ncrypt.dll","dbghelp.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","nlaapi.dll","comctl32.dll","RpcRtRemote.dll","sechost.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","shlwapi.dll","bcrypt.dll","cryptsp.dll","fastprox.dll","gdi32.dll","api-ms-win-core-timezone-l1-1-0.dll","crypt32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","psapi.dll","urlmon.dll","FWPUCLNT.DLL","rsaenh.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","userenv.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","wshqos.dll","msvcp140.dll","winhttp.dll","wship6.dll","cryptbase.dll","netprofm.dll","wbemprox.dll","fltLib.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","msimg32.dll","iertutil.dll","winnsi.dll","bcryptprimitives.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-core-localization-l1-2-0.dll","msvcr100.dll","GdiPlus.dll","webio.dll","mswsock.dll","IPHLPAPI.DLL","wbemsvc.dll","api-ms-win-crt-convert-l1-1-0.dll","wininet.dll","kernel32.dll","ntdll.dll","user32.dll","profapi.dll","secur32.dll","dhcpcsvc6.dll","nsi.dll","rasadhlp.dll","wbemcomn2.dll","wbemdisp.dll","wbemcomn.dll","vcruntime140.dll","WSHTCPIP.DLL","credssp.dll","wintrust.dll","ntdsapi.dll","sxs.dll","tzres.dll","lpk.dll","msvcrt.dll","msctf.dll","api-ms-win-crt-environment-l1-1-0.dll","shell32.dll","clbcatq.dll","dhcpcsvc.dll","schannel.dll","advapi32.dll","rpcrt4.dll","api-ms-win-crt-string-l1-1-0.dll","dnsapi.dll","rpcss.dll","gpapi.dll","ole32.dll","msasn1.dll","api-ms-win-downlevel-user32-l1-1-0.dll","normaliz.dll","uxtheme.dll","VxSSL32.dll","oleaut32.dll","npmproxy.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","cabinet.dll","setupapi.dll","devobj.dll","Wldap32.dll","cryptnet.dll","SensApi.dll","cfgmgr32.dll","devrtl.dll","edputil.dll","pcacli.dll","sfc_os.dll","ntmarta.dll","win32u.dll","OnDemandConnRouteHelper.dll","msIso.dll","SHCore.dll","ncryptsslp.dll","apphelp.dll","propsys.dll","mpr.dll","wow64win.dll","cldapi.dll","imagehlp.dll","wow64.dll","powrprof.dll","wow64cpu.dll","combase.dll","dpapi.dll","gdi32full.dll","kernel.appcore.dll","msvcp_win.dll","aepic.dll","mskeyprotect.dll","Windows.StateRepositoryPS.dll","windows.storage.dll","ntasn1.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"JZLF99B5.txt","sha256":"314a8d6cd138a32e9a0690f6fd33214372794bd20f99b9489d6bd3e1daf833d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"name":"77EC63BDA74BD0D0E0426DC8F8008506","sha256":"c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"name":"156887258BBD6E1FEF562837733EA04E_5BBC02CEDFD3F7AC9E268D830CF231EE","sha256":"e63ae44b93ea3b2853b46601f705184cfe5ab78085f5e61be1c9dd1d84e8be9d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"name":"223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771","sha256":"b3e2c15b6f6cc9a628fcb66b8174067ee5cde88feed3de276cbfaaa2313dff8e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"name":"2D1A90FAFB37AB41025F9A041C0A2FFE","sha256":"72c54d83573ddd1d68807d8daf51d165a959d80d4937f5edd61a4bd1d44fb1af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"0b6b5f881a38da76baff3393ccbd19f874f92a848dcadddd37c820eb5aac9ff5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"name":"67F6625BC22310D5C99DDE12020DBD90","sha256":"1c82c681a1102bb6a58a1c33edd431bce62344ef7579d21bf9160332b4a5da83","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"name":"EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D","sha256":"abc2724de3a7d5a42f2cb5900f7ec5120d69881926838f9fc312c9e1df9c2706","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"name":"EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619","sha256":"2a571b71dbc7b8b76f65e55fce74e1bbedcd074b071d21558fafc45f0d59fcec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"name":"Cab1F62.tmp","sha256":"c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"name":"Tar1F63.tmp","sha256":"4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"name":"76561199644883218_1_.htm","sha256":"9c0f01dd6dccb1ad1585d5ec9e0998da289a484e5deae6483779674d82878830","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"name":"sqlm_1_.dll","sha256":"036a57102385d7f0d7b2deacf932c1c372ae30d924365b7a88f8a26657dd7550","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JZLF99B5.txt","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\67F6625BC22310D5C99DDE12020DBD90","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\67F6625BC22310D5C99DDE12020DBD90","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\156887258BBD6E1FEF562837733EA04E_5BBC02CEDFD3F7AC9E268D830CF231EE","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\156887258BBD6E1FEF562837733EA04E_5BBC02CEDFD3F7AC9E268D830CF231EE","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\2D1A90FAFB37AB41025F9A041C0A2FFE","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\2D1A90FAFB37AB41025F9A041C0A2FFE","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\76561199644883218[1].htm","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"path":"%TEMP%\\Cab1F62.tmp","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"path":"%TEMP%\\Tar1F63.tmp","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\Y93FRGKG.htm","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\4EKOOWYY\\2WB00V67.htm","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\T1MM1X3A\\sqlm[1].dll","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{2424D572-AAF3-4742-A7C8-03C89CDD7BB0}\\","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-50-56-91-97-85\\","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{2424D572-AAF3-4742-A7C8-03C89CDD7BB0}\\00-50-56-91-97-85\\","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{F02887FB-BE88-4C9B-8C42-8C64C2AD2606}\\","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-10-DB-FF-DC-01\\","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{F02887FB-BE88-4C9B-8C42-8C64C2AD2606}\\00-10-DB-FF-DC-01\\","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\P3P\\HISTORY\\","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{2424D572-AAF3-4742-A7C8-03C89CDD7BB0}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-50-56-91-97-85\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{F02887FB-BE88-4C9B-8C42-8C64C2AD2606}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-10-DB-FF-DC-01\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a8a635b301d4d05c40b5c39"},{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65dcaed755027e7163048bab"},{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"name":"SM0:5800:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"name":"Local\\SM0:5800:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"name":"SM0:5800:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]},{"name":"Local\\SM0:5800:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65dcaecd746cb5af320cff9f"}]}]}},"report_ids":{"sandbox_job_ids":["65dcaed755027e7163048bab","65dcaecd746cb5af320cff9f","6a8a635b301d4d05c40b5c39"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Midie.Generic Sample 3e492bc5784a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3e492bc5784a…. Malware family: Midie.Generic. Threat score 100/100. 21/28 AV engines flagged this file. 9 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf"}],["$","meta","4",{"property":"og:title","content":"Malicious Midie.Generic Sample 3e492bc5784a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3e492bc5784a…. Malware family: Midie.Generic. Threat score 100/100. 21/28 AV engines flagged this file. 9 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3e492bc5784a6fc90242a1cc4604bbac9d2ba0a68eea50fde7e263186ce977cf"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Midie.Generic Sample 3e492bc5784a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3e492bc5784a…. Malware family: Midie.Generic. Threat score 100/100. 21/28 AV engines flagged this file. 9 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4c","11",{}]]