26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] af:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T512,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Backdoor.MSIL.Convagent.gen.wuzv Sample 4c9d9e12a691… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4c9d9e12a691…. Malware family: Backdoor.MSIL.Convagent.gen.wuzv. Threat score 100/100. 18/27 AV engines flagged this file. 10 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de","keywords":["Malicious","Backdoor.MSIL.Convagent.gen.wuzv","malware analysis","sandbox report","threat intelligence","4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de"],"about":{"@type":"SoftwareApplication","name":"4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Backdoor.MSIL.Convagent.gen.wuzv","antivirusDetections":{"malicious":18,"total":27},"behavioralIndicators":{"malicious":10,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5e4,file/memory contains long string(File: "245174283040..exe") file/memory contains long string(File: "564987112108.exe") file/memory contains long string(File: "241045424102.exe") file/memory contains long string(File: "667043595059.exe") file/memory contains long string(File: "877111624444.exe") file/memory contains long string(File: "406475284249.exe") file/memory contains long string(File: "070569547007.exe") file/memory contains long string(File: "470345888771.exe") file/memory contains long string(File: "828966903419.exe") file/memory contains long string(File: "926441451361.exe") file/memory contains long string(File: "281343293357.exe") file/memory contains long string(File: "370265125865..exe") file/memory contains long string(File: "314304482630..exe") file/memory contains long string(File: "854387608819.exe") file/memory contains long string(File: "042965728882..exe") file/memory contains long string(File: "023845380061..exe") file/memory contains long string(File: "952236127770..exe") file/memory contains long string(File: "231641341569.exe") file/memory contains long string(File: "776689993087.exe") file/memory contains long string(File: "954994908454.exe") file/memory contains long string(File: "231154504005..exe") file/memory contains long string(File: "707942802384..exe") file/memory contains long string(File: "126517743759..exe") file/memory contains long string(File: "699524611187.exe") file/memory contains long string(File: "248584619219..exe")28:Tdba,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp")29:T4fb,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThread"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp")2a:T1a2d,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") file/memory contains long string with (Indicator: "QueryPerformanceCounter"; File: "094669835264.exe") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "094669835264.exe") file/memory contains long string with (Indicator: "QueryPerformanceCounter"; File: "RCX610E.tmp") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "RCX610E.tmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "NtSignalAndWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp")2b:T515,Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "SetThreadToken" (Indicator: "SetThreadToken"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "OpenThreadToken"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "SetThreadToken" (Indicator: "SetThreadToken"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp")2c:T1094,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp")2d:T4c4,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp")2e:T64b,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "423965423337.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "423965423337.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "425578815803.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "425578815803.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "007136357876.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "007136357876.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "848056272322.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "848056272322.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp")2f:T1dbb,Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to "SHA512" (Indicator: "SHA512"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") file/memory contains long string with (Indicator: "RC2"; File: "489195744284.exe") file/memory contains long string with (Indicator: "SHA384"; File: "809032932684.exe") file/memory contains long string with (Indicator: "SHA384"; File: "510155926035.exe") file/memory contains long string with (Indicator: "SHA384"; File: "618886536425.exe") file/memory contains long string with (Indicator: "SHA384"; File: "879178855366.exe") file/memory contains long string with (Indicator: "SHA384"; File: "998205189910.exe") file/memory contains long string with (Indicator: "Rijndael"; File: "audiodg.exe") file/memory contains long string with (Indicator: "RijndaelManaged"; File: "audiodg.exe") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00001400.00000000.233597.234EE000.00000004.mdmp, 00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.234EE000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00001400.00000000.233597.234EE000.00000004.mdmp, 00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.234EE000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00001400.00000000.233597.234EE000.00000004.mdmp, 00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.234EE000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001400.00000000.233597.234EE000.00000004.mdmp, 00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.234EE000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00001400.00000000.233597.234EE000.00000004.mdmp, 00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.234EE000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000000.233719.6DAEE000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000000.233719.6DAEE000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000000.233719.6DAEE000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000000.233719.6DAEE000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000000.233719.6DAEE000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00007356.00000000.233834.00C02000.00000002.mdmp, 00000000-00007356.00000000.233834.04FC0000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00007356.00000000.233834.00C02000.00000002.mdmp, 00000000-00007356.00000000.233834.04FC0000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00007356.00000000.233834.00C02000.00000002.mdmp, 00000000-00007356.00000000.233834.04FC0000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00007356.00000000.233834.00C02000.00000002.mdmp, 00000000-00007356.00000000.233834.04FC0000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00007356.00000000.233834.00C02000.00000002.mdmp, 00000000-00007356.00000000.233834.04FC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00007356.00000000.233834.04FC0000.00000004.mdmp")30:T72e,Found PE header "MZ" - Source: "00000000-00001400.00000000.233597.234EE000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001400.00000001.233768.234EE000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005724.00000000.233719.107B0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005724.00000000.233719.10A40000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005724.00000000.233719.6DAEE000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005724.00000001.235639.107B0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005724.00000001.235639.10848000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005724.00000001.235639.10859000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005724.00000001.235639.1088B000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005724.00000001.235639.10A40000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005724.00000001.235639.40037000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005724.00000002.237557.10B1C000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005724.00000002.237557.110E6000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007356.00000000.233834.04FC0000.00000004.mdmp")31:T9eb,"" "2.5.29.31" "2.5.29.32" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.17" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.1" "2.5.4.3" "2.5.29.16"7c:T4c3c,Pattern match: "https://clients2.google.com/service/update2/crx" Pattern match: "https://helpx.adobe.com/acrobat/kb/acrobat-failed-load-core-dll.html" Heuristic match: "help.adobe.com" Heuristic match: "adobehelp.corp.adobe.com" Heuristic match: "adobe.com" Pattern match: "https://helpx.adobe.com/acrobat/kb/failed-to-connect-to-dde-server.html" Pattern match: "dc.acrobat.com/link/review" Pattern match: "documentcloud.adobe.com/link/review" Pattern match: "dc.stage.acrobat.com/link/review" Pattern match: "acrobat.adobe.com/link/review" Pattern match: "stage.acrobat.adobe.com/link/review" Pattern match: "documentcloud.adobe.com/id/" Pattern match: "acrobat.adobe.com/id/" Pattern match: "dc.stage.acrobat.com/id/" Pattern match: "stage.acrobat.adobe.com/id/" Heuristic match: "*.com" Heuristic match: "ims-na1.adobelogin.com" Heuristic match: "ims-na1-stg1.adobelogin.com" Heuristic match: "adobeid-na1.services.adobe.com" Pattern match: "www.dropbox.com/oauth2/authorize" Pattern match: "app.box.com/api/oauth2/authorize" Pattern match: "login.live.com/oauth20_authorize.srf" Pattern match: "login.microsoftonline.com/common/oauth2/authorize" Pattern match: "login.microsoftonline.com/common/oauth2/v2.0/authorize" Pattern match: "login.live.com/oauth20_logout.srf" Heuristic match: "accounts.google.com" Heuristic match: "login.windows.net" Heuristic match: "login.microsoftonline.com" Heuristic match: "login.live.com" Pattern match: "www.adobe.com" Pattern match: "www.acrobat.com" Pattern match: "www.microsoft.com" Heuristic match: "*.okta.com" Heuristic match: "*.adobe.com" Heuristic match: "*.adobelogin.com" Pattern match: "https://acrobatoauth.adobe.com" Heuristic match: "https%3a%2f%2facrobatoauth.adobe.com" Pattern match: "https://acrobatoauth.adobe.com/" Pattern match: "https://oobe.adobe.com" Pattern match: "https://oobe.adobe.com/" Heuristic match: "https%3a%2f%2foobe.adobe.com" Heuristic match: "https%3a%2f%2foobe.adobe.com/" Pattern match: "https://msmip.reader.com/authorize" Pattern match: "http://localhost" Heuristic match: "856021680625-2s5o14i1fr9g28s62ck8t2v3tidn3mv2.apps.googleusercontent.com" Heuristic match: "520350406820-ltekb13ghd73bo957uc8retdrflqkb00.apps.googleusercontent.com" Pattern match: "https://mail.google.com/" Pattern match: "https://www.googleapis.com/auth/userinfo.profile" Pattern match: "https://www.googleapis.com/auth/gmail.compose" Pattern match: "https://ims-na1-stg1.adobelogin.com/ims/authorize/v1" Pattern match: "https://ims-na1.adobelogin.com/ims/authorize/v1" Pattern match: "https://ims-na1.adobelogin.com/ims/logout/v1" Pattern match: "https://login.live.com/oauth20_authorize.srf" Pattern match: "https://login.live.com/oauth20_logout.srf" Pattern match: "https://www.dropbox.com/oauth2/authorize" Pattern match: "https://app.box.com/api/oauth2/authorize" Pattern match: "https://login.microsoftonline.com/common/oauth2/authorize" Pattern match: "https://accounts.google.com/o/oauth2/auth" Pattern match: "https://login.windows.net/common/oauth2/authorize" Pattern match: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize" Pattern match: "https://login.microsoftonline.com/common/oauth2/v2.0/logout" Pattern match: "https://commerce-stg.adobe.com/payments/in-app/billing" Pattern match: "https://commerce.adobe.com/payments/in-app/billing" Pattern match: "https://login.microsoftonline.com/" Pattern match: "https://login.windows.net/" Pattern match: "https://adobeid-na1-stg1.services.adobe.com/ims/jump/" Pattern match: "https://adobeid-na1.services.adobe.com/ims/jump/" Pattern match: "https://ims-na1.adobelogin.com/ims/jump/" Heuristic match: "lcs-cops-stage.adobe.io" Heuristic match: "lcs-cops.adobe.io" Heuristic match: "\files.acrobat.com" Pattern match: "https://simulate_offline.adobe.com" Pattern match: "https://acrobatoauth.adobe.com/delegation_end" Heuristic match: "r*.acrobat.com" Heuristic match: "*.echosign.com" Heuristic match: "ims-prod06.adobelogin.com" Heuristic match: "*.echosignpreview.com" Heuristic match: "*.echosignstage.com" Pattern match: "https://no-way-now.org" Pattern match: "https://acrobatoauth.adobe.com/delegation_start" Pattern match: "https://acrobatoauth.adobe.com/delegation_error" Pattern match: "www.stage.acrobat.com" Pattern match: "http://www.adobe.com/go/protected_mode_info" Pattern match: "crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0h" Pattern match: "crl.microsoft.com/pki/crl/products/cspca.crl0h" Pattern match: "isl.md/xyirv@ige/e,a7`o3$*z5dcq{lxfqkjjq|^anb,$~^" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "armmf.adobe.com/arm-manifests/win/http://www.adobe.com/support/downloads/product.jsp?product=1&platform=windowshttp://www.adobe.com/support/downloads/product.jsp?product=10&platform=windowssoftware\adobe\adobe" Pattern match: "https://npcap.com/for" Pattern match: "https://www.tcpdump.org/linktypes.html" Pattern match: "https://www.wireshark.org" Pattern match: "https://docs.microsoft.com/en-us/windows/apps/design/globalizing/use-utf8-code-page" Pattern match: "b.vcv/ygzu-`ud!8l]rf2uyq{vih" Pattern match: "spj-spj.spj/spj0spjdspjespjfspjgspjhspjispjjspjkspjlspjmspjnspjosjpj8spj9spj:spj;spj" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "http://ocsp2.globalsign.com/rootr306/0-0+%http://crl.globalsign.com/root-r3.crl0c\0z0_0402&https://www.globalsign.com/repository/0jee-mih?#ssk~g|globalsign" Pattern match: "www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0je|4x$z#:pb]f/ed'f$vg!c|c" Pattern match: "http://ocsp.thawte.com080604.http://crl.thawte.com/thawtetimestampingca.crl0timestamp-2048-10y@b%symantec" Pattern match: "http://s.symcb.com/pca3-g5.crl00" Pattern match: "http://schemas.microsoft.com/smi/2020/windowssettings" Pattern match: "crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt01$7x06{&mqjj=" Pattern match: "http://crl.geotrust.com/crls/gtglobal.crl04" Pattern match: "java.com/inst-dl-redirectopendeploy.dlladvapi32.dllshell32.dllshlwapi.dllrsdsc:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u161\10277\build\windows-i586\deploy\tmp\jp2launcher\obj\jp2launcher.pdb?gettoolkit@deployuitoolkit@@saaav1@xzconvertsecuritydesc" Pattern match: "java.com/inst-dl-redirectopendeploy.dlladvapi32.dllshell32.dllshlwapi.dllrsdsic:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u131\8869\build\windows-i586\deploy\tmp\jp2launcher\obj\jp2launcher.pdb?gettoolkit@deployuitoolkit@@saaav1@xzconvertsecuritydesc" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0u~d_nlik'lwashington1redmond1microsoft" Pattern match: "http://nsis.sf.net/nsis_errorerror" Pattern match: "https://github.com/dotnet/corefx/tree/8136b3dd606b08acc749645401fdf719b7c5e05ccurve25519wrap.dll" Pattern match: "https://github.com/dotnet/corefx/tree/8136b3dd606b08acc749645401fdf719b7c5e05cmicrosoft.csharp.dll" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "oft.as" Pattern match: "https://pastebin.com/raw/fxzr3jet" Heuristic match: "pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.ms" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Heuristic match: "microsoft-windows-textprediction-package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-package01~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "readme.md" Pattern match: "http://www.unicode.org/copyright.html" Heuristic match: "notifications_emptystate_v3.png.pn" Heuristic match: "lib.ni" Heuristic match: "iguration.se" Heuristic match: "pastebin.com" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315#withcomments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#withcomments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/tr/1999/rec-xpath-19991116" Pattern match: "http://www.w3.org/tr/1999/rec-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#xml" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://schemas.microsoft.com/.netconfiguration/v2.0" Pattern match: "system.web/anonymousidentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browsercaps" Pattern match: "system.web/clienttarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customerrors" Pattern match: "system.web/deployment" Pattern match: "system.web/devicefilters" Pattern match: "system.web/fulltrustassemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthmonitoring" Pattern match: "system.web/hostingenvironment" Pattern match: "system.web/httpcookies" Pattern match: "system.web/httphandlers" Pattern match: "system.web/httpmodules" Pattern match: "system.web/httpruntime" Pattern match: "system.web/identity" Pattern match: "system.web/machinekey" Pattern match: "system.web/membership" Pattern match: "system.web/mobilecontrols" Pattern match: "system.web/pages" Pattern match: "system.web/partialtrustvisibleassemblies" Pattern match: "system.web/processmodel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/rolemanager" Pattern match: "system.web/securitypolicy" Pattern match: "system.web/sessionpagestate" Pattern match: "system.web/sessionstate" Pattern match: "system.web/sitemap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlmappings" Pattern match: "system.web/webcontrols" Pattern match: "system.web/webparts" Pattern match: "system.web/webservices" Pattern match: "system.web/xhtmlconformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputcache" Pattern match: "system.web/caching/outputcachesettings" Pattern match: "system.web/caching/sqlcachedependency" Heuristic match: "/.net/netclasses/httpwebrequest/connect__group$$/" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "https://pastebin.com" Pattern match: "http://pastebin.com" Heuristic match: "host: pastebin.com" Pattern match: "microsoft.net/assembly/gac_msil/system/v4.0_4.0.0.0__b77a5c561934e089/system.dll" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Heuristic match: "astebin.com" Heuristic match: "ntrust.net" Heuristic match: "*.pastebin.com" Pattern match: "www.digicert.com1" Pattern match: "www.digicert.com1+0" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1/0-" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.globalsign.net/root" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1!0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Heuristic match: ".pastebin.com" Pattern match: "crl.microsoft.com/pki/crl/product" Heuristic match: "dobe.com" Heuristic match: "iles.acrobat.com" Heuristic match: "*.acrobat.com" Heuristic match: "ww.stage.acrobat.com" Heuristic match: "win\win_util.cc" Heuristic match: "file_version_info_win.cc" Heuristic match: "files\file_util_win.cc" Heuristic match: "browser\browser_process_impl.cc" Heuristic match: "win\src\win_utils.cc" Heuristic match: "win\src\broker_services.cc" Heuristic match: "..\services\service_manager\sandbox\win\sandbox_win.cc" Heuristic match: "win\src\sandbox_policy_base.cc" Heuristic match: "win\src\target_process.cc" Heuristic match: "win\src\filesystem_policy.cc" Heuristic match: "win\src\registry_policy.cc" Heuristic match: "win\src\named_pipe_policy.cc" Heuristic match: "win\src\process_thread_policy.cc" Heuristic match: "win\src\signed_policy.cc" Heuristic match: "win\src\filesystem_dispatcher.cc" Heuristic match: "win\src\named_pipe_dispatcher.cc" Heuristic match: "win\src\process_thread_dispatcher.cc" Heuristic match: "win\src\sync_dispatcher.cc" Heuristic match: "win\src\registry_dispatcher.cc" Heuristic match: "win\src\signed_dispatcher.cc" Pattern match: "https://rna-pdf-resource.acrobat.com/" Pattern match: "http://www.w3.org/tr/rec-html40" Heuristic match: "mutant_dispatcher.cc" Pattern match: "https://oobe.adobe.com/federation_start" Pattern match: "https://oobe.adobe.com/delegation_start" Pattern match: "https://oobe.adobe.com/delegation_end" Pattern match: "https://oobe.adobe.com/delegation_error" Pattern match: "https://oobe.adobe.com/federation_end" Pattern match: "https://oobe.adobe.com/federation_error" Heuristic match: "process\launch_win.cc" Pattern match: "https://crbug.com/820996" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#"7d:T5823,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004176.00000000.233691.030C0000.00000004.mdmp") Found URL "https://pastebin.com/raw/fxzr3jet%localappdata%localappdata%localappdata%c:\users\hapubws\appdata\localc:\users\hapubws\appdata\localc:\users\hapubws\appdata\localwinlogon@(bs" - Source: "00000000-00004176.00000000.233691.051F0000.00000004.mdmp") Found URL "https://pastebin.com/raw/fxzr3jethttps://pastebin.com/raw/fxzr3jetteeglm0aevie3izirf!" - Source: "00000000-00004176.00000000.233691.051F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005152.00000000.237129.02910000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp") Found URL "http://www.unicode.org/copyright.html" - Source: "00000000-00005724.00000001.235639.1088B000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp") Found URL "https://pastebin.com/raw/fxzr3jet%localappdata%localappdata%localappdata%c:\users\hapubws\appdata\localc:\users\hapubws\appdata\localc:\users\hapubws\appdata\localwinlogonc:\users\hapubws\appdata\local\winlogonc:\users\hapubws\appdata\local\winlogonwinlogonc:\users\hapubws\appdata\local\winlogonc:\users\hapubws\appdata\localc:\users\hapubws\appdata\localc:\users\hapubws\appdata\localc:\users\hapubws\appdata\local\winlogonaudiodg.exe\\.\modeaccessrightssharec:\users\hapubws\documents\diagnostics\audiodg.exei9jlarj0pekn0rumdciuiimzxazty9lik0uy5xcjjolotf2mdrauchkgibt0bg2hzmeutgjqzhh6kj10gp1p6nwe5oaeaobz9smcffpg3nwxpemge7c9xbjkqfrzr2hjoxkoday1oikhugoufab25ggdsb7wrpuqdk73xg7fv7g1eoppnrut3oyhuojbbftjvwgjz1wo8ryoo7zsvrqnk0dx6dzydjdh8qakzzsi34n5mtrjqawk70mnz6r6nwpncfmfny5casuxtmcrsbvfikfdz0mtxixe9vozwgrbl7itwyxj0mfaimbtejwdicaauklki2ntzswkicsfd447r9abgahnfhjrp2jmb06okadjsgkmx7jfbpf8selcjizdwgfln4fpxexptpwdoxddrk1v7lssq5fpyq4ra2ym4aqwizxubwdt38os9jqosndmrvkbbejatemqg0ei18bzznsnp4ynxvvcc6vkzydjjshy9hrv6wqchhdj0rxfzrzfnxurkppszc0hz4mayg5dgo15go3aplba+9xkado3xacticb0hegcmrw==5yszwhafqbreu3y55gzwg==f4elttyyn7yun24dzypqq==g2kbncr2zfrfzbwz9c7dw==n9cu9ilsknk11h1+pqzdw==buo+zl7eha+vmtqoro1sg==eeglm0aevie3izivbl3bsa0vvqgmoerxrsasjbmdfpc9w2y2qvodrm1nrk96ax2sojhutvvd6tic1aq2gujqfmpwdxmiyunij2a7qpgyjf4rf3bgofcrnhk78tm9clz4ybtlm2dp6hwdy1vegw5jrbdutoftware\microsoft\windows\currentversion\runscript.shellreateshortcutargetpathorkingdirectoryqiq6enuhnbeqrnnumudiwpwgw3l2ulqo8haejhphr4cesiabgooorwcywiifccdceqmvfmebsn41pnvtnqswc8ccvzjmvkzkmi8npaqvhsjb9l8rpvkf37ioqln4cunayqrvorx1pcnexml9t5vtx71umx9agkkwfsscvnul7cibzvw5tpsbseqhsps5dvrcd7uzcsw5jvdwjdeva2whw9den7n9ymeitqyclxnfxfxqkondyus1hroz4dtuzj9nu0emobg68maix4s4lubi9lthchref8g0x1ak4bztsxdntznbhvwdufyersipiymgrdqbl3xkucmnjtwphc16afbi4icrosoftervice" - Source: "00000000-00007356.00000000.233834.04FC0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\users\hapubws\documents\diagnostics\audiodg.exe.configfile:///c:/users/hapubws/documents/diagnostics/audiodg.exec:/users/hapubws/documents/diagnostics/audiodg.exec:\users\hapubws\documents\diagnostics\audiodg.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmonikerrflct.invalidfieldfailrflct.invalidpropfail0123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework64\v4.0.30319\c:\windows\microsoft.net\framework64\v4.0.30319\path2path1c:\windows\microsoft.net\framework64\v4.0.30319\configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptormachine.configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configconfig_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibversionmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00007356.00000000.233834.04FC0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007356.00000000.233834.04FC0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007356.00000000.233834.04FC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007356.00000001.235754.03180000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3r" - Source: "00000000-00007356.00000001.235754.03180000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9iqmgvw,czcs;\wthawte," - Source: "00000000-00007356.00000001.235754.1E440000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?es>wwglobalsign" - Source: "00000000-00007356.00000001.235754.1E440000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007356.00000001.235754.1E440000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007356.00000001.235754.1E440000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007356.00000001.235754.1E440000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007356.00000001.235754.1E440000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;sinwaddtrust" - Source: "00000000-00007356.00000001.235754.1E440000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007356.00000001.235754.1E440000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007356.00000001.235754.1E440000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007356.00000001.235754.1E440000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007356.00000001.235754.1E440000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007356.00000001.235754.1E440000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00007356.00000001.235754.1E440000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00007356.00000001.235754.1E440000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007356.00000001.235754.1E440000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007356.00000001.235754.1E440000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00007356.00000001.235754.1E440000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007356.00000001.235754.1EB40000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00007356.00000001.235754.1EB40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007356.00000001.235754.1EB40000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l250905032048z0/^g(o-cejy" - Source: "00000000-00007356.00000001.235754.1EB40000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l3lssruuukssm98j&" - Source: "00000000-00007356.00000001.235754.1EB40000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lrumn9iqmgvw,czcs;\wthawte," - Source: "00000000-00007356.00000002.237675.1E440000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?es>wwglobalsign" - Source: "00000000-00007356.00000002.237675.1E440000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007356.00000002.237675.1E440000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007356.00000002.237675.1E440000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/productqs[\x" - Source: "00000000-00007356.00000002.237675.1E440000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007356.00000002.237675.1E440000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007356.00000002.237675.1E440000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;sinwaddtrust" - Source: "00000000-00007356.00000002.237675.1E440000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007356.00000002.237675.1E440000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007356.00000002.237675.1E440000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007356.00000002.237675.1E440000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007356.00000002.237675.1E440000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007356.00000002.237675.1E440000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00007356.00000002.237675.1E440000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00007356.00000002.237675.1E440000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007356.00000002.237675.1E440000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007356.00000002.237675.1E440000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007356.00000002.237675.1EB40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007356.00000002.237675.1EB40000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00007356.00000002.237675.1EB40000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*latio" - Source: "00000000-00007356.00000002.237675.1EB40000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00007356.00000002.237675.1EB40000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007356.00000002.237675.1EB40000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn" (Indicator: "System.Data.SqlClient"; Source: "00000000-00007356.00000000.233834.04FC0000.00000004.mdmp")84:T8c2,Found registry query API: "RegNotifyChangeKeyValue" in file "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin" Found registry query API: "RegQueryValueExA" in file "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin" Found registry query API: "RegGetValueW" in file "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin" Found registry query API: "RegOpenKeyExA" in file "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin" Found registry query API: "RegOpenKeyA" in file "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin" Found registry query API: "RegQueryValueA" in file "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin" Found registry query API: "RegReadW" in "00000000-00007356.00000000.233834.03180000.00000004.mdmp, 00000000-00007356.00000001.235754.03180000.00000004.mdmp, 00000000-00007356.00000002.237675.03180000.00000004.mdmp" Found registry query API: "RegOpenKeyTransactedW" in "00000000-00007872.00000000.233752.0130B000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00007872.00000000.233752.0130B000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00007872.00000000.233752.0130B000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00007872.00000000.233752.0130B000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00007872.00000000.233752.0130B000.00000002.mdmp" Found registry query API: "RegOpenKeyA" in "00000000-00007872.00000000.233752.0130B000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00007872.00000000.233752.0130B000.00000002.mdmp" Found registry query API: "RegQueryValueA" in "00000000-00007872.00000000.233752.0130B000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00007872.00000000.233752.0130B000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00007872.00000000.233752.0130B000.00000002.mdmp" Found registry query API: "RegNotifyChangeKeyValue" in "00000000-00007872.00000000.233752.0130B000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00007872.00000000.233752.0130B000.00000002.mdmp"85:T826,"audiodg.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004176) "audiodg.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00004176) "audiodg.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004176) "audiodg.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004176) "audiodg.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004176) "audiodg.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00004176) "audiodg.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00004176) "audiodg.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00004176) "audiodg.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00004176) "audiodg.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00004176) "audiodg.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00004176) "audiodg.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00004176) "audiodg.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00004176) "audiodg.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\XClient\* (UID: 00000000-00004176) "audiodg.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\* (UID: 00000000-00004176) "audiodg.exe" called "FindNextFileW" with parameter fb4ba4db52ca77687f807bb068871ec2 (UID: 00000000-00004176) "audiodg.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00004176) "audiodg.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00004176) "audiodg.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00004176)86:T123e,Found string "3MkVixZZbmDG88ovLxqcpXoJ3oDRUBcWtuFG6Sv5dlTZoJoy6aVfjIaESaUVvx5euY0134" (Indicator: "aes"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found string "RijndaelManaged" (Indicator: "rijndael"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found string "FromBase64String" (Indicator: "base64"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found string "ToBase64String" (Indicator: "base64"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found string "ToBase64String" (Indicator: "ToBase64String"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found string "GZipStream" (Indicator: "GzipStream"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found string "CreateDecryptor" (Indicator: "createdecryptor"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found string "CreateEncryptor" (Indicator: "createencryptor"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "245174283040..exe") file/memory contains long string with (Indicator: "zipfile"; File: "245174283040..exe") file/memory contains long string with (Indicator: "aes"; File: "489195744284.exe") file/memory contains long string with (Indicator: "aes"; File: "077817523037..exe") file/memory contains long string with (Indicator: "aes"; File: "580539875475.exe") file/memory contains long string with (Indicator: "aes"; File: "audiodg.exe") file/memory contains long string with (Indicator: "base64"; File: "audiodg.exe") file/memory contains long string with (Indicator: "FromBase64String"; File: "audiodg.exe") file/memory contains long string with (Indicator: "ToBase64String"; File: "audiodg.exe") file/memory contains long string with (Indicator: "rijndael"; File: "audiodg.exe") file/memory contains long string with (Indicator: "Rijndaelmanaged"; File: "audiodg.exe") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "828966903419.exe") file/memory contains long string with (Indicator: "zipfile"; File: "828966903419.exe") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "926441451361.exe") file/memory contains long string with (Indicator: "zipfile"; File: "926441451361.exe") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "281343293357.exe") file/memory contains long string with (Indicator: "zipfile"; File: "281343293357.exe") file/memory contains long string with (Indicator: "zipfile"; File: "370265125865..exe") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "314304482630..exe") file/memory contains long string with (Indicator: "zipfile"; File: "314304482630..exe") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "854387608819.exe") file/memory contains long string with (Indicator: "zipfile"; File: "854387608819.exe") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "042965728882..exe") file/memory contains long string with (Indicator: "zipfile"; File: "042965728882..exe") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "023845380061..exe") file/memory contains long string with (Indicator: "zipfile"; File: "023845380061..exe") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "952236127770..exe") file/memory contains long string with (Indicator: "zipfile"; File: "952236127770..exe") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "231641341569.exe") file/memory contains long string with (Indicator: "zipfile"; File: "231641341569.exe") file/memory contains long string with (Indicator: "zipfile"; File: "776689993087.exe")87:T5f4,Found reference to API "OpenClipboard" (Indicator: "OpenClipboard"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetClipboardFormatNameW" (Indicator: "GetClipboardFormatName"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetOpenClipboardWindow" (Indicator: "OpenClipboard"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetClipboardFormatNameA" (Indicator: "GetClipboardFormatName"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetClipboardData" (Indicator: "GetClipboardData"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetClipboardData" (Indicator: "GetClipboardData"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "OpenClipboard" (Indicator: "OpenClipboard"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "GetClipboardFormatNameW" (Indicator: "GetClipboardFormatName"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "GetClipboardFormatNameA" (Indicator: "GetClipboardFormatName"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "GetOpenClipboardWindow" (Indicator: "OpenClipboard"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp")88:T4c4,Found reference to API "GetDriveTypeA" (Indicator: "GetDriveType"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveType"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveType"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp")89:T1700,Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "69867925374,5584,3120,,FindNextFileW,kernel32.dll,"01:01:16.343",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005724.00000001.235639.10848000.00000004.mdmp") Found reference to API "73356836720,5584,3120,,FindNextFileW,kernel32.dll,"01:01:17.796",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005724.00000001.235639.10848000.00000004.mdmp") Found reference to API "73361257966,5584,3120,,FindNextFileW,kernel32.dll,"01:01:17.796",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005724.00000001.235639.10848000.00000004.mdmp") Found reference to API "69869844886,5584,3120,,FindNextFileW,kernel32.dll,"01:01:16.343",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005724.00000001.235639.10848000.00000004.mdmp") Found reference to API "73354819758,5584,3120,,FindNextFileW,kernel32.dll,"01:01:17.796",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005724.00000001.235639.10848000.00000004.mdmp") Found reference to API "73359711978,5584,3120,,FindNextFileW,kernel32.dll,"01:01:17.796",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005724.00000001.235639.10848000.00000004.mdmp") Found reference to API "73357642216,5584,3120,,FindNextFileW,kernel32.dll,"01:01:17.796",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005724.00000001.235639.10848000.00000004.mdmp") Found reference to API "73360431174,5584,3120,,FindNextFileW,kernel32.dll,"01:01:17.796",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005724.00000001.235639.10848000.00000004.mdmp") Found reference to API "66499770508,5584,3120,,FindNextFileW,kernel32.dll,"01:01:14.937",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005724.00000001.235639.10848000.00000004.mdmp") Found reference to API "73357262576,5584,3120,,FindNextFileW,kernel32.dll,"01:01:17.796",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005724.00000001.235639.10848000.00000004.mdmp") Found reference to API "73355584176,5584,3120,,FindNextFileW,kernel32.dll,"01:01:17.796",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005724.00000001.235639.10848000.00000004.mdmp") Found reference to API "73360080648,5584,3120,,FindNextFileW,kernel32.dll,"01:01:17.796",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005724.00000001.235639.10848000.00000004.mdmp") Found reference to API "69876652256,5584,3120,,FindNextFileW,kernel32.dll,"01:01:16.343",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005724.00000001.235639.10848000.00000004.mdmp") Found reference to API "73359019896,5584,3120,,FindNextFileW,kernel32.dll,"01:01:17.796",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00005724.00000001.235639.10848000.00000004.mdmp")8a:T1a1d,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "094669835264.exe") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "094669835264.exe") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "RCX610E.tmp") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "RCX610E.tmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001400.00000000.233597.234EE000.00000004.mdmp, 00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.234EE000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000000.233719.6DAEE000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007356.00000000.233834.00C02000.00000002.mdmp, 00000000-00007356.00000000.233834.04FC0000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp")8b:T40e,Found reference to API "ReadFile" (Indicator: "ReadFile"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "ReadFile" (Indicator: "ReadFile"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "ReadFile" (Indicator: "ReadFile"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "ReadFile" (Indicator: "ReadFile"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp")8c:Tba9,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "094669835264.exe") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "RCX610E.tmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp")8d:T43e,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp")8e:T118c,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetTempFileName" (Indicator: "GetTempFileName"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetTempFileName" (Indicator: "GetTempFileName"; Source: "00000000-00001400.00000000.233597.234EE000.00000004.mdmp, 00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.234EE000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00001400.00000000.233597.234EE000.00000004.mdmp, 00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.234EE000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp")8f:T94a,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp")90:T771,Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "74343760246,5584,111,,GetSystemMetrics,user32.dll,"01:01:18.203",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00005724.00000001.235639.10848000.00000004.mdmp") Found reference to API "69000289532,5584,111,,GetSystemMetrics,user32.dll,"01:01:15.984",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00005724.00000001.235639.10848000.00000004.mdmp") Found reference to API "74343816264,5584,111,,GetSystemMetrics,user32.dll,"01:01:18.203",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00005724.00000001.235639.10848000.00000004.mdmp") Found reference to API "74343667872,5584,111,,GetSystemMetrics,user32.dll,"01:01:18.203",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00005724.00000001.235639.10848000.00000004.mdmp") Found reference to API "74343716320,5584,111,,GetSystemMetrics,user32.dll,"01:01:18.203",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00005724.00000001.235639.10848000.00000004.mdmp") Found reference to API "129533371824,5584,111,,GetSystemMetrics,user32.dll,"01:01:41.203",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00005724.00000002.237557.110E6000.00000004.mdmp") Found reference to API "129533530226,5584,111,,GetSystemMetrics,user32.dll,"01:01:41.203",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00005724.00000002.237557.110E6000.00000004.mdmp") Found reference to API "129533426046,5584,111,,GetSystemMetrics,user32.dll,"01:01:41.203",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00005724.00000002.237557.110E6000.00000004.mdmp") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp")91:T4f6,Found reference to API "IsInRole" (Indicator: "IsInRole"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "IsInRole" (Indicator: "IsInRole"; Source: "00000000-00001400.00000000.233597.234EE000.00000004.mdmp, 00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.234EE000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "IsInRole" (Indicator: "IsInRole"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000000.233719.6DAEE000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "IsInRole" (Indicator: "IsInRole"; Source: "00000000-00007356.00000000.233834.00C02000.00000002.mdmp, 00000000-00007356.00000000.233834.04FC0000.00000004.mdmp")92:T8a4,Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "NtOpenProcessToken"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "NtOpenProcessToken"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "NtOpenProcessTokenEx" (Indicator: "OpenProcessToken"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "NtOpenThreadToken"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "NtOpenThreadTokenEx" (Indicator: "NtOpenThreadToken"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "GetUserNameExW" (Indicator: "GetUserName"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp")93:T44a,Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00007356.00000000.233834.04FC0000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00007356.00000000.233834.04FC0000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00007356.00000000.233834.04FC0000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00007356.00000000.233834.04FC0000.00000004.mdmp, 00000000-00007356.00000000.233834.1E440000.00000004.mdmp, 00000000-00007356.00000001.235754.1E440000.00000004.mdmp, 00000000-00007356.00000002.237675.1E440000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00007356.00000000.233834.04FC0000.00000004.mdmp, 00000000-00007356.00000000.233834.1E440000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00007356.00000000.233834.04FC0000.00000004.mdmp, 00000000-00007356.00000000.233834.1E440000.00000004.mdmp")94:T1517,"software\Microsoft\Windows\CurrentVersion\App Paths\AcroRd32.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Photoshop.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Illustrator.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\notepad++.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\notepad++.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Brackets.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\Brackets.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\devenv.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\devenv.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ConTEXT.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\ConTEXT.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\uedit64.exeSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\uedit64.exeSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\TextPad.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin "tsoftware\Microsoft\Windows\CurrentVersion\App Paths\AcroRd32.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin "software\Microsoft\Windows\CurrentVersion\App Paths\AcroRd32.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00007872.00000000.233752.0130B000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Photoshop.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00007872.00000000.233752.0130B000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Illustrator.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00007872.00000000.233752.0130B000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\notepad++.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00007872.00000000.233752.0130B000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\notepad++.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00007872.00000000.233752.0130B000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Brackets.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00007872.00000000.233752.0130B000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\Brackets.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00007872.00000000.233752.0130B000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\devenv.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00007872.00000000.233752.0130B000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\devenv.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00007872.00000000.233752.0130B000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ConTEXT.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00007872.00000000.233752.0130B000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\ConTEXT.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00007872.00000000.233752.0130B000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\uedit64.exeSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\uedit64.exeSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\TextPad.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00007872.00000000.233752.0130B000.00000002.mdmp95:Ta14,Found string "ECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found string "elect * from AntivirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00001400.00000000.233597.234EE000.00000004.mdmp, 00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.234EE000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found string "ELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00001400.00000000.233597.234EE000.00000004.mdmp, 00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.234EE000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found string "elect * from AntivirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000000.233719.6DAEE000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found string "ELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000000.233719.6DAEE000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found string "elect * from AntivirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00007356.00000000.233834.00C02000.00000002.mdmp, 00000000-00007356.00000000.233834.04FC0000.00000004.mdmp") Found string "ELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00007356.00000000.233834.00C02000.00000002.mdmp, 00000000-00007356.00000000.233834.04FC0000.00000004.mdmp")96:T491,Found registry deletion API: "RegDeleteTreeW" in file "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin" Found registry deletion API: "RegDeleteKeyW" in file "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin" Found registry deletion API: "RegDeleteValueW" in file "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin" Found registry deletion API: "RegDeleteKeyExW" in file "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin" Found registry deletion API: "RegDeleteKeyTransactedW" in "00000000-00007872.00000000.233752.0130B000.00000002.mdmp" Found registry deletion API: "RegDeleteKeyExW" in "00000000-00007872.00000000.233752.0130B000.00000002.mdmp" Found registry deletion API: "NtDeleteValueKey" in "00000000-00007872.00000000.233752.0130B000.00000002.mdmp" Found registry deletion API: "RegDeleteKeyW" in "00000000-00007872.00000000.233752.0130B000.00000002.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00007872.00000000.233752.0130B000.00000002.mdmp" Found registry deletion API: "RegDeleteTreeW" in "00000000-00007872.00000000.233752.0130B000.00000002.mdmp"97:T8fb,file/memory contains long string with (Indicator: "OpenProcess"; File: "296471190329..exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "297446173879.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "742984622436.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "718168143749.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "348956352782.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "677147781497.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "423965423337.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "425578815803.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "474422178090.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "260745073588.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "947504982099.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "954044799687.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "233468777388.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "504827019304.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "129425336305.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "358978096805.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "556946934848.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "922386064559.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "429188318046.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "256246409821.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "953495577230.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "492506886705.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "097197725475.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "390734388914.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "707924243104.exe")98:T10a8,Found string "\Device\Mup\" (Indicator: "\Device\"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found string "\Device\LanmanRedirector\" (Indicator: "\Device\"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found string "\Device\WebDavRedirector\" (Indicator: "\Device\"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found string "\Device\WinDfs\" (Indicator: "\Device\"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found string "\Device\NetWareRedirector\" (Indicator: "\Device\"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found string "\Device\nwrdr\" (Indicator: "\Device\"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found string "\Device\SftVol\" (Indicator: "\Device\"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found string "\Device\" (Indicator: "\Device\"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found string "\Device\HarddiskVolume" (Indicator: "\Device\"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found string "g\Device\" (Indicator: "\Device\"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found string "\Device\NamedPipe\" (Indicator: "\Device\"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found string "\device\volume{*}\*:" (Indicator: "\Device\"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found string "\device\volume{*}\*" (Indicator: "\Device\"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found string "\drivers\etc\hosts" (Indicator: "\drivers\"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp") Found string "\Device\HarddiskVolume2\4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin.exe" (Indicator: "\Device\"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found string "WS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00004176.00000000.233691.030C0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\Documents\diagnostics\shost.exe" (Indicator: "\Device\"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00007356.00000000.233834.03180000.00000004.mdmp, 00000000-00007356.00000001.235754.03180000.00000004.mdmp, 00000000-00007356.00000002.237675.03180000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007356.00000000.233834.03180000.00000004.mdmp, 00000000-00007356.00000001.235754.03180000.00000004.mdmp, 00000000-00007356.00000002.237675.03180000.00000004.mdmp") Found string "\Device\Mup\" (Indicator: "\Device\"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found string "\Device\LanmanRedirector\" (Indicator: "\Device\"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp")99:T51b,Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "DeleteFileWW" (Indicator: "DeleteFile"; Source: "00000000-00007356.00000000.233834.03180000.00000004.mdmp, 00000000-00007356.00000001.235754.03180000.00000004.mdmp, 00000000-00007356.00000002.237675.03180000.00000004.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp")9a:T4b9,Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00004176.00000000.233691.051F0000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00007356.00000000.233834.04FC0000.00000004.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp")9b:T64c,Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "NtSetInformationFile" (Indicator: "NtSetInformationFile"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "NtSetInformationFile: STATUS_ACCESS_DENIED" (Indicator: "SetInformationFile"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "NtSetInformationFile: STATUS_ACCESS_DENIED" (Indicator: "NtSetInformationFile"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp")9c:T1043,Found reference to API "AddAce" (Indicator: "AddAce"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "SetKernelObjectSecurity" (Indicator: "SetKernelObjectSecurity"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "SetTokenInformation" (Indicator: "SetTokenInformation"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "ImpersonateAnonymousToken" (Indicator: "ImpersonateAnonymousToken"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetKernelObjectSecurity" (Indicator: "GetKernelObjectSecurity"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "MapGenericMask" (Indicator: "MapGenericMask"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "AccessCheck" (Indicator: "AccessCheck"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "CopySid" (Indicator: "CopySid"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "CreateRestrictedToken" (Indicator: "CreateRestrictedToken"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetAce" (Indicator: "GetAce"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin")9d:Td67,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") file/memory contains long string with (Indicator: "TerminateProcess"; File: "094669835264.exe") file/memory contains long string with (Indicator: "TerminateProcess"; File: "RCX610E.tmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp")9e:T416,Found reference to API "WriteFile" (Indicator: "WriteFile"; File: "4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00001400.00000000.233597.BCB80000.00000004.mdmp, 00000000-00001400.00000001.233768.BCB80000.00000004.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00005724.00000000.233719.0E6F0000.00000004.mdmp, 00000000-00005724.00000000.233719.107B0000.00000004.mdmp, 00000000-00005724.00000000.233719.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.0E6F0000.00000004.mdmp, 00000000-00005724.00000001.235639.107B0000.00000004.mdmp, 00000000-00005724.00000001.235639.10A40000.00000004.mdmp, 00000000-00005724.00000001.235639.40037000.00000002.mdmp, 00000000-00005724.00000002.237557.0E6F0000.00000004.mdmp, 00000000-00005724.00000002.237557.107B0000.00000004.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00007872.00000000.233752.0130B000.00000002.mdmp")9f:T1776,Observed import api "AccessCheck" which can "determine whether a security descriptor grants a specified set of access rights to the client identified by an access token" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe] Observed import api "CreateRestrictedToken" which can "create a new access token that is a restricted version of an existing access token" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe] Observed import api "CreateWellKnownSid" which can "create a SID for predefined aliases" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe] Observed import api "GetKernelObjectSecurity" which can "retrieve a copy of the security descriptor that protects a kernel object" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe] Observed import api "GetSidSubAuthorityCount" which can "return a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe] Observed import api "ImpersonateAnonymousToken" which can "enable the specified thread to impersonate the system's anonymous logon token" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe] Observed import api "MapGenericMask" which can "map the generic access rights in an access mask to specific and standard access rights" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe] Observed import api "SetKernelObjectSecurity" which can "set the security of a kernel object" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe] Observed import api "SetTokenInformation" which can "set various types of information for a specified access token" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe]a0:Tcb8," Simonzh\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"C:\\found.000\\dir0002.chk\\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.17134.1_none_b03bac357662eb62\\credentialuibroker.exe\" (Indicator: \"credentialuibroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"audiodg.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"audiodg.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4176)\n \"audiodg.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7356)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"May check for the presence of a forensics/monitoring tool","description":"$a4","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-45","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"17/26 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe\" has resource with unusual entropy \"PNG:7.028781319605256\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"audiodg.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"audiodg.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"audiodg.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"audiodg.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"audiodg.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"audiodg.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"audiodg.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"audiodg.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"\n \"audiodg.exe\" reads file \"C:\\Users\\%OSUSER%\\Searches\\desktop.ini\"\n \"audiodg.exe\" reads file \"C:\\Users\\%OSUSER%\\Contacts\\desktop.ini\"\n \"audiodg.exe\" reads file \"C:\\Users\\%OSUSER%\\Favorites\\desktop.ini\"\n \"audiodg.exe\" reads file \"C:\\Users\\%OSUSER%\\Links\\desktop.ini\"\n \"audiodg.exe\" reads file \"C:\\Users\\%OSUSER%\\Saved Games\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$a5","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"audiodg.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"WINLOGON\"; Value: \"%LOCALAPPDATA%\\winlogon\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$a6","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains multiple references to file extensions (often found in ransomware)","description":"Found reference to a lot of file extensions within a single string in file \"00000000-00007872.00000000.233752.0130B000.00000002.mdmp\" : .xlsm\n .slk\n .doc\n .sh\n .swf\n .cs\n .vb\n .accdr\n .adp\n .map\n .xla\n .des\n .cmd\n .der\n .ppt\n .xlm\n .asx\n .pptm\n .zip\n .asp\n .dot\n .cer\n .myd\n .prf\n .arc\n .pst\n .aspx\n .xls\n .sldm\n .js\n .ps\n .pl\n .mapimail\n .psd\n .vbs\n .xltm\n .pot\n .pcd\n .dotm\n .csh\n .tar\n .tgz\n .cfg\n .pdf\n .pps\n .pif\n .docb\n .accde\n .crt\n .md\n .rb\n .bat\n .ai\n .potm\n .rar\n .xlt\n .bz2\n .py\n .xlsb\n .class\n .xlam\n .ppam\n .docm\n .ppsm\n .gz\n .mdb\n .jar","origin":"File/Memory","relevance":10,"id":"string-52","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped a large number of files","description":"The input sample dropped 1709 files (often an indicator for ransomware)","origin":"Binary File","mitre_attack_id":"T1491.001","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve browser cookies using SQL","description":"Found string \"icrosoft\\Windows\\INetCookies\" (Source: \"00000000-00007356.00000000.233834.1E440000.00000004.mdmp, 00000000-00007356.00000001.235754.1E440000.00000004.mdmp, 00000000-00007356.00000002.237675.1E440000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-692","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"shost.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"50107e1\"\n \"cx\": \"32\"\n \"cy\": \"32\"}\n \"shost.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"50107e1\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"shost.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1f01080b\"\n \"cx\": \"32\"\n \"cy\": \"32\"}\n \"shost.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1f01080b\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"shost.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"a010888\"\n \"cx\": \"32\"\n \"cy\": \"32\"}\n \"shost.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"a010888\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":5,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"shost.exe\" called \"GetDriveTypeA\" with parameter A:\\ (UID: 00000000-00005724)\n \"shost.exe\" called \"GetDriveTypeA\" with parameter B:\\ (UID: 00000000-00005724)\n \"shost.exe\" called \"GetDriveTypeA\" with parameter C:\\ (UID: 00000000-00005724)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@KERNEL32.dll at 25399-1499-000000014002CEC3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browser information locations related strings","description":"\"\\Google\\Chrome\\User Data\\Default\\Extensions\\efaidnbmnnnibpcajpcglclefindmkaj\\\" (Indicator: \"google\\chrome\\user data\") in Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin\n \"t\\Google\\Chrome\\User Data\\Local State\" (Indicator: \"google\\chrome\\user data\") in Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin\n \"\\Google\\Chrome\\User Data\\\" (Indicator: \"google\\chrome\\user data\") in Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin\n \"\\Microsoft\\Edge\\User Data\\Local State\" (Indicator: \"microsoft\\edge\\user data\") in Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin\n \"\\Microsoft\\Edge\\User Data\\\" (Indicator: \"microsoft\\edge\\user data\") in Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin","origin":"File/Memory","mitre_attack_id":"T1005","relevance":5,"id":"string-93","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$a7","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$a8","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"suspicious","category":"System Security","name":"Found registry location strings which can modify COM objects","description":"Observed string: \"software\\classes\\clsid\" [Source: 4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin]\n Observed string: \"software\\classes\\clsid\" [Source: 556946934848.exe]\n Observed string: \"software\\classes\\clsid\" [Source: 922386064559.exe]","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":5,"id":"string-344","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$a9","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"suspicious","category":"System Security","name":"Opens a handle to the specified local process","description":"\"audiodg.exe\" opens a process \"C:\\Users\\%OSUSER%\\Documents\\diagnostics\\audiodg.exe\" (UID: 00000000-00004176)\n \"audiodg.exe\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00007356)\n \"audiodg.exe\" opens a process \"C:\\Users\\%OSUSER%\\Documents\\diagnostics\\audiodg.exe\" (UID: 00000000-00007356)","origin":"API Call","mitre_attack_id":"T1489","relevance":1,"id":"api-284","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"4c9d9e12a691c67939525cfbd4bd416ee027602113dd8159e847aaaab9bdd6de.bin..exe\" claimed CRC 4686720 while the actual is CRC 5118256\n \"816744554456.exe\" claimed CRC 3838304 while the actual is CRC 3857540","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$aa","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"816744554456.exe\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Found a system process name at an unusual pathway","description":"Process \"audiodg.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00004176)\n Process \"audiodg.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00007356)\n Process \"audiodg.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00005152)\n Process \"audiodg.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00003384)","origin":"Monitored Target","mitre_attack_id":"T1036.005","relevance":3,"id":"target-94","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (D)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"17/26 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"14/26 Antivirus vendors marked dropped file \"excelcnv.exe\" as malicious (classified as \"Trojan.Kryptik.Win64\" with 53% detection rate)\n 14/26 Antivirus vendors marked dropped file \"node.exe\" as malicious (classified as \"Trojan.Kryptik.Win64\" with 53% detection rate)\n 15/26 Antivirus vendors marked dropped file \"mitmweb.exe\" as malicious (classified as \"Trojan.Kryptik.Win64\" with 57% detection rate)\n 15/26 Antivirus vendors marked dropped file \"mitmproxy.exe\" as malicious (classified as \"Trojan.Kryptik.Win64\" with 57% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops system driver","description":"\"658623742371.exe\" has type \"PE32+ executable for MS Windows 10.00 (native) x86-64 6 sections\"\n \"356519375408.exe\" has type \"PE32+ executable for MS Windows 10.00 (native) x86-64 14 sections\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-2","sources":[{"report_type":"sandbox","report_id":"69b50020c9f8685ea9096a93"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"