21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 83:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T481,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample 52dd30e29abf… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 52dd30e29abf…. Malware family: Crifi.Generic. Threat score 100/100. 13/25 AV engines flagged this file. 16 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":13,"total":25},"behavioralIndicators":{"malicious":16,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T4bd,GET /favicon.ico HTTP/1.1 Host: store.steampowered.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://store.steampowered.com/login Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; browserid=412753823171828074; sessionid=cbc7147d8b8442a93863abf7; timezoneOffset=-25200,0; ak_bmsc=C9374A2C8A7340C74785CEA28A1DB30E~000000000000000000000000000000~YAAQqCTDFzgN7O+WAQAAkudHAhsJ+ugJ3jtJFA+LN4BILjv0ScZWZjvxNKTl9ioDaxG3kUoDeK8gVYdGzmHs2fdhbCd3tIJGkz4Ccyyy7OnMLgzWfaoFbBSySbc2/jwjH1RkmEvnMXQAsGsjcQWjvgUHa+thSheG0J/5XCL3eNZ0IPvXYA4AAQue7SpgD4N1gTZYYgmUFQpZgK5A/8VR6uK+kFltFkeo3x2gtBiq4fx76i0+DRwtZEwD05yXmIDwGR3vnve8S3H5yaDReWpBRGmzh7E0vwiXsiYK5OPpWC86dE+st5HS3tJHgCq4GaR6fvoEOKXKWEjZBDsw9WbajkDnXAUYrPYHm2ouS9u7H/tbwetJs7Rbgu14+rkwoSEP+BT7ljw=23:T5e8,GET /v1/counter.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1 Host: b.stats.paypal.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.paypal.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ24:T754,GET /v1/counter2.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1 Host: slc.stats.paypal.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.paypal.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ; KHcl0EuY7AKSMgfvHl7J5E7hPtK=WDckqzzy9vIWdSfHBSr21ywQ9jcffPZH_af73lDsaeYEp7HG-hEXr5QXu_tU6ttG6FuinJp-AGS-6WTA; ddi=G3snUBqktJChviAUctibdWBY-7BqT26ut_Zj7uE-onOzLMQRnf06iPA3Rr8V-LWJyvzfllDpne-tl-SElQNe4CXdgBlGmzGoCGqWB3BQM65RWqUO; c=9ebad54a66acd3b3ddf3; sc_f=0wf7biK6sULawYka6_-wcAz-c70v2qMjLrQC7eRnBXEczlw-LaasRJuf02oPzSKZM0uVI6gd-GaFu3sSjCAptBETw9HNENV1VMx_UW25:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAIiIiIh3d3d3d3d3gAAAAACIiIiIiIiIiIiIiIAAAAAAj//4iIiIiIiIiIiAAAAAAI///4iIiIiIiIiIgAAAAACP///4iIiIiIiIiIAAAAAAj/////iIiIiIiIiAAAAAAI//////iIiIiIiIgAAAAACP//////iIiIiIiIAAAAAAj///////+IiIiIiAAAAAAI/////////4iIiIgAAAAACP////////+IiIiIAAAAAAj//////////4iIiAAAAAAI////////////iIgAAAAACP////////////iIAAAAAAj/////////////iAAAAAAI/////////////4gAAAAACP////////////+IAAAAAAj/////////////iAAAAAAI/////////////4gAAAAACP////////////+IAAAAAAj/////////////iAAAAAAI/////////////4gAAAAACP////////////+IAAAAAAj///////////iIiAQAAAAI//////////+OZmdEAAAAD///////////iO52RAAAAA///////////4jnZEYAAAAP//////////+IdkZAAAAAD///////////iERkAAAAAAiIiIiIiIiIiIgAAAAADwAAAD8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAD8AAAA/AAAAfwAAAP8AAB/w==26:Tdda,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "Process32First" (Indicator: "Process32First"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004412.00000000.144519.0128A000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")27:T56a,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") file/memory contains long string with (Indicator: "OpenProcess"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004412.00000000.144519.00F82000.00000040.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")28:T2831,"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76710000 "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76710000 "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76710000 "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" loaded module "KERNEL32" at base 75080000 "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72880000 "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" loaded module "KERNEL32.DLL" at base 75080000 "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74230000 "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" loaded module "FECLIENT.DLL" at base 72860000 "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72830000 "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" loaded module "NTDLL.DLL" at base 770e0000 "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73a50000 "HB8Ri19.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76710000 "HB8Ri19.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76710000 "HB8Ri19.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76710000 "HB8Ri19.exe" loaded module "KERNEL32" at base 75080000 "HB8Ri19.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72880000 "HB8Ri19.exe" loaded module "KERNEL32.DLL" at base 75080000 "HB8Ri19.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74230000 "HB8Ri19.exe" loaded module "FECLIENT.DLL" at base 72860000 "HB8Ri19.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72830000 "HB8Ri19.exe" loaded module "NTDLL.DLL" at base 770e0000 "HB8Ri19.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73a50000 "ao2FE12.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76710000 "ao2FE12.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76710000 "ao2FE12.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76710000 "ao2FE12.exe" loaded module "KERNEL32" at base 75080000 "ao2FE12.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72880000 "ao2FE12.exe" loaded module "KERNEL32.DLL" at base 75080000 "ao2FE12.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74230000 "ao2FE12.exe" loaded module "FECLIENT.DLL" at base 72860000 "ao2FE12.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72830000 "ao2FE12.exe" loaded module "NTDLL.DLL" at base 770e0000 "ao2FE12.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73a50000 "Qj7GR07.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76710000 "Qj7GR07.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76710000 "Qj7GR07.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76710000 "Qj7GR07.exe" loaded module "KERNEL32" at base 75080000 "Qj7GR07.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72880000 "Qj7GR07.exe" loaded module "KERNEL32.DLL" at base 75080000 "Qj7GR07.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74230000 "Qj7GR07.exe" loaded module "FECLIENT.DLL" at base 72860000 "Qj7GR07.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72830000 "Qj7GR07.exe" loaded module "NTDLL.DLL" at base 770e0000 "Qj7GR07.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73a50000 "1uM06vb2.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76710000 "1uM06vb2.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76710000 "1uM06vb2.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76710000 "1uM06vb2.exe" loaded module "KERNEL32" at base 75080000 "1uM06vb2.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72880000 "1uM06vb2.exe" loaded module "KERNEL32.DLL" at base 75080000 "1uM06vb2.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 735b0000 "1uM06vb2.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 76710000 "1uM06vb2.exe" loaded module "COMCTL32.DLL" at base 729f0000 "1uM06vb2.exe" loaded module "COMCTL32" at base 729f0000 "1uM06vb2.exe" loaded module "RPCRT4.DLL" at base 77020000 "1uM06vb2.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 72210000 "1uM06vb2.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 75080000 "1uM06vb2.exe" loaded module "USER32.DLL" at base 73c90000 "1uM06vb2.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.SHELL.SERVICEHOSTBUILDER.DLL" at base 721f0000 "1uM06vb2.exe" loaded module "%WINDIR%\SYSWOW64\IEFRAME.DLL" at base 707e0000 "1uM06vb2.exe" loaded module "PROPSYS.DLL" at base 73050000 "1uM06vb2.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73050000 "1uM06vb2.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 747a0000 "1uM06vb2.exe" loaded module "SECUR32.DLL" at base 72160000 "1uM06vb2.exe" loaded module "SSPICLI.DLL" at base 73b00000 "1uM06vb2.exe" loaded module "MLANG.DLL" at base 72120000 "1uM06vb2.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 73eb0000 "1uM06vb2.exe" loaded module "WININET.DLL" at base 72550000 "1uM06vb2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.APPDEFAULTS.DLL" at base 0 "1uM06vb2.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76900000 "1uM06vb2.exe" loaded module "NTDLL.DLL" at base 770e0000 "1uM06vb2.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73a50000 "1uM06vb2.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 71350000 "1uM06vb2.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1" at base 74630000 "2HO7525.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76710000 "2HO7525.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76710000 "2HO7525.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76710000 "2HO7525.exe" loaded module "KERNEL32" at base 75080000 "2HO7525.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72880000 "2HO7525.exe" loaded module "SHFOLDER.DLL" at base 727f0000 "2HO7525.exe" loaded module "IMM32.DLL" at base 73f50000 "2HO7525.exe" loaded module "COMCTL32.DLL" at base 72760000 "2HO7525.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 735b0000 "2HO7525.exe" loaded module "KERNEL32.DLL" at base 75080000 "2HO7525.exe" loaded module "RPCRT4.DLL" at base 77020000 "2HO7525.exe" loaded module "SSPICLI.DLL" at base 73b00000 "2HO7525.exe" loaded module "ADVAPI32.DLL" at base 74230000 "2HO7525.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 726d0000 "2HO7525.exe" loaded module "SHLWAPI.DLL" at base 745c0000 "2HO7525.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74630000 "2HO7525.exe" loaded module "VERSION.DLL" at base 73830000 "2HO7525.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 71f20000 "2HO7525.exe" loaded module "USER32.DLL" at base 73c90000 "2HO7525.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 76710000 "2HO7525.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "2HO7525.exe" loaded module "MSCOREE.DLL" at base 72800000 "2HO7525.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 747a0000 "2HO7525.exe" loaded module "PSAPI.DLL" at base 73f40000 "2HO7525.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 6ff40000 "2HO7525.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "2HO7525.exe" loaded module "OLE32.DLL" at base 76f20000 "2HO7525.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "2HO7525.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 747a0000 "2HO7525.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76710000 "2HO7525.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71dc0000 "2HO7525.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6f4e0000 "2HO7525.exe" loaded module "ADVAPI32" at base 74230000 "2HO7525.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "2HO7525.exe" loaded module "NTDLL.DLL" at base 770e0000 "3on26Nz.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76710000 "3on26Nz.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76710000 "3on26Nz.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76710000 "3on26Nz.exe" loaded module "KERNEL32" at base 75080000 "3on26Nz.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72880000 "3on26Nz.exe" loaded module "COMCTL32.DLL" at base 729f0000 "3on26Nz.exe" loaded module "SHFOLDER.DLL" at base 72850000 "3on26Nz.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 735b0000 "3on26Nz.exe" loaded module "KERNEL32.DLL" at base 75080000 "3on26Nz.exe" loaded module "RPCRT4.DLL" at base 77020000 "3on26Nz.exe" loaded module "SSPICLI.DLL" at base 73b00000 "3on26Nz.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 76710000 "3on26Nz.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76710000 "3on26Nz.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76710000 "3on26Nz.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76710000 "3on26Nz.exe" loaded module "%WINDIR%\SYSWOW64\GPEDIT.DLL" at base 72740000 "3on26Nz.exe" loaded module "NTDLL.DLL" at base 770e0000 "3on26Nz.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73a50000 "3on26Nz.exe" loaded module "WINHTTP.DLL" at base 727a0000 "3on26Nz.exe" loaded module "WININET.DLL" at base 724d0000 "3on26Nz.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 72db000029:T6a2,Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp")2a:Ta3f,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetUserName" (Indicator: "GetUserName"; File: "00000000-00004412.00000000.144519.00F82000.00000040.mdmp") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetUserName" (Indicator: "GetUserName"; Source: "00000000-00004412.00000000.144519.00F82000.00000040.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004412.00000000.144519.00F82000.00000040.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")2b:T4bf,Found string "https://www.paypal.com/signin" (Indicator: "paypal.com"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found string "https://www.youtube.com/" (Indicator: "youtube.com"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found string "b.stats.paypal.com" (Indicator: "paypal.com"; File: "PCAP") file/memory contains long string with (Indicator: "paypal.com"; File: "PCAP") Found string "slc.stats.paypal.com" (Indicator: "paypal.com"; File: "PCAP") Found string "c.paypal.com" (Indicator: "paypal.com"; File: "PCAP") Found string "c6.paypal.com" (Indicator: "paypal.com"; File: "PCAP") Found string "ddbm2.paypal.com" (Indicator: "paypal.com"; File: "PCAP") Found string "t.paypal.com" (Indicator: "paypal.com"; File: "PCAP") Found string "www.paypal.com" (Indicator: "paypal.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube.com"; File: "PCAP") Found string "ttps://www.paypal.com/signin" (Indicator: "paypal.com"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found string "ttps://www.youtube.com" (Indicator: "youtube.com"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp")2c:T4fb,"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 73F80000 "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72E80000 "HB8Ri19.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 73F80000 "HB8Ri19.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72E80000 "ao2FE12.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 73F80000 "ao2FE12.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72E80000 "Qj7GR07.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 73F80000 "Qj7GR07.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72E80000 "1uM06vb2.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 73F80000 "1uM06vb2.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72E80000 "2HO7525.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 73F80000 "2HO7525.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72E80000 "3on26Nz.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 73F80000 "3on26Nz.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72E80000 "schtasks.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 73F800002d:T2db6,Process "HB8Ri19.exe" (UID: 00000000-00006560) was launched with new environment variables: "__COMPAT_LAYER="ElevateCreateProcess WRPMitigation", USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64"" Process "HB8Ri19.exe" (UID: 00000000-00006560) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "msedge.exe" (UID: 00000000-00009148) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "msedge.exe" (UID: 00000000-00009148) was launched with modified environment variables: "Path" Process "msedge.exe" (UID: 00000000-00008376) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_9148_DPDGONJCSVNTJFVM", EDGE_BROWSER_PID="9148"" Process "msedge.exe" (UID: 00000000-00008376) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00008376) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00008324) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "msedge.exe" (UID: 00000000-00008324) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00008324) was launched with missing environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00007148) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_8324_WCUZUYJYMTKBXXBU", EDGE_BROWSER_PID="8324"" Process "msedge.exe" (UID: 00000000-00007148) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00007148) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00003596) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="28", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_VARIATIONS_SEED_ETAG=""/+nlB/JaJs3S7UdI1iuRoVt1x8h0lBvuyyStUyfx2D8="", EDGE_METRICS_CLIENT_ID_HASH="-5815550854748070847"" Process "msedge.exe" (UID: 00000000-00003596) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00007116) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT"" Process "msedge.exe" (UID: 00000000-00007348) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "msedge.exe" (UID: 00000000-00007348) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles" Process "msedge.exe" (UID: 00000000-00007348) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00005248) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="28", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_9148_DPDGONJCSVNTJFVM", EDGE_BROWSER_PID="9148", EDGE_VARIATIONS_SEED_ETAG=""/+nlB/JaJs3S7UdI1iuRoVt1x8h0lBvuyyStUyfx2D8="", EDGE_METRICS_CLIENT_ID_HASH="-5815550854748070847"" Process "msedge.exe" (UID: 00000000-00005248) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles" Process "msedge.exe" (UID: 00000000-00005248) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00004268) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00004268) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00002172) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="28", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_VARIATIONS_SEED_ETAG=""/+nlB/JaJs3S7UdI1iuRoVt1x8h0lBvuyyStUyfx2D8="", EDGE_METRICS_CLIENT_ID_HASH="-5815550854748070847"" Process "msedge.exe" (UID: 00000000-00002172) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00007968) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00007968) was launched with missing environment variables: "CHROME_RESTART" Process "msedge.exe" (UID: 00000000-00005408) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "msedge.exe" (UID: 00000000-00005408) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00005408) was launched with missing environment variables: "EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00006672) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="28", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_9148_DPDGONJCSVNTJFVM", EDGE_BROWSER_PID="9148", EDGE_VARIATIONS_SEED_ETAG=""/+nlB/JaJs3S7UdI1iuRoVt1x8h0lBvuyyStUyfx2D8="", EDGE_METRICS_CLIENT_ID_HASH="-5815550854748070847"" Process "msedge.exe" (UID: 00000000-00006672) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles" Process "msedge.exe" (UID: 00000000-00006672) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00005768) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00005768) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00006592) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="28", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_VARIATIONS_SEED_ETAG=""/+nlB/JaJs3S7UdI1iuRoVt1x8h0lBvuyyStUyfx2D8="", EDGE_METRICS_CLIENT_ID_HASH="-5815550854748070847"" Process "msedge.exe" (UID: 00000000-00006592) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00007360) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "msedge.exe" (UID: 00000000-00007360) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles" Process "msedge.exe" (UID: 00000000-00007360) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00007484) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="28", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_9148_DPDGONJCSVNTJFVM", EDGE_BROWSER_PID="9148", EDGE_VARIATIONS_SEED_ETAG=""/+nlB/JaJs3S7UdI1iuRoVt1x8h0lBvuyyStUyfx2D8="", EDGE_METRICS_CLIENT_ID_HASH="-5815550854748070847"" Process "msedge.exe" (UID: 00000000-00007484) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles" Process "msedge.exe" (UID: 00000000-00007484) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00007396) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00007396) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00003480) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "msedge.exe" (UID: 00000000-00003480) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00003480) was launched with missing environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00007896) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="28", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_9148_DPDGONJCSVNTJFVM", EDGE_BROWSER_PID="9148", EDGE_VARIATIONS_SEED_ETAG=""/+nlB/JaJs3S7UdI1iuRoVt1x8h0lBvuyyStUyfx2D8="", EDGE_METRICS_CLIENT_ID_HASH="-5815550854748070847"" Process "msedge.exe" (UID: 00000000-00007896) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles" Process "msedge.exe" (UID: 00000000-00007896) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00006692) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00006692) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00000528) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="28", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", PROCESSOR_ARCHITEW6432="AMD64", EDGE_VARIATIONS_SEED_ETAG=""/+nlB/JaJs3S7UdI1iuRoVt1x8h0lBvuyyStUyfx2D8="", EDGE_METRICS_CLIENT_ID_HASH="-5815550854748070847"" Process "msedge.exe" (UID: 00000000-00000528) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00002108) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00004400) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00004400) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH"2e:T764,"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "HB8Ri19.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "HB8Ri19.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "HB8Ri19.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "ao2FE12.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "ao2FE12.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "ao2FE12.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Qj7GR07.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Qj7GR07.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Qj7GR07.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1uM06vb2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "1uM06vb2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1uM06vb2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1uM06vb2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "2HO7525.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "2HO7525.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "2HO7525.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")2f:T531,"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" trying to access non-existent file "C:\52DD30E29ABF61D4E6EA0CA34E23649FE98C73D6529C5B5253825660F0D0F919.EXE.LOCAL" "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "HB8Ri19.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\HB8RI19.EXE.LOCAL" "HB8Ri19.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "ao2FE12.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\AO2FE12.EXE.LOCAL" "ao2FE12.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "Qj7GR07.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\QJ7GR07.EXE.LOCAL" "Qj7GR07.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "1uM06vb2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1UM06VB2.EXE.LOCAL" "1uM06vb2.exe" trying to access non-existent file "C:\Windows\SysWOW64\UXTHEME.DLL.CONFIG" "1uM06vb2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1uM06vb2.exe.Local\"30:T424,"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\HB8Ri19.exe" (Handle: 652) "HB8Ri19.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\ao2FE12.exe" (Handle: 660) "ao2FE12.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\Qj7GR07.exe" (Handle: 664) "ao2FE12.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3on26Nz.exe" (Handle: 636) "Qj7GR07.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1uM06vb2.exe" (Handle: 660) "Qj7GR07.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2HO7525.exe" (Handle: 124) "3on26Nz.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 1012) "3on26Nz.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 1016)31:Tc3c,"HB8Ri19.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\IXP000.TMP\HB8Ri19.exe]- [targetUID: 00000000-00006560] "ao2FE12.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\IXP001.TMP\ao2FE12.exe]- [targetUID: 00000000-00006560] "3on26Nz.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 8 sections"- Location: [%TEMP%\IXP002.TMP\3on26Nz.exe]- [targetUID: 00000000-00009036] "5AU2Hf7.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\IXP000.TMP\5AU2Hf7.exe]- [targetUID: 00000000-00002988] "4ft667bN.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 8 sections"- Location: [%TEMP%\IXP001.TMP\4ft667bN.exe]- [targetUID: 00000000-00006560] "Qj7GR07.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\IXP002.TMP\Qj7GR07.exe]- [targetUID: 00000000-00006196] "1uM06vb2.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\IXP003.TMP\1uM06vb2.exe]- [targetUID: 00000000-00006196] "2HO7525.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 6 sections"- Location: [%TEMP%\IXP003.TMP\2HO7525.exe]- [targetUID: 00000000-00006196] "urlref_httpswww.youtube.com" has type "HTML document ASCII text with very long lines (55474)"- [targetUID: N/A] "2HO7525.exe.log" has type "CSV ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\2HO7525.exe.log]- [targetUID: 00000000-00004412] "urlref_httpsinstagram.comaccountslogin" has type "HTML document ASCII text with very long lines (65536) with no line terminators"- [targetUID: N/A] "urlref_httpswww.linkedin.comlogin" has type "HTML document Unicode text UTF-8 text with very long lines (4169)"- [targetUID: N/A] "urlref_httpssteamcommunity.comopenidloginform" has type "HTML document Unicode text UTF-8 text with very long lines (3238)"- [targetUID: N/A] "urlref_httpsstore.steampowered.comlogin" has type "HTML document Unicode text UTF-8 text with very long lines (3819)"- [targetUID: N/A] "Registry.pol" has type "Group Policy Registry Policy Version=1"- Location: [%WINDIR%\System32\GroupPolicy\Machine\Registry.pol]- [targetUID: 00000000-00009036] "gpt.ini" has type "ASCII text with CRLF line terminators"- Location: [%WINDIR%\System32\GroupPolicy\gpt.ini]- [targetUID: 00000000-00009036] "D23EF1D2" has type "data"- Location: [%TEMP%\D23EF1D2]- [targetUID: 00000000-00004412] "rage131MP.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\rage131MP.tmp]- [targetUID: 00000000-00009036] "gpt.ini" has type "ASCII text with CRLF line terminators"- Location: [%WINDIR%\SysWOW64\GroupPolicy\gpt.ini]- [targetUID: 00000000-00009036] "RageMP131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 8 sections"- Location: [%LOCALAPPDATA%\RageMP131\RageMP131.exe]- [targetUID: 00000000-00009036] "MPGPH131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 8 sections"- Location: [%ALLUSERSPROFILE%\MPGPH131\MPGPH131.exe]- [targetUID: 00000000-00009036]32:T131e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006196-45988-15-01221F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006196-45988-15-01221F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006196-45988-16-012244B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006196-45988-16-012244B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006196-45988-22-0122681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006196-45988-22-0122681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006196-45988-26-012224E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006196-45988-26-012224E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006196-45988-29-012252B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006196-45988-29-012252B6 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00006196-45988-31-01222390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00006196-45988-31-01222390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006196-45988-33-01222F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006196-45988-33-01222F1D Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00006196-45988-36-01223BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00006196-45988-36-01223BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006196-45988-37-01223FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006196-45988-37-01223FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006196-45988-40-01222267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006196-45988-40-01222267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006196-45988-41-01226495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006196-45988-41-01226495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006196-45988-42-0122202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00006196-45988-42-0122202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006196-45988-42-0122202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006196-45988-43-01221AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006196-45988-43-01221AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006196-45988-44-01222AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006196-45988-44-01222AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006196-45988-52-01224EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006196-45988-52-01224EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006196-45988-57-01226298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006196-45988-57-01226298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006196-45988-59-0122621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006196-45988-59-0122621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006196-45988-60-0122597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006196-45988-60-0122597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006196-45988-62-012255A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006196-45988-62-012255A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006196-45988-63-01225467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006196-45988-63-01225467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006196-45988-65-012253A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006196-45988-65-012253A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006196-45988-66-01222630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006196-45988-66-01222630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006196-45988-71-01222CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006196-45988-71-01222CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006196-45988-72-012218A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006196-45988-72-012218A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006196-45988-73-012217EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006196-45988-73-012217EE33:Tdd1,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919 "DSystem\CurrentControlSet\Control\Session Manager" in Source: 52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919 "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919 "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: 52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919 "System\CurrentControlSet\Control\Session Manager" in Source: 43595-17-0040256D "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 47579-329-008ECF92 "Software\AutoIt v3\AutoIt" in Source: 47579-1225-008D344D "SOFTWARE\Classes\" in Source: 47579-1601-009306DE "SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" in Source: 00000000-00004412.00000000.144519.00F82000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00002988.00000000.143070.00BF1000.00000020.mdmp "Software\AutoIt v3\AutoIt" in Source: 00000000-00004320.00000000.143308.0096C000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00004320.00000000.143308.0096C000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00004320.00000000.143308.0096C000.00000002.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00004320.00000000.143308.030F0000.00000004.mdmp "Registry\Machine\Software\Classes\AppX90nv6nhay5n6a98fnetv7tpk64pp35es\Shell\open" in Source: 00000000-00004320.00000000.143308.030F0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{267265C8-EB6E-409D-B104-E6451EE39433}" in Source: 00000000-00004320.00000000.143308.030F0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}" in Source: 00000000-00004320.00000000.143308.030F0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{49244656-5EA6-5680-BF99-87EF7636F6C8}" in Source: 00000000-00004320.00000000.143308.030F0000.00000004.mdmp "-1-5-21-735145574-3570218355-1207367261-1001\Software\Classes\Local Settings\Software\Micron" in Source: 00000000-00004320.00000000.143308.030F0000.00000004.mdmp "261-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel>" in Source: 00000000-00004320.00000000.143308.030F0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004320.00000000.143308.030F0000.00000004.mdmp "-1-5-21-735145574-3570218355-1207367261-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages" in Source: 00000000-00004320.00000000.143308.030F0000.00000004.mdmp "Software\Enigma Protector\FB0CD20013B33CD2-EA80541D7E84BC6D" in Source: 00000000-00004412.00000000.144519.05F00000.00000040.mdmp "SOFTWARE\EnigmaDevelopers\\" in Source: 00000000-00004412.00000000.144519.05F00000.00000040.mdmp 00000000-00004412.00000000.144519.05F30000.00000040.mdmp "Software\Enigma Protector\FB0CD20013B33CD2-EA80541D7E84BH" in Source: 00000000-00004412.00000000.144519.05F30000.00000040.mdmp "Software\Enigma Protector\FB0CD20013B33CD2-EA80541D7E84BC6D\1D23E801FF916F1C-DF69CE3484AE41BB" in Source: 00000000-00004412.00000000.144519.05F30000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00006196.00000000.143256.01221000.00000020.mdmp34:T90a,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "IcmpCreateFile" (Indicator: "CreateFile"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "IcmpCreateFile" (Indicator: "CreateFile"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00006196.00000000.143256.010E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00006196.00000000.143256.010E0000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")35:T8af,Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "screen_2.png") Found string "httpsy//www.linkedin.com/login" (Indicator: "linkedin.com"; File: "screen_3.png") Found string "https://www.linkedin.com/login" (Indicator: "linkedin.com"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found string "https://www.paypal.com/signin" (Indicator: "paypal"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found string "https://www.youtube.com/" (Indicator: "youtube"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found string "https://twitter.com/i/flow/login" (Indicator: "twitter"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found string "b.stats.paypal.com" (Indicator: "paypal"; File: "PCAP") Found string "slc.stats.paypal.com" (Indicator: "paypal"; File: "PCAP") Found string "api.twitter.com" (Indicator: "twitter"; File: "PCAP") Found string "c.paypal.com" (Indicator: "paypal"; File: "PCAP") Found string "c6.paypal.com" (Indicator: "paypal"; File: "PCAP") Found string "ddbm2.paypal.com" (Indicator: "paypal"; File: "PCAP") Found string "facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "paypalobjects.com" (Indicator: "paypal"; File: "PCAP") Found string "platform.linkedin.com" (Indicator: "linkedin.com"; File: "PCAP") Found string "t.paypal.com" (Indicator: "paypal"; File: "PCAP") Found string "twitter.com" (Indicator: "twitter"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.linkedin.com" (Indicator: "linkedin.com"; File: "PCAP") Found string "www.paypal.com" (Indicator: "paypal"; File: "PCAP") Found string "www.paypalobjects.com" (Indicator: "paypal"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "--single-argument https://www.facebook.com/login" (Indicator: "facebook.com"; File: "msedge.exe") Found string "--single-argument https://www.linkedin.com/login" (Indicator: "linkedin.com"; File: "msedge.exe") Found string "--single-argument https://www.paypal.com/signin" (Indicator: "paypal"; File: "msedge.exe")36:T4a4,Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")37:T657,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "2580437920,6284,3024,,RtlGetVersion,NTDLL.dll,"00:37:11.687",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")38:Tcd2,"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12568704'}" (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12568560'}" (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12568720'}" (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12568608'}" (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12568576'}" (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12568624'}" (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12568672'}" (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12568544'}" (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12568656'}" (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12568688'}" (UID: 00000000-00002988) "HB8Ri19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11389056'}" (UID: 00000000-00006560) "HB8Ri19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11388912'}" (UID: 00000000-00006560) "HB8Ri19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11389072'}" (UID: 00000000-00006560) "HB8Ri19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11388960'}" (UID: 00000000-00006560) "HB8Ri19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11388928'}" (UID: 00000000-00006560) "HB8Ri19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11388976'}" (UID: 00000000-00006560) "HB8Ri19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11389024'}" (UID: 00000000-00006560) "HB8Ri19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11388896'}" (UID: 00000000-00006560) "HB8Ri19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11389008'}" (UID: 00000000-00006560) "HB8Ri19.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11389040'}" (UID: 00000000-00006560) "ao2FE12.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17483904'}" (UID: 00000000-00008952) "ao2FE12.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17483760'}" (UID: 00000000-00008952) "ao2FE12.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '17483920'}" (UID: 00000000-00008952)39:T10fd,Pattern match: "https://www.facebook.com/login" Pattern match: "www.linkedin.com/login" Pattern match: "https://www.linkedin.com/login" Pattern match: "https://instagram.com/accounts/login" Pattern match: "https://www.epicgames.com/id/login" Pattern match: "https://www.paypal.com/signin" Pattern match: "https://steamcommunity.com/openid/loginform" Pattern match: "https://store.steampowered.com/login" Pattern match: "https://www.youtube.com/" Pattern match: "https://accounts.google.com/" Pattern match: "https://twitter.com/i/flow/login" Heuristic match: "k33^3.mt" Heuristic match: "0b.rs" Heuristic match: "]x.md" Pattern match: "https://store.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=gcaj3d0j0rdc&l=english&_cdn=cloudflare" Pattern match: "https://ipinfo.io/" Pattern match: "https://www.maxmind.com/en/locate-my-ip-address" Pattern match: "http://www.winimage.com/zlibdll" Heuristic match: "store.steampowered.com" Pattern match: "https://store.steampowered.com/loginaccept-encoding" Heuristic match: "tzm.protechts.net" Pattern match: "https://li.protechts.netsec-fetch-site" Heuristic match: "b.stats.paypal.com" Pattern match: "https://www.paypal.com/accept-encoding" Heuristic match: "slc.stats.paypal.com" Heuristic match: "abs.twimg.com" Heuristic match: "accounts.google.com" Heuristic match: "api.hcaptcha.com" Heuristic match: "api.twitter.com" Heuristic match: "api.x.com" Heuristic match: "browser-intake-us5-datadoghq.com" Heuristic match: "c.paypal.com" Heuristic match: "c6.paypal.com" Heuristic match: "client.protechts.net" Heuristic match: "collector-pxdojv695v.protechts.net" Heuristic match: "community.fastly.steamstatic.com" Heuristic match: "connect.facebook.net" Heuristic match: "csp.withgoogle.com" Heuristic match: "ddbm2.paypal.com" Heuristic match: "dpm.demdex.net" Heuristic match: "facebook.com" Heuristic match: "fbcdn.net" Heuristic match: "fbsbx.com" Heuristic match: "fonts.googleapis.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "googleads.g.doubleclick.net" Heuristic match: "i.ytimg.com" Heuristic match: "instagram.com" Heuristic match: "js.hcaptcha.com" Heuristic match: "li.protechts.net" Heuristic match: "lnkd.demdex.net" Heuristic match: "newassets.hcaptcha.com" Heuristic match: "paypalobjects.com" Heuristic match: "pbs.twimg.com" Heuristic match: "platform.linkedin.com" Heuristic match: "play.google.com" Heuristic match: "sentry.io" Heuristic match: "static-assets-prod.unrealengine.com" Heuristic match: "static.cdninstagram.com" Heuristic match: "static.licdn.com" Heuristic match: "static.xx.fbcdn.net" Heuristic match: "store.fastly.steamstatic.com" Heuristic match: "stun.l.google.com" Heuristic match: "t.paypal.com" Heuristic match: "talon-service-prod.ecosec.on.epicgames.com" Heuristic match: "talon-website-prod.ecosec.on.epicgames.com" Heuristic match: "tracking.epicgames.com" Heuristic match: "twitter.com" Heuristic match: "use1-turn.fpjs.io" Heuristic match: "video.twimg.com" Pattern match: "www.epicgames.com" Pattern match: "www.facebook.com" Pattern match: "www.google.com" Pattern match: "www.gstatic.com" Pattern match: "www.instagram.com" Pattern match: "www.linkedin.com" Pattern match: "www.paypal.com" Pattern match: "www.paypalobjects.com" Pattern match: "www.recaptcha.net" Pattern match: "www.youtube.com" Heuristic match: "x.com" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "u0g-up.ru" Pattern match: "www.epicgames.com/id/login" Pattern match: "store.steampowered.com/login" Pattern match: "twitter.com/i/flow/login" Pattern match: "steamcommunity.com/openid/loginform" Pattern match: "instagram.com/accounts/login" Pattern match: "www.facebook.com/login" Pattern match: "www.paypal.com/signin" Heuristic match: "ttps://accounts.google.com" Heuristic match: "ccounts.google.com" Heuristic match: "ww.facebook.com" Heuristic match: "tore.steampowered.com" Heuristic match: "ay.sg" Heuristic match: "}.se" Pattern match: "http://www.enigmaprotector.com/" Heuristic match: "e-mail : support@enigmaprotector.com" Heuristic match: "kg.mp" Pattern match: "ixp003.tmp/2ho7525.exe" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "icrosoft.vi" Heuristic match: "~\s9r.tf"3a:T50a,"HB8Ri19.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\IXP000.TMP\HB8Ri19.exe]- [targetUID: 00000000-00006560] "ao2FE12.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\IXP001.TMP\ao2FE12.exe]- [targetUID: 00000000-00006560] "3on26Nz.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 8 sections"- Location: [%TEMP%\IXP002.TMP\3on26Nz.exe]- [targetUID: 00000000-00009036] "5AU2Hf7.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\IXP000.TMP\5AU2Hf7.exe]- [targetUID: 00000000-00002988] "4ft667bN.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 8 sections"- Location: [%TEMP%\IXP001.TMP\4ft667bN.exe]- [targetUID: 00000000-00006560] "Qj7GR07.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\IXP002.TMP\Qj7GR07.exe]- [targetUID: 00000000-00006196] "1uM06vb2.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\IXP003.TMP\1uM06vb2.exe]- [targetUID: 00000000-00006196] "2HO7525.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 6 sections"- Location: [%TEMP%\IXP003.TMP\2HO7525.exe]- [targetUID: 00000000-00006196]3b:T67e,"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "HB8Ri19.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "HB8Ri19.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "ao2FE12.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "ao2FE12.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "Qj7GR07.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "Qj7GR07.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"") "3on26Nz.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "RAGEMP131"; Value: "%LOCALAPPDATA%\RageMP131\RageMP131.exe")3c:T2ae5,"GET /login HTTP/1.1 Host: store.steampowered.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://store.fastly.steamstatic.com/ https://store.fastly.steamstatic.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' http://store.steampowered.com https://store.steampowered.com http://127.0.0.1:27060 ws://127.0.0.1:27060 https://community.fastly.steamstatic.com/ https://steamcommunity.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://shared.fastly.steamstatic.com/ https://checkout.steampowered.com/ https://store.steampowered.com/; frame-src 'self' steam: http://www.youtube.com https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://steamcommunity.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://checkout.steampowered.com/ https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/ https://steamcommunity.com/ https://help.steampowered.com/; frame-ancestors 'none'; Content-Encoding: gzip Vary: Accept-Encoding Strict-Transport-Security: max-age=10368000 Content-Length: 6747 Date: Sat 24 May 2025 12:31:56 GMT Connection: keep-alive Set-Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; path=/; secure; HttpOnly; SameSite=None Set-Cookie: browserid=412753823171828074; expires=Sun 24-May-2026 12:31:56 GMT; Max-Age=31536000; path=/; secure; SameSite=None Set-Cookie: sessionid=cbc7147d8b8442a93863abf7; Path=/; Secure; SameSite=None with response body ==>33633A32313A34343A34663A34333A35343A35393A35303A34353A32303A36383A37343A36643A36633A33653A30613A33633A36383A37343A36643A36633A32....... "GET /dynamicstore/saledata/?cc=US HTTP/1.1 Host: store.steampowered.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24" Accept: */* X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://store.steampowered.com/login Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; browserid=412753823171828074; sessionid=cbc7147d8b8442a93863abf7; timezoneOffset=-25200,0" Response ==> HTTP/1.1 200 OK Server: nginx Content-Type: application/json; charset=utf-8 X-Frame-Options: DENY Vary: Accept-Encoding Origin Cache-Control: public max-age=300 Expires: Sat 24 May 2025 12:34:28 GMT Last-Modified: Sat 24 May 2025 12:25:00 GMT Content-Encoding: gzip Vary: Accept-Encoding Strict-Transport-Security: max-age=10368000 Content-Length: 49 Date: Sat 24 May 2025 12:32:29 GMT Connection: keep-alive with response body ==>37623A32323A36323A34313A36633A36633A36663A37373A34313A37303A37303A34393A36643A37303A37323A36353A37333A37333A36393A36663A36653A37....... "GET /favicon.ico HTTP/1.1 Host: store.steampowered.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://store.steampowered.com/login Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; browserid=412753823171828074; sessionid=cbc7147d8b8442a93863abf7; timezoneOffset=-25200,0; ak_bmsc=C9374A2C8A7340C74785CEA28A1DB30E~000000000000000000000000000000~YAAQqCTDFzgN7O+WAQAAkudHAhsJ+ugJ3jtJFA+LN4BILjv0ScZWZjvxNKTl9ioDaxG3kUoDeK8gVYdGzmHs2fdhbCd3tIJGkz4Ccyyy7OnMLgzWfaoFbBSySbc2/jwjH1RkmEvnMXQAsGsjcQWjvgUHa+thSheG0J/5XCL3eNZ0IPvXYA4AAQue7SpgD4N1gTZYYgmUFQpZgK5A/8VR6uK+kFltFkeo3x2gtBiq4fx76i0+DRwtZEwD05yXmIDwGR3vnve8S3H5yaDReWpBRGmzh7E0vwiXsiYK5OPpWC86dE+st5HS3tJHgCq4GaR6fvoEOKXKWEjZBDsw9WbajkDnXAUYrPYHm2ouS9u7H/tbwetJs7Rbgu14+rkwoSEP+BT7ljw=" Response ==> HTTP/1.1 200 OK Server: nginx Content-Type: image/x-icon Cache-Control: public max-age=86400 Expires: Fri 07 Mar 2025 15:36:39 GMT Last-Modified: Wed 28 Jun 2023 04:07:18 GMT Strict-Transport-Security: max-age=10368000 Content-Length: 38554 Date: Sat 24 May 2025 12:32:37 GMT Connection: keep-alive with response body ==>30303A30303A30313A30303A30353A30303A31303A31303A30303A30303A30313A30303A32303A30303A36383A30343A30303A30303A35363A30303A30303A30....... "GET /ns?c=d93f0c70-38d6-11f0-a732-c5bcabf5e228 HTTP/1.1 Host: tzm.protechts.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: */* Origin: https://li.protechts.net Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://li.protechts.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Date: Sat 24 May 2025 12:32:41 GMT Content-Type: text/html Content-Length: 242 Access-Control-Allow-Origin: * with response body ==>36363A36363A33353A36313A36333A36353A33343A33323A36333A33313A36363A33353A36343A33303A33333A33313A33313A36363A36313A33383A33363A36....... "GET /v1/counter.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1 Host: b.stats.paypal.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.paypal.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ" Response ==> HTTP/1.1 302 Found Connection: close Server: PayPal-B.Stats/1.0 Location: https://slc.stats.paypal.com/v1/counter2.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w Content-Length: 0 Set-Cookie: c=9ebad54a66acd3b3ddf3; Domain=stats.paypal.com; expires=Fri 19 May 2045 12:32:46 GMT; Path=/ Content-Type: application/octet-stream Date: Sat 24 May 2025 12:32:46 GMT with no response body "GET /v1/counter2.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1 Host: slc.stats.paypal.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.paypal.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ; KHcl0EuY7AKSMgfvHl7J5E7hPtK=WDckqzzy9vIWdSfHBSr21ywQ9jcffPZH_af73lDsaeYEp7HG-hEXr5QXu_tU6ttG6FuinJp-AGS-6WTA; ddi=G3snUBqktJChviAUctibdWBY-7BqT26ut_Zj7uE-onOzLMQRnf06iPA3Rr8V-LWJyvzfllDpne-tl-SElQNe4CXdgBlGmzGoCGqWB3BQM65RWqUO; c=9ebad54a66acd3b3ddf3; sc_f=0wf7biK6sULawYka6_-wcAz-c70v2qMjLrQC7eRnBXEczlw-LaasRJuf02oPzSKZM0uVI6gd-GaFu3sSjCAptBETw9HNENV1VMx_UW" Response ==> HTTP/1.1 200 OK Connection: close Server: PayPal-B.Stats/1.0 Content-Type: image/jpeg Content-Length: 42 Set-Cookie: c=9ebad54a66acd3b3ddf3; Domain=stats.paypal.com; expires=Fri 19 May 2045 12:32:47 GMT; Path=/ Date: Sat 24 May 2025 12:32:47 GMT with response body ==>34373A34393A34363A33383A33393A36313A30313A30303A30313A30303A38303A30303A30303A30303A30303A30303A66663A66663A66663A32313A66393A30.......3d:Tf15,"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "52DD30E29ABF61D4E6EA0CA34E23649FE98C73D6529C5B5253825660F0D0F919.EXE"; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")3e:T51d,Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") file/memory contains long string with (Indicator: "ExitWindows"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "InitiateSystemShutdownExW" (Indicator: "InitiateSystemShutdown"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "SetSystemPowerState" (Indicator: "SetSystemPowerState"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "SetSystemPowerState" (Indicator: "SetSystemPowerState"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "InitiateSystemShutdownExW" (Indicator: "InitiateSystemShutdown"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") file/memory contains long string with (Indicator: "ExitWindows"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")3f:T8ab,"Qj7GR07.exe" called "FindFirstFileA" with parameter %TEMP%\IXP003.TMP\* (UID: 00000000-00006196) "Qj7GR07.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00006196) "2HO7525.exe" called "FindFirstFileW" with parameter %TEMP%\IXP003.TMP\2HO7525.exe (UID: 00000000-00004412) "2HO7525.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004412) "2HO7525.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00004412) "2HO7525.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004412) "2HO7525.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00004412) "2HO7525.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00004412) "2HO7525.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004412) "2HO7525.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004412) "2HO7525.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00004412) "2HO7525.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00004412) "2HO7525.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00004412) "2HO7525.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00004412) "2HO7525.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00004412) "2HO7525.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00004412) "2HO7525.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00004412) "2HO7525.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00004412) "2HO7525.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00004412) "2HO7525.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00004412) "2HO7525.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00004412) "2HO7525.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00004412)40:T819,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004412.00000000.144519.0128A000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")41:T57c,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")42:T89e,Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00006196.00000000.143256.010E0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00006196.00000000.143256.010E0000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")43:T52b,Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; File: "00000000-00004320.00000000.143308.008D1000.00000020.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")44:T47c,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004412.00000000.144519.00F82000.00000040.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")45:T4b7,"0b000c0017fb6f01c004d073c204d073@mscoree.dll" "0e000f00603fc0058031267438f83f01@advapi32.dll" "0d000e00603fc005a0644e7138f83f01@advapi32.dll" "0b000c00603fc005702a257438f83f01@advapi32.dll" "0b000c00603fc00560f5247438f83f01@advapi32.dll" "14001500603fc005701d267438f83f01@advapi32.dll" "10001100603fc00500fa247438f83f01@advapi32.dll" "0d000e00603fc005002a257438f83f01@advapi32.dll" "0f001000603fc005f0614e7138f83f01@advapi32.dll" "08000900603fc005f03f257438f83f01@advapi32.dll" "0c000d00603fc005f02c257438f83f01@advapi32.dll" "0e000f00603fc005e0654e7138f83f01@advapi32.dll" "10001100603fc00590c4427538f83f01@SHELL32.dll" "0d000e00603fc005d09b3c7538f83f01@SHELL32.dll" "0b000c00603fc005e0519f7438f83f01@WS2_32.dll" "0c000d00603fc005404f9f7438f83f01@WS2_32.dll" "12001300603fc005e058007438f83f01@CRYPT32.dll" "12001300603fc00580ca5d7438f83f01@shlwapi.dll" "0e000f00603fc005500b8b7338f83f01@gdiplus.dll" "0f001000603fc005c00a8b7338f83f01@gdiplus.dll" "10001100603fc00580f38a7338f83f01@gdiplus.dll" "13001400603fc005e0a0877338f83f01@gdiplus.dll" "18001900603fc005f095877338f83f01@gdiplus.dll" "1b001c00603fc0052079897338f83f01@gdiplus.dll" "14001500603fc00510b8877338f83f01@gdiplus.dll"46:T4d9,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00004320.00000000.143308.008D1000.00000020.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004412.00000000.144519.0128A000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")47:T583,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")48:T1355,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "CreateProcessWithLogonW" (Indicator: "CreateProcess"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.00A40000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "L32.DLL" FUNCTION="CreateProcessW"/>" (Indicator: "CreateProcess"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp 00000000-00002988.00000002.146910.032E0000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp 00000000-00002988.00000002.146910.032E0000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp 00000000-00002988.00000002.146910.032E0000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp 00000000-00002988.00000002.146910.032E0000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp 00000000-00002988.00000002.146910.032E0000.00000004.mdmp"), Found reference to API "PRINT NS_ElevateCreateProcess::APIHook_CreateProcessA 318 [ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp 00000000-00002988.00000002.146910.032E0000.00000004.mdmp"), Found reference to API "2581598928 6284 3141 CreateProcessA kernel32.dll "00:37:11.687" RX=0 PX=0" (Indicator: "CreateProcess"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp 00000000-00002988.00000002.146910.032E0000.00000004.mdmp"), Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp"), Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp"), Found reference to API "CreateProcessWithLogonW" (Indicator: "CreateProcess"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp"), Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00004320.00000000.143308.03050000.00000004.mdmp 00000000-00004320.00000000.143308.030F0000.00000004.mdmp"), Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp"), Found reference to API "_COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp"), Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp"), Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp 00000000-00004412.00000000.144519.03AA0000.00000004.mdmp 00000000-00004412.00000000.144519.05D90000.00000004.mdmp")49:T662,"HB8Ri19.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\IXP000.TMP\HB8Ri19.exe]- [targetUID: 00000000-00006560] "ao2FE12.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\IXP001.TMP\ao2FE12.exe]- [targetUID: 00000000-00006560] "3on26Nz.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 8 sections"- Location: [%TEMP%\IXP002.TMP\3on26Nz.exe]- [targetUID: 00000000-00009036] "5AU2Hf7.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\IXP000.TMP\5AU2Hf7.exe]- [targetUID: 00000000-00002988] "4ft667bN.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 8 sections"- Location: [%TEMP%\IXP001.TMP\4ft667bN.exe]- [targetUID: 00000000-00006560] "Qj7GR07.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\IXP002.TMP\Qj7GR07.exe]- [targetUID: 00000000-00006196] "1uM06vb2.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\IXP003.TMP\1uM06vb2.exe]- [targetUID: 00000000-00006196] "2HO7525.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 6 sections"- Location: [%TEMP%\IXP003.TMP\2HO7525.exe]- [targetUID: 00000000-00006196] "RageMP131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 8 sections"- Location: [%LOCALAPPDATA%\RageMP131\RageMP131.exe]- [targetUID: 00000000-00009036] "MPGPH131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 8 sections"- Location: [%ALLUSERSPROFILE%\MPGPH131\MPGPH131.exe]- [targetUID: 00000000-00009036]4a:T81f,Found reference to API "LockResource" (Indicator: "LockResource"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")4b:T25a5,"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002988) "HB8Ri19.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006560) "HB8Ri19.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006560) "HB8Ri19.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006560) "ao2FE12.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008952) "ao2FE12.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008952) "ao2FE12.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008952) "Qj7GR07.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006196) "Qj7GR07.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006196) "Qj7GR07.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006196) "1uM06vb2.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004320) "1uM06vb2.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000c0000f03000000000000000001010000ff0700000000000000000000000000000000000000000000b420000000000001000000000000000140ba110340ba11030a00000000000000ff0700000000000048ba1103ff0700000000000000000100feffffff200000004cfeff007f219000787711030477110302000000000000000d00000044feff00bb2f9000f80d9a0080feff008e1e9000020000007e1e9000dbbd452702000000a0c896000d0000000000000054feff000000000038ffff00202d8f0093c92327feffffff7e1e90002d1f900094feff00b0feff0098feff00020000000200000000080000b8feff002022900002000000b0feff00 (UID: 00000000-00004320) "1uM06vb2.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004320)4c:Tbc2,"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" trying to access non-existent file "C:\CABINET.DLL" "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" trying to access non-existent file "C:\VERSION.DLL" "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" trying to access non-existent file "C:\FLTLIB.DLL" "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\HB8RI19.EXE" "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\HB8Ri19.exe" "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\5AU2HF7.EXE" "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\5AU2Hf7.exe" "HB8Ri19.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "HB8Ri19.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CABINET.DLL" "HB8Ri19.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VERSION.DLL" "HB8Ri19.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\FLTLIB.DLL" "HB8Ri19.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\AO2FE12.EXE" "HB8Ri19.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\ao2FE12.exe" "HB8Ri19.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\4FT667BN.EXE" "HB8Ri19.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\4ft667bN.exe" "ao2FE12.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "ao2FE12.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\CABINET.DLL" "ao2FE12.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VERSION.DLL" "ao2FE12.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\FLTLIB.DLL" "ao2FE12.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\QJ7GR07.EXE" "ao2FE12.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\Qj7GR07.exe" "ao2FE12.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3ON26NZ.EXE" "ao2FE12.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3on26Nz.exe" "Qj7GR07.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL"4d:Tce8,"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\HB8Ri19.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" wrote 17408 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\5AU2Hf7.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "HB8Ri19.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\ao2FE12.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "HB8Ri19.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\4ft667bN.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "ao2FE12.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\Qj7GR07.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "ao2FE12.exe" wrote 6144 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3on26Nz.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Qj7GR07.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1uM06vb2.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Qj7GR07.exe" wrote 1024 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2HO7525.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...4e:T64f,"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "HB8Ri19.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "HB8Ri19.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "ao2FE12.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "ao2FE12.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Qj7GR07.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Qj7GR07.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1uM06vb2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1uM06vb2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "2HO7525.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3on26Nz.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3on26Nz.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")4f:T19d3,GET /login HTTP/1.1 Host: store.steampowered.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 Accept: text/html application/xhtml+xml application/xml;q=0.9 image/webp image/apng */*;q=0.8 application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 GET /dynamicstore/saledata/?cc=US HTTP/1.1 Host: store.steampowered.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" Accept: */* X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://store.steampowered.com/login Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; browserid=412753823171828074; sessionid=cbc7147d8b8442a93863abf7; timezoneOffset=-25200 0 GET /favicon.ico HTTP/1.1 Host: store.steampowered.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://store.steampowered.com/login Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; browserid=412753823171828074; sessionid=cbc7147d8b8442a93863abf7; timezoneOffset=-25200 0; ak_bmsc=C9374A2C8A7340C74785CEA28A1DB30E~000000000000000000000000000000~YAAQqCTDFzgN7O+WAQAAkudHAhsJ+ugJ3jtJFA+LN4BILjv0ScZWZjvxNKTl9ioDaxG3kUoDeK8gVYdGzmHs2fdhbCd3tIJGkz4Ccyyy7OnMLgzWfaoFbBSySbc2/jwjH1RkmEvnMXQAsGsjcQWjvgUHa+thSheG0J/5XCL3eNZ0IPvXYA4AAQue7SpgD4N1gTZYYgmUFQpZgK5A/8VR6uK+kFltFkeo3x2gtBiq4fx76i0+DRwtZEwD05yXmIDwGR3vnve8S3H5yaDReWpBRGmzh7E0vwiXsiYK5OPpWC86dE+st5HS3tJHgCq4GaR6fvoEOKXKWEjZBDsw9WbajkDnXAUYrPYHm2ouS9u7H/tbwetJs7Rbgu14+rkwoSEP+BT7ljw= GET /ns?c=d93f0c70-38d6-11f0-a732-c5bcabf5e228 HTTP/1.1 Host: tzm.protechts.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: */* Origin: https://li.protechts.net Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://li.protechts.net/ Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 GET /v1/counter.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1 Host: b.stats.paypal.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.paypal.com/ Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ GET /v1/counter2.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1 Host: slc.stats.paypal.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="107" "Chromium";v="107" "Not=A?Brand";v="24" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 sec-ch-ua-platform: "Windows" Accept: image/webp image/apng image/svg+xml image/* */*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.paypal.com/ Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ; KHcl0EuY7AKSMgfvHl7J5E7hPtK=WDckqzzy9vIWdSfHBSr21ywQ9jcffPZH_af73lDsaeYEp7HG-hEXr5QXu_tU6ttG6FuinJp-AGS-6WTA; ddi=G3snUBqktJChviAUctibdWBY-7BqT26ut_Zj7uE-onOzLMQRnf06iPA3Rr8V-LWJyvzfllDpne-tl-SElQNe4CXdgBlGmzGoCGqWB3BQM65RWqUO; c=9ebad54a66acd3b3ddf3; sc_f=0wf7biK6sULawYka6_-wcAz-c70v2qMjLrQC7eRnBXEczlw-LaasRJuf02oPzSKZM0uVI6gd-GaFu3sSjCAptBETw9HNENV1VMx_UW 50:T5de,"abs.twimg.com" with TTL 258 "accounts.google.com" with TTL 300 "api.hcaptcha.com" with TTL 300 "api.twitter.com" with TTL 477 "b.stats.paypal.com" with TTL 235 "browser-intake-us5-datadoghq.com" with TTL 113 "c.paypal.com" with TTL 286 "c6.paypal.com" with TTL 156 "csp.withgoogle.com" with TTL 214 "ddbm2.paypal.com" with TTL 203 "dpm.demdex.net" with TTL 255 "facebook.com" with TTL 60 "fbcdn.net" with TTL 60 "fbsbx.com" with TTL 60 "fonts.googleapis.com" with TTL 142 "fonts.gstatic.com" with TTL 234 "googleads.g.doubleclick.net" with TTL 116 "i.ytimg.com" with TTL 300 "instagram.com" with TTL 60 "js.hcaptcha.com" with TTL 300 "lnkd.demdex.net" with TTL 248 "newassets.hcaptcha.com" with TTL 300 "paypalobjects.com" with TTL 255 "platform.linkedin.com" with TTL 225 "play.google.com" with TTL 300 "slc.stats.paypal.com" with TTL 10 "static-assets-prod.unrealengine.com" with TTL 300 "static.licdn.com" with TTL 66 "store.steampowered.com" with TTL 20 "stun.l.google.com" with TTL 300 "t.co" with TTL 335 "t.paypal.com" with TTL 189 "talon-service-prod.ecosec.on.epicgames.com" with TTL 300 "talon-website-prod.ecosec.on.epicgames.com" with TTL 300 "tracking.epicgames.com" with TTL 60 "twitter.com" with TTL 64 "tzm.protechts.net" with TTL 154 "use1-turn.fpjs.io" with TTL 60 "www.google.com" with TTL 174 "www.gstatic.com" with TTL 300 "www.linkedin.com" with TTL 300 "www.recaptcha.net" with TTL 300 "www.youtube.com" with TTL 158 "x.com" with TTL 751:T482,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00004412.00000000.144519.0128A000.00000040.mdmp") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")52:T717,Short term registered certificate: "accounts.google.com" (83 days old) Short term registered certificate: "api.hcaptcha.com" (90 days old) Short term registered certificate: "api.twitter.com" (89 days old) Short term registered certificate: "api.x.com" (89 days old) Short term registered certificate: "community.fastly.steamstatic.com" (89 days old) Short term registered certificate: "connect.facebook.net" (90 days old) Short term registered certificate: "csp.withgoogle.com" (83 days old) Short term registered certificate: "facebook.com" (90 days old) Short term registered certificate: "fbcdn.net" (90 days old) Short term registered certificate: "fbsbx.com" (90 days old) Short term registered certificate: "fonts.googleapis.com" (83 days old) Short term registered certificate: "fonts.gstatic.com" (83 days old) Short term registered certificate: "googleads.g.doubleclick.net" (83 days old) Short term registered certificate: "i.ytimg.com" (83 days old) Short term registered certificate: "instagram.com" (72 days old) Short term registered certificate: "js.hcaptcha.com" (90 days old) Short term registered certificate: "newassets.hcaptcha.com" (90 days old) Short term registered certificate: "play.google.com" (83 days old) Short term registered certificate: "static-assets-prod.unrealengine.com" (90 days old) Short term registered certificate: "static.cdninstagram.com" (72 days old) Short term registered certificate: "static.xx.fbcdn.net" (90 days old) Short term registered certificate: "store.fastly.steamstatic.com" (89 days old) Short term registered certificate: "t.co" (89 days old) Short term registered certificate: "talon-service-prod.ecosec.on.epicgames.com" (90 days old) Short term registered certificate: "talon-website-prod.ecosec.on.epicgames.com" (90 days old)53:Tc3c,"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\HB8RI19.EXE"; Value: "") "HB8Ri19.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\AO2FE12.EXE"; Value: "") "ao2FE12.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\QJ7GR07.EXE"; Value: "") "ao2FE12.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\3ON26NZ.EXE"; Value: "") "Qj7GR07.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\1UM06VB2.EXE"; Value: "") "Qj7GR07.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\2HO7525.EXE"; Value: "") "1uM06vb2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: ""), "3on26Nz.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: ""), "3on26Nz.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: ""), "3on26Nz.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: ""), "3on26Nz.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: ""), "3on26Nz.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: ""), "3on26Nz.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: ""), "3on26Nz.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: ""), "3on26Nz.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "")54:Tb4b,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00009036-00000C2B-1277183953") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00009036-00000C2B-1277184098") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00009036-00000C2B-1277184134") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00009036-00000C2B-1277184183") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00009036-00000C2B-1277184284") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp")55:T479,"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00002988) "HB8Ri19.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00006560) "HB8Ri19.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00006560) "ao2FE12.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00008952) "ao2FE12.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00008952) "ao2FE12.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00008952) "Qj7GR07.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00006196) "Qj7GR07.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00006196) "Qj7GR07.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00006196) "Qj7GR07.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00006196) "Qj7GR07.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP\ (UID: 00000000-00006196)56:T416,Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "00000000-00009036.00000001.146814.00271000.00000040.mdmp")57:T498,"1uM06vb2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "1uM06vb2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTPS"; Value: "") "1uM06vb2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: ""; Value: "") "1uM06vb2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: "HIDDEN"; Value: "") "1uM06vb2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "1uM06vb2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTPS"; Value: "") "1uM06vb2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: ""; Value: "") "1uM06vb2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: "HIDDEN"; Value: "")58:Te37,"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919" was detected as "Microsoft Cabinet" and name: "sfx" "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919" was detected as "Microsoft Visual C/C++" and name: "Compiler" "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919" was detected as "Microsoft Cabinet File" and name: "Archive" "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919" was detected as "Microsoft Linker" and name: "Linker" "HB8Ri19.exe" was detected as "Microsoft Cabinet" and name: "sfx" "HB8Ri19.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "HB8Ri19.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "HB8Ri19.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "HB8Ri19.exe" was detected as "Microsoft Linker" and name: "Linker" "ao2FE12.exe" was detected as "Microsoft Cabinet" and name: "sfx" "ao2FE12.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "ao2FE12.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ao2FE12.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "ao2FE12.exe" was detected as "Microsoft Linker" and name: "Linker" "3on26Nz.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3on26Nz.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3on26Nz.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3on26Nz.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3on26Nz.exe" was detected as "Microsoft Linker" and name: "Linker" "5AU2Hf7.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5AU2Hf7.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5AU2Hf7.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5AU2Hf7.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5AU2Hf7.exe" was detected as "Microsoft Linker" and name: "Linker" "4ft667bN.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4ft667bN.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4ft667bN.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4ft667bN.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4ft667bN.exe" was detected as "Microsoft Linker" and name: "Linker" "Qj7GR07.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Qj7GR07.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Qj7GR07.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Qj7GR07.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Qj7GR07.exe" was detected as "Microsoft Linker" and name: "Linker" "1uM06vb2.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1uM06vb2.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1uM06vb2.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1uM06vb2.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1uM06vb2.exe" was detected as "Microsoft Linker" and name: "Linker" "2HO7525.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2HO7525.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2HO7525.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2HO7525.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2HO7525.exe" was detected as "Microsoft Linker" and name: "Linker"59:T762,"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919" has section name .text with entropy "6.314163792045976" "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919" has section name .rsrc with entropy "7.996699581845602" "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919" has section name .reloc with entropy "6.222637930812128" "HB8Ri19.exe" has section name .text with entropy "6.314163792045976" "HB8Ri19.exe" has section name .rsrc with entropy "7.995886315838371" "HB8Ri19.exe" has section name .reloc with entropy "6.222637930812128" "ao2FE12.exe" has section name .text with entropy "6.314163792045976" "ao2FE12.exe" has section name .rsrc with entropy "7.992592822169769" "ao2FE12.exe" has section name .reloc with entropy "6.222637930812128" "3on26Nz.exe" has section name with entropy "7.999551775193585" "3on26Nz.exe" has section name with entropy "7.995594961457606" "3on26Nz.exe" has section name with entropy "7.262836628761155" "3on26Nz.exe" has section name with entropy "7.992520113436494" "3on26Nz.exe" has section name with entropy "7.998688299551119" "3on26Nz.exe" has section name .data with entropy "7.977106375433132" "5AU2Hf7.exe" has section name .text with entropy "6.620456398727848" "5AU2Hf7.exe" has section name .reloc with entropy "6.6329469459556964" "4ft667bN.exe" has section name with entropy "7.99749851382577" "4ft667bN.exe" has section name with entropy "7.98835130867074" "4ft667bN.exe" has section name with entropy "7.153703034305481" "4ft667bN.exe" has section name with entropy "7.978845655763044" "4ft667bN.exe" has section name with entropy "7.998659600452049" "4ft667bN.exe" has section name .data with entropy "7.97335966277628" "Qj7GR07.exe" has section name .text with entropy "6.314163792045976" "Qj7GR07.exe" has section name .rsrc with entropy "7.964092609429604"5a:T477,"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\HB8Ri19.exe" - (UID: 00000000-00002988) "HB8Ri19.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\ao2FE12.exe" - (UID: 00000000-00006560) "ao2FE12.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\Qj7GR07.exe" - (UID: 00000000-00008952) "ao2FE12.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\3on26Nz.exe" - (UID: 00000000-00008952) "Qj7GR07.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\1uM06vb2.exe" - (UID: 00000000-00006196) "Qj7GR07.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\2HO7525.exe" - (UID: 00000000-00006196) "3on26Nz.exe" called "CreateProcessA" with parameter "schtasks /create /f /RU "uD0xdzD" /tr "%ALLUSERSPROFILE%\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST" - (UID: 00000000-00009036) "3on26Nz.exe" called "CreateProcessA" with parameter "schtasks /create /f /RU "uD0xdzD" /tr "%ALLUSERSPROFILE%\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST" - (UID: 00000000-00009036)5b:Tc4b,Spawned process "HB8Ri19.exe" (UID: 00000000-00006560) Spawned process "ao2FE12.exe" (UID: 00000000-00008952) Spawned process "Qj7GR07.exe" (UID: 00000000-00006196) Spawned process "1uM06vb2.exe" (UID: 00000000-00004320) Spawned process "msedge.exe" with commandline "--single-argument https://accounts.google.com/" (UID: 00000000-00009148) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00008376), Spawned process "msedge.exe" with commandline "--single-argument https://www.facebook.com/login" (UID: 00000000-00008324), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00007148) Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00003596) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00007116) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00005520) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00004384) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00006952) Spawned process "msedge.exe" with commandline "--single-argument https://store.steampowered.com/login" (UID: 00000000-00007348) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00005248) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00004268), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00002172), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00003096), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00007968), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00003396), Spawned process "msedge.exe" with commandline "--single-argument https://steamcommunity.com/openid/loginform" (UID: 00000000-00005408), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00006672), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00005768) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00006592) Spawned process "msedge.exe" with commandline "--single-argument https://www.epicgames.com/id/login" (UID: 00000000-00007360)5c:T14d9,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: 52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: HB8Ri19.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: HB8Ri19.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: HB8Ri19.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: HB8Ri19.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: HB8Ri19.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: ao2FE12.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: ao2FE12.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: ao2FE12.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: ao2FE12.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: ao2FE12.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: Qj7GR07.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: Qj7GR07.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Qj7GR07.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: Qj7GR07.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: Qj7GR07.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 1uM06vb2.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 1uM06vb2.exe] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: 1uM06vb2.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: 1uM06vb2.exe] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: 1uM06vb2.exe] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: 1uM06vb2.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 1uM06vb2.exe] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: 1uM06vb2.exe] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: 1uM06vb2.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: 1uM06vb2.exe] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: 1uM06vb2.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 1uM06vb2.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: 1uM06vb2.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: 1uM06vb2.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 1uM06vb2.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: 1uM06vb2.exe]5d:Tea9,The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: D7:A7:49:97:9A:54:CD:B8:6A:E1:DF:0D:73:A6:23:32:B3:B3:A6:72; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 1B:51:1A:BE:AD:59:C6:CE:20:70:77:C0:BF:0E:00:43:B1:38:26:12; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: C1:23:6B:8B:E9:B9:28:BB:DE:15:E9:38:B1:9E:50:AA:7D:13:C9:E9; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 58:48:35:EB:FF:60:A4:49:F6:D6:07:45:EA:39:4E:9C:4D:44:72:CE; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=E5, O=Let's Encrypt, C=US" (SHA1: 97:B5:3B:9A:FF:1B:C1:F6:72:05:D1:FA:B6:19:AB:BD:31:15:86:8C; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 5F:28:D9:C5:89:EE:4B:F3:1A:11:B7:8C:72:B8:D1:3F:07:9D:DC:45; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 6B:78:22:20:99:CA:A8:A9:FD:1D:98:FB:F8:18:60:C1:93:C8:E8:C7; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 63:8B:07:EF:33:13:43:A4:92:3C:B4:4C:C3:1D:70:C2:E3:89:6D:FF; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert SHA2 Extended Validation Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: D3:FA:28:57:AF:61:AB:95:FA:21:63:D4:AC:8D:74:AA:DE:8E:CA:3F; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7E:2F:3A:4F:8F:E8:FA:8A:57:30:AE:CA:02:96:96:63:7E:98:6F:3F; see report for more information) The input sample is signed with a certificate issued by "CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B0:06:10:9D:D6:6B:75:19:AB:17:9F:FB:46:92:17:F9:EA:18:E8:A4; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7C:CC:2A:87:E3:94:9F:20:57:2B:18:48:29:80:50:5F:A9:0C:AC:3B; see report for more information)5e:T494,"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "HB8Ri19.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "HB8Ri19.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "ao2FE12.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "ao2FE12.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "ao2FE12.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "Qj7GR07.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "Qj7GR07.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "Qj7GR07.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "Qj7GR07.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" with delete access "Qj7GR07.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2HO7525.exe" with delete access "Qj7GR07.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1uM06vb2.exe" with delete access5f:T134c,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found URL "https://store.steampowered.com/loginppx90nv6nhay5n6a98fnetv7tpk64pp35esecurity=impersonation" - Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found URL "https://store.steampowered.com/login:\windows\system32\windows.storage.dllp.exeppx90nv6nhay5n6a98fnetv7tpk64pp35es:\windows\system32\windows.storage.dllhttpspenasunasebcache_" - Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found URL "https://accounts.google.com/ttps://accounts.google.com/:\users\hapubws\appdata\localicrosoft\windows\inetcookies:\windows\syswow64\ieframe.dllttps://accounts.google.com/:\windows\syswow64\ieframe.dllle4e2b4bb3501de7ec1f7a9858353c:\windows\system32\ieframe.dll:\windows\syswow64\ieframe.dllicrosoft" - Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found URL "https://store.steampowered.com/loginc:\program" - Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found URL "https://store.steampowered.com/loginhttps://store.steampowered.com/login:\program" - Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found URL "https://store.steampowered.com/loginhttps://store.steampowered.com/loginhttps://store.steampowered.com/login:\program" - Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found URL "https://www.facebook.com/login??\c:\users\hapubws\appdata\local\temp\ixp003.tmpoftware\microsoft\internet" - Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found URL "https://accounts.google.com/oftware\clients\contacts\address" - Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found URL "https://store.steampowered.com/loginhttps://store.steampowered.com/login??\c:\program" - Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found URL "https://store.steampowered.com/login??\c:\0f78b956-909d-45b2-8b8d-2e5e1d522649https://store.steampowered.com/loginhttps://store.steampowered.com/loginth=\usepubwslocalappdata=c:\users\hap??\c:\0f78b956-909d-45b2-8b8d-2e5e1d522649driveos=windows_ntpath=c:\programdata0https://store.steampowered.com/login??\c:\windows\system32\launchwinapp.exe\wi[powershell\v1.0\;c:\users\hss\appdata\lw??\c:\0f78b956-909d-45bld-2e5e1d522649bws\appdata\local\pyms\python\python311https://store.steampowered.com/loginxe;.bat;.vbs;.vbe;.js;.jse;.wsf;.wsh;.https://store.steampowered.com/loginprocessor_identifier=intel64" - Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found URL "https://store.steampowered.com/login35es\java\jttps:s\syste:\windo\windowtysteshelapubws\appl\programs\python\python311\scripts\;c:\users\hapubws\appdata\local\programs\python\python311\;c:\users\hapubws\appdata\local\microsoft\windowsapps;c:\program" - Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found URL "http://www.enigmaprotector.com/e-mail" - Source: "00000000-00004412.00000000.144519.0128A000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006196.00000000.143256.010E0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006560.00000001.145069.03520000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006560.00000002.146991.03520000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00008952.00000000.143208.03900000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00008952.00000001.145127.03900000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00008952.00000002.147049.03900000.00000004.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00009036.00000000.144893.00271000.00000040.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00009036.00000000.144893.00271000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00009036.00000000.144893.03650000.00000004.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00009036.00000001.146814.00271000.00000040.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00009036.00000001.146814.00271000.00000040.mdmp")60:T48c,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004412.00000000.144519.0128A000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")61:T412,Found string "OpenProcessToken" (Indicator: "OpenProcess"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") file/memory contains long string with (Indicator: "OpenProcess"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found string "OpenProcess" (Indicator: "OpenProcess"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004412.00000000.144519.00F82000.00000040.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")62:Tc85,"INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 51397-2033-00342220, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "CREATE TABLE sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)" (Source: 51397-2063-0034FC80, Indicator: "create table sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 51397-2063-0034FC80, Indicator: "select name rootpage sql from '%q'.%s"), "SELECT name rootpage sql FROM '%q'.%s WHERE %s" (Source: 51397-2090-0032DE10, Indicator: "select name rootpage sql from '%q'.%s where %s"), "DELETE FROM %Q.%s WHERE name=%Q" (Source: 51397-2120-003431A0, Indicator: "delete from %q.%s where name=%q"), "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 51397-2120-003431A0, Indicator: "delete from %q.sqlite_stat1 where idx=%q"), "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q) tbl_name = %Q name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='" (Source: 51397-2212-0033D260, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='") "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 51397-2214-0033D990, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "UPDATE %Q.%s SET type='table' name=%Q tbl_name=%Q rootpage=0 sql=%Q WHERE rowid=#%d" (Source: 51397-2217-0035CCD0, Indicator: "update %q.%s set type='table' name=%q tbl_name=%q rootpage=0 sql=%q where rowid=#%d"), "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 51397-2290-00341990, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'"), "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 51397-2290-00341990, Indicator: "delete from %q.sqlite_stat1 where tbl=%q"), "UPDATE %Q.%s SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 51397-2293-00341360, Indicator: "update %q.%s set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "CREATE TABLE" (Source: 51397-2294-003410F0, Indicator: "create table"), "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q) tbl_name = %Q name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');" (Source: 00000000-00009036.00000001.146814.00271000.00000040.mdmp, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='table' or type='index' or type='trigger');")63:Tc85,"INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 51397-2033-00342220, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "CREATE TABLE sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)" (Source: 51397-2063-0034FC80, Indicator: "create table sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 51397-2063-0034FC80, Indicator: "select name rootpage sql from '%q'.%s"), "SELECT name rootpage sql FROM '%q'.%s WHERE %s" (Source: 51397-2090-0032DE10, Indicator: "select name rootpage sql from '%q'.%s where %s"), "DELETE FROM %Q.%s WHERE name=%Q" (Source: 51397-2120-003431A0, Indicator: "delete from %q.%s where name=%q"), "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 51397-2120-003431A0, Indicator: "delete from %q.sqlite_stat1 where idx=%q"), "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q) tbl_name = %Q name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='" (Source: 51397-2212-0033D260, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='") "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 51397-2214-0033D990, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "UPDATE %Q.%s SET type='table' name=%Q tbl_name=%Q rootpage=0 sql=%Q WHERE rowid=#%d" (Source: 51397-2217-0035CCD0, Indicator: "update %q.%s set type='table' name=%q tbl_name=%q rootpage=0 sql=%q where rowid=#%d"), "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 51397-2290-00341990, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'"), "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 51397-2290-00341990, Indicator: "delete from %q.sqlite_stat1 where tbl=%q"), "UPDATE %Q.%s SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 51397-2293-00341360, Indicator: "update %q.%s set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "CREATE TABLE" (Source: 51397-2294-003410F0, Indicator: "create table"), "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q) tbl_name = %Q name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');" (Source: 00000000-00009036.00000001.146814.00271000.00000040.mdmp, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='table' or type='index' or type='trigger');")64:Te7e,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetDC" (Indicator: "GetDC"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")65:T780,"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "FindResourceA" with parameter "12522104" - (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "FindResourceA" with parameter "12522112" - (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "FindResourceA" with parameter "12522140" - (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "FindResourceA" with parameter "12522352" - (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "FindResourceA" with parameter "12522168" - (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "FindResourceA" with parameter "12522324" - (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "FindResourceA" with parameter "12522336" - (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "FindResourceA" with parameter "7339024" - (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "FindResourceA" with parameter "12522220" - (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "FindResourceA" with parameter "12522316" - (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "FindResourceA" with parameter "7339020" - (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "FindResourceA" with parameter "12522184" - (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "FindResourceA" with parameter "12522192" - (UID: 00000000-00002988)66:Td1c,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")67:Te12,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006196.00000000.143256.010E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006196.00000000.143256.010E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006196.00000000.143256.010E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006196.00000000.143256.010E0000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")68:T66e,Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found string "\Device\HarddiskVolume1\??\Volume{815ead30-0000-0000-0000-100000000000}" (Indicator: "\Device\"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00006196.00000000.143256.010E0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006196.00000000.143256.010E0000.00000004.mdmp")69:Tb02,Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00004412-00000C2B-1268139870") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00004412-00000C2B-1268149843") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "findwindow"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "11377057092,3468,100,,FindWindowExW,user32.dll,"00:37:18.968",RX=0,PX=0" (Indicator: "findwindow"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")6a:Tc4b,Spawned process "HB8Ri19.exe" (UID: 00000000-00006560) Spawned process "ao2FE12.exe" (UID: 00000000-00008952) Spawned process "Qj7GR07.exe" (UID: 00000000-00006196) Spawned process "1uM06vb2.exe" (UID: 00000000-00004320) Spawned process "msedge.exe" with commandline "--single-argument https://accounts.google.com/" (UID: 00000000-00009148) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00008376), Spawned process "msedge.exe" with commandline "--single-argument https://www.facebook.com/login" (UID: 00000000-00008324), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00007148) Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00003596) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00007116) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00005520) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00004384) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00006952) Spawned process "msedge.exe" with commandline "--single-argument https://store.steampowered.com/login" (UID: 00000000-00007348) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00005248) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00004268), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00002172), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00003096), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00007968), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00003396), Spawned process "msedge.exe" with commandline "--single-argument https://steamcommunity.com/openid/loginform" (UID: 00000000-00005408), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00006672), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00005768) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00006592) Spawned process "msedge.exe" with commandline "--single-argument https://www.epicgames.com/id/login" (UID: 00000000-00007360)6b:Tc6bf,Contains base62 string in header "7Cdd89e304c87f19ea401ddd7cfd7158f" in header "GET /dynamicstore/saledata/?cc=US HTTP/1.1Host: store.steampowered.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"Accept: */*X-Requested-With: XMLHttpRequestsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://store.steampowered.com/loginAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; browserid=412753823171828074; sessionid=cbc7147d8b8442a93863abf7; timezoneOffset=-25200,0" Contains base62 string in header "7Cdd89e304c87f19ea401ddd7cfd7158f" in header "GET /favicon.ico HTTP/1.1Host: store.steampowered.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://store.steampowered.com/loginAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; browserid=412753823171828074; sessionid=cbc7147d8b8442a93863abf7; timezoneOffset=-25200,0; ak_bmsc=C9374A2C8A7340C74785CEA28A1DB30E~000000000000000000000000000000~YAAQqCTDFzgN7O+WAQAAkudHAhsJ+ugJ3jtJFA+LN4BILjv0ScZWZjvxNKTl9ioDaxG3kUoDeK8gVYdGzmHs2fdhbCd3tIJGkz4Ccyyy7OnMLgzWfaoFbBSySbc2/jwjH1RkmEvnMXQAsGsjcQWjvgUHa+thSheG0J/5XCL3eNZ0IPvXYA4AAQue7SpgD4N1gTZYYgmUFQpZgK5A/8VR6uK+kFltFkeo3x2gtBiq4fx76i0+DRwtZEwD05yXmIDwGR3vnve8S3H5yaDReWpBRGmzh7E0vwiXsiYK5OPpWC86dE+st5HS3tJHgCq4GaR6fvoEOKXKWEjZBDsw9WbajkDnXAUYrPYHm2ouS9u7H/tbwetJs7Rbgu14+rkwoSEP+BT7ljw=" Contains base62 string in header "LN4BILjv0ScZWZjvxNKTl9ioDaxG3kUoD" in header "GET /favicon.ico HTTP/1.1Host: store.steampowered.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://store.steampowered.com/loginAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; browserid=412753823171828074; sessionid=cbc7147d8b8442a93863abf7; timezoneOffset=-25200,0; ak_bmsc=C9374A2C8A7340C74785CEA28A1DB30E~000000000000000000000000000000~YAAQqCTDFzgN7O+WAQAAkudHAhsJ+ugJ3jtJFA+LN4BILjv0ScZWZjvxNKTl9ioDaxG3kUoDeK8gVYdGzmHs2fdhbCd3tIJGkz4Ccyyy7OnMLgzWfaoFbBSySbc2/jwjH1RkmEvnMXQAsGsjcQWjvgUHa+thSheG0J/5XCL3eNZ0IPvXYA4AAQue7SpgD4N1gTZYYgmUFQpZgK5A/8VR6uK+kFltFkeo3x2gtBiq4fx76i0+DRwtZEwD05yXmIDwGR3vnve8S3H5yaDReWpBRGmzh7E0vwiXsiYK5OPpWC86dE+st5HS3tJHgCq4GaR6fvoEOKXKWEjZBDsw9WbajkDnXAUYrPYHm2ouS9u7H/tbwetJs7Rbgu14+rkwoSEP+BT7ljw=" Contains base62 string in header "eK8gVYdGzmHs2fdhbCd3tIJGkz4Ccyyy7" in header "GET /favicon.ico HTTP/1.1Host: store.steampowered.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://store.steampowered.com/loginAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; browserid=412753823171828074; sessionid=cbc7147d8b8442a93863abf7; timezoneOffset=-25200,0; ak_bmsc=C9374A2C8A7340C74785CEA28A1DB30E~000000000000000000000000000000~YAAQqCTDFzgN7O+WAQAAkudHAhsJ+ugJ3jtJFA+LN4BILjv0ScZWZjvxNKTl9ioDaxG3kUoDeK8gVYdGzmHs2fdhbCd3tIJGkz4Ccyyy7OnMLgzWfaoFbBSySbc2/jwjH1RkmEvnMXQAsGsjcQWjvgUHa+thSheG0J/5XCL3eNZ0IPvXYA4AAQue7SpgD4N1gTZYYgmUFQpZgK5A/8VR6uK+kFltFkeo3x2gtBiq4fx76i0+DRwtZEwD05yXmIDwGR3vnve8S3H5yaDReWpBRGmzh7E0vwiXsiYK5OPpWC86dE+st5HS3tJHgCq4GaR6fvoEOKXKWEjZBDsw9WbajkDnXAUYrPYHm2ouS9u7H/tbwetJs7Rbgu14+rkwoSEP+BT7ljw=" Contains base62 string in header "5XCL3eNZ0IPvXYA4AAQue7SpgD4N1gTZY" in header "GET /favicon.ico HTTP/1.1Host: store.steampowered.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://store.steampowered.com/loginAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; browserid=412753823171828074; sessionid=cbc7147d8b8442a93863abf7; timezoneOffset=-25200,0; ak_bmsc=C9374A2C8A7340C74785CEA28A1DB30E~000000000000000000000000000000~YAAQqCTDFzgN7O+WAQAAkudHAhsJ+ugJ3jtJFA+LN4BILjv0ScZWZjvxNKTl9ioDaxG3kUoDeK8gVYdGzmHs2fdhbCd3tIJGkz4Ccyyy7OnMLgzWfaoFbBSySbc2/jwjH1RkmEvnMXQAsGsjcQWjvgUHa+thSheG0J/5XCL3eNZ0IPvXYA4AAQue7SpgD4N1gTZYYgmUFQpZgK5A/8VR6uK+kFltFkeo3x2gtBiq4fx76i0+DRwtZEwD05yXmIDwGR3vnve8S3H5yaDReWpBRGmzh7E0vwiXsiYK5OPpWC86dE+st5HS3tJHgCq4GaR6fvoEOKXKWEjZBDsw9WbajkDnXAUYrPYHm2ouS9u7H/tbwetJs7Rbgu14+rkwoSEP+BT7ljw=" Contains base62 string in header "DRwtZEwD05yXmIDwGR3vnve8S3H5yaDRe" in header "GET /favicon.ico HTTP/1.1Host: store.steampowered.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://store.steampowered.com/loginAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; browserid=412753823171828074; sessionid=cbc7147d8b8442a93863abf7; timezoneOffset=-25200,0; ak_bmsc=C9374A2C8A7340C74785CEA28A1DB30E~000000000000000000000000000000~YAAQqCTDFzgN7O+WAQAAkudHAhsJ+ugJ3jtJFA+LN4BILjv0ScZWZjvxNKTl9ioDaxG3kUoDeK8gVYdGzmHs2fdhbCd3tIJGkz4Ccyyy7OnMLgzWfaoFbBSySbc2/jwjH1RkmEvnMXQAsGsjcQWjvgUHa+thSheG0J/5XCL3eNZ0IPvXYA4AAQue7SpgD4N1gTZYYgmUFQpZgK5A/8VR6uK+kFltFkeo3x2gtBiq4fx76i0+DRwtZEwD05yXmIDwGR3vnve8S3H5yaDReWpBRGmzh7E0vwiXsiYK5OPpWC86dE+st5HS3tJHgCq4GaR6fvoEOKXKWEjZBDsw9WbajkDnXAUYrPYHm2ouS9u7H/tbwetJs7Rbgu14+rkwoSEP+BT7ljw=" Contains base62 string in header "st5HS3tJHgCq4GaR6fvoEOKXKWEjZBDsw" in header "GET /favicon.ico HTTP/1.1Host: store.steampowered.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://store.steampowered.com/loginAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; browserid=412753823171828074; sessionid=cbc7147d8b8442a93863abf7; timezoneOffset=-25200,0; ak_bmsc=C9374A2C8A7340C74785CEA28A1DB30E~000000000000000000000000000000~YAAQqCTDFzgN7O+WAQAAkudHAhsJ+ugJ3jtJFA+LN4BILjv0ScZWZjvxNKTl9ioDaxG3kUoDeK8gVYdGzmHs2fdhbCd3tIJGkz4Ccyyy7OnMLgzWfaoFbBSySbc2/jwjH1RkmEvnMXQAsGsjcQWjvgUHa+thSheG0J/5XCL3eNZ0IPvXYA4AAQue7SpgD4N1gTZYYgmUFQpZgK5A/8VR6uK+kFltFkeo3x2gtBiq4fx76i0+DRwtZEwD05yXmIDwGR3vnve8S3H5yaDReWpBRGmzh7E0vwiXsiYK5OPpWC86dE+st5HS3tJHgCq4GaR6fvoEOKXKWEjZBDsw9WbajkDnXAUYrPYHm2ouS9u7H/tbwetJs7Rbgu14+rkwoSEP+BT7ljw=" Contains base62 string in header "9WbajkDnXAUYrPYHm2ouS9u7H/tbwetJs" in header "GET /favicon.ico HTTP/1.1Host: store.steampowered.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://store.steampowered.com/loginAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; browserid=412753823171828074; sessionid=cbc7147d8b8442a93863abf7; timezoneOffset=-25200,0; ak_bmsc=C9374A2C8A7340C74785CEA28A1DB30E~000000000000000000000000000000~YAAQqCTDFzgN7O+WAQAAkudHAhsJ+ugJ3jtJFA+LN4BILjv0ScZWZjvxNKTl9ioDaxG3kUoDeK8gVYdGzmHs2fdhbCd3tIJGkz4Ccyyy7OnMLgzWfaoFbBSySbc2/jwjH1RkmEvnMXQAsGsjcQWjvgUHa+thSheG0J/5XCL3eNZ0IPvXYA4AAQue7SpgD4N1gTZYYgmUFQpZgK5A/8VR6uK+kFltFkeo3x2gtBiq4fx76i0+DRwtZEwD05yXmIDwGR3vnve8S3H5yaDReWpBRGmzh7E0vwiXsiYK5OPpWC86dE+st5HS3tJHgCq4GaR6fvoEOKXKWEjZBDsw9WbajkDnXAUYrPYHm2ouS9u7H/tbwetJs7Rbgu14+rkwoSEP+BT7ljw=" Contains base62 string in header "cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM" in header "GET /v1/counter.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1Host: b.stats.paypal.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.paypal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ" Contains base62 string in header "2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNj" in header "GET /v1/counter.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1Host: b.stats.paypal.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.paypal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ" Contains base62 string in header "ImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM" in header "GET /v1/counter.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1Host: b.stats.paypal.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.paypal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ" Contains base62 string in header "df71f49f24334867a915d13fd6c1a5241" in header "GET /v1/counter.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1Host: b.stats.paypal.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.paypal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ" Contains base62 string in header "3D0247623e1970aa30bcb995acfe5d152" in header "GET /v1/counter.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1Host: b.stats.paypal.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.paypal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ" Contains base62 string in header "v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLA" in header "GET /v1/counter.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1Host: b.stats.paypal.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.paypal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ" Contains base62 string in header "YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9" in header "GET /v1/counter.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1Host: b.stats.paypal.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.paypal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ" Contains base62 string in header "69612446283065076265852075731177;" in header "GET /v1/counter.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1Host: b.stats.paypal.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.paypal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ" Contains base62 string in header "28083002222101133541775236872213;" in header "GET /v1/counter.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1Host: b.stats.paypal.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.paypal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ" Contains base62 string in header "eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiO" in header "GET /v1/counter.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1Host: b.stats.paypal.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.paypal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ" Contains base62 string in header "cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM" in header "GET /v1/counter2.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1Host: slc.stats.paypal.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.paypal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ; KHcl0EuY7AKSMgfvHl7J5E7hPtK=WDckqzzy9vIWdSfHBSr21ywQ9jcffPZH_af73lDsaeYEp7HG-hEXr5QXu_tU6ttG6FuinJp-AGS-6WTA; ddi=G3snUBqktJChviAUctibdWBY-7BqT26ut_Zj7uE-onOzLMQRnf06iPA3Rr8V-LWJyvzfllDpne-tl-SElQNe4CXdgBlGmzGoCGqWB3BQM65RWqUO; c=9ebad54a66acd3b3ddf3; sc_f=0wf7biK6sULawYka6_-wcAz-c70v2qMjLrQC7eRnBXEczlw-LaasRJuf02oPzSKZM0uVI6gd-GaFu3sSjCAptBETw9HNENV1VMx_UW" Contains base62 string in header "2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNj" in header "GET /v1/counter2.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1Host: slc.stats.paypal.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.paypal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ; KHcl0EuY7AKSMgfvHl7J5E7hPtK=WDckqzzy9vIWdSfHBSr21ywQ9jcffPZH_af73lDsaeYEp7HG-hEXr5QXu_tU6ttG6FuinJp-AGS-6WTA; ddi=G3snUBqktJChviAUctibdWBY-7BqT26ut_Zj7uE-onOzLMQRnf06iPA3Rr8V-LWJyvzfllDpne-tl-SElQNe4CXdgBlGmzGoCGqWB3BQM65RWqUO; c=9ebad54a66acd3b3ddf3; sc_f=0wf7biK6sULawYka6_-wcAz-c70v2qMjLrQC7eRnBXEczlw-LaasRJuf02oPzSKZM0uVI6gd-GaFu3sSjCAptBETw9HNENV1VMx_UW" Contains base62 string in header "ImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM" in header "GET /v1/counter2.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1Host: slc.stats.paypal.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.paypal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ; KHcl0EuY7AKSMgfvHl7J5E7hPtK=WDckqzzy9vIWdSfHBSr21ywQ9jcffPZH_af73lDsaeYEp7HG-hEXr5QXu_tU6ttG6FuinJp-AGS-6WTA; ddi=G3snUBqktJChviAUctibdWBY-7BqT26ut_Zj7uE-onOzLMQRnf06iPA3Rr8V-LWJyvzfllDpne-tl-SElQNe4CXdgBlGmzGoCGqWB3BQM65RWqUO; c=9ebad54a66acd3b3ddf3; sc_f=0wf7biK6sULawYka6_-wcAz-c70v2qMjLrQC7eRnBXEczlw-LaasRJuf02oPzSKZM0uVI6gd-GaFu3sSjCAptBETw9HNENV1VMx_UW" Contains base62 string in header "df71f49f24334867a915d13fd6c1a5241" in header "GET /v1/counter2.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1Host: slc.stats.paypal.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.paypal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ; KHcl0EuY7AKSMgfvHl7J5E7hPtK=WDckqzzy9vIWdSfHBSr21ywQ9jcffPZH_af73lDsaeYEp7HG-hEXr5QXu_tU6ttG6FuinJp-AGS-6WTA; ddi=G3snUBqktJChviAUctibdWBY-7BqT26ut_Zj7uE-onOzLMQRnf06iPA3Rr8V-LWJyvzfllDpne-tl-SElQNe4CXdgBlGmzGoCGqWB3BQM65RWqUO; c=9ebad54a66acd3b3ddf3; sc_f=0wf7biK6sULawYka6_-wcAz-c70v2qMjLrQC7eRnBXEczlw-LaasRJuf02oPzSKZM0uVI6gd-GaFu3sSjCAptBETw9HNENV1VMx_UW" Contains base62 string in header "3D0247623e1970aa30bcb995acfe5d152" in header "GET /v1/counter2.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1Host: slc.stats.paypal.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.paypal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ; KHcl0EuY7AKSMgfvHl7J5E7hPtK=WDckqzzy9vIWdSfHBSr21ywQ9jcffPZH_af73lDsaeYEp7HG-hEXr5QXu_tU6ttG6FuinJp-AGS-6WTA; ddi=G3snUBqktJChviAUctibdWBY-7BqT26ut_Zj7uE-onOzLMQRnf06iPA3Rr8V-LWJyvzfllDpne-tl-SElQNe4CXdgBlGmzGoCGqWB3BQM65RWqUO; c=9ebad54a66acd3b3ddf3; sc_f=0wf7biK6sULawYka6_-wcAz-c70v2qMjLrQC7eRnBXEczlw-LaasRJuf02oPzSKZM0uVI6gd-GaFu3sSjCAptBETw9HNENV1VMx_UW" Contains base62 string in header "v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLA" in header "GET /v1/counter2.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1Host: slc.stats.paypal.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.paypal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ; KHcl0EuY7AKSMgfvHl7J5E7hPtK=WDckqzzy9vIWdSfHBSr21ywQ9jcffPZH_af73lDsaeYEp7HG-hEXr5QXu_tU6ttG6FuinJp-AGS-6WTA; ddi=G3snUBqktJChviAUctibdWBY-7BqT26ut_Zj7uE-onOzLMQRnf06iPA3Rr8V-LWJyvzfllDpne-tl-SElQNe4CXdgBlGmzGoCGqWB3BQM65RWqUO; c=9ebad54a66acd3b3ddf3; sc_f=0wf7biK6sULawYka6_-wcAz-c70v2qMjLrQC7eRnBXEczlw-LaasRJuf02oPzSKZM0uVI6gd-GaFu3sSjCAptBETw9HNENV1VMx_UW" Contains base62 string in header "YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9" in header "GET /v1/counter2.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1Host: slc.stats.paypal.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.paypal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ; KHcl0EuY7AKSMgfvHl7J5E7hPtK=WDckqzzy9vIWdSfHBSr21ywQ9jcffPZH_af73lDsaeYEp7HG-hEXr5QXu_tU6ttG6FuinJp-AGS-6WTA; ddi=G3snUBqktJChviAUctibdWBY-7BqT26ut_Zj7uE-onOzLMQRnf06iPA3Rr8V-LWJyvzfllDpne-tl-SElQNe4CXdgBlGmzGoCGqWB3BQM65RWqUO; c=9ebad54a66acd3b3ddf3; sc_f=0wf7biK6sULawYka6_-wcAz-c70v2qMjLrQC7eRnBXEczlw-LaasRJuf02oPzSKZM0uVI6gd-GaFu3sSjCAptBETw9HNENV1VMx_UW" Contains base62 string in header "69612446283065076265852075731177;" in header "GET /v1/counter2.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1Host: slc.stats.paypal.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.paypal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ; KHcl0EuY7AKSMgfvHl7J5E7hPtK=WDckqzzy9vIWdSfHBSr21ywQ9jcffPZH_af73lDsaeYEp7HG-hEXr5QXu_tU6ttG6FuinJp-AGS-6WTA; ddi=G3snUBqktJChviAUctibdWBY-7BqT26ut_Zj7uE-onOzLMQRnf06iPA3Rr8V-LWJyvzfllDpne-tl-SElQNe4CXdgBlGmzGoCGqWB3BQM65RWqUO; c=9ebad54a66acd3b3ddf3; sc_f=0wf7biK6sULawYka6_-wcAz-c70v2qMjLrQC7eRnBXEczlw-LaasRJuf02oPzSKZM0uVI6gd-GaFu3sSjCAptBETw9HNENV1VMx_UW" Contains base62 string in header "28083002222101133541775236872213;" in header "GET /v1/counter2.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1Host: slc.stats.paypal.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.paypal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ; KHcl0EuY7AKSMgfvHl7J5E7hPtK=WDckqzzy9vIWdSfHBSr21ywQ9jcffPZH_af73lDsaeYEp7HG-hEXr5QXu_tU6ttG6FuinJp-AGS-6WTA; ddi=G3snUBqktJChviAUctibdWBY-7BqT26ut_Zj7uE-onOzLMQRnf06iPA3Rr8V-LWJyvzfllDpne-tl-SElQNe4CXdgBlGmzGoCGqWB3BQM65RWqUO; c=9ebad54a66acd3b3ddf3; sc_f=0wf7biK6sULawYka6_-wcAz-c70v2qMjLrQC7eRnBXEczlw-LaasRJuf02oPzSKZM0uVI6gd-GaFu3sSjCAptBETw9HNENV1VMx_UW" Contains base62 string in header "eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiO" in header "GET /v1/counter2.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1Host: slc.stats.paypal.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.paypal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ; KHcl0EuY7AKSMgfvHl7J5E7hPtK=WDckqzzy9vIWdSfHBSr21ywQ9jcffPZH_af73lDsaeYEp7HG-hEXr5QXu_tU6ttG6FuinJp-AGS-6WTA; ddi=G3snUBqktJChviAUctibdWBY-7BqT26ut_Zj7uE-onOzLMQRnf06iPA3Rr8V-LWJyvzfllDpne-tl-SElQNe4CXdgBlGmzGoCGqWB3BQM65RWqUO; c=9ebad54a66acd3b3ddf3; sc_f=0wf7biK6sULawYka6_-wcAz-c70v2qMjLrQC7eRnBXEczlw-LaasRJuf02oPzSKZM0uVI6gd-GaFu3sSjCAptBETw9HNENV1VMx_UW" Contains base62 string in header "KHcl0EuY7AKSMgfvHl7J5E7hPtK=WDckq" in header "GET /v1/counter2.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1Host: slc.stats.paypal.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.paypal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ; KHcl0EuY7AKSMgfvHl7J5E7hPtK=WDckqzzy9vIWdSfHBSr21ywQ9jcffPZH_af73lDsaeYEp7HG-hEXr5QXu_tU6ttG6FuinJp-AGS-6WTA; ddi=G3snUBqktJChviAUctibdWBY-7BqT26ut_Zj7uE-onOzLMQRnf06iPA3Rr8V-LWJyvzfllDpne-tl-SElQNe4CXdgBlGmzGoCGqWB3BQM65RWqUO; c=9ebad54a66acd3b3ddf3; sc_f=0wf7biK6sULawYka6_-wcAz-c70v2qMjLrQC7eRnBXEczlw-LaasRJuf02oPzSKZM0uVI6gd-GaFu3sSjCAptBETw9HNENV1VMx_UW" Contains base62 string in header "zzy9vIWdSfHBSr21ywQ9jcffPZH_af73l" in header "GET /v1/counter2.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1Host: slc.stats.paypal.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.paypal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ; KHcl0EuY7AKSMgfvHl7J5E7hPtK=WDckqzzy9vIWdSfHBSr21ywQ9jcffPZH_af73lDsaeYEp7HG-hEXr5QXu_tU6ttG6FuinJp-AGS-6WTA; ddi=G3snUBqktJChviAUctibdWBY-7BqT26ut_Zj7uE-onOzLMQRnf06iPA3Rr8V-LWJyvzfllDpne-tl-SElQNe4CXdgBlGmzGoCGqWB3BQM65RWqUO; c=9ebad54a66acd3b3ddf3; sc_f=0wf7biK6sULawYka6_-wcAz-c70v2qMjLrQC7eRnBXEczlw-LaasRJuf02oPzSKZM0uVI6gd-GaFu3sSjCAptBETw9HNENV1VMx_UW" Contains base62 string in header "SElQNe4CXdgBlGmzGoCGqWB3BQM65RWqU" in header "GET /v1/counter2.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w HTTP/1.1Host: slc.stats.paypal.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.paypal.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: enforce_policy=ccpa; cookie_check=yes; d_id=df71f49f24334867a915d13fd6c1a5241748089922156; LANG=en_US%3BUS; l7_az=dcg15.slc; ts_c=vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521; datadome=w5ejzFS1_v3VQ1AeLYnufIhCP7AvV3vgK0pHbj7BLAHYyWr2tnxGi_YVFEbbqhxvFRsPf26O6aUnSJkl5W2LDJ9A3WxXSUVI2yicRD0C0e2P0~XbN21T7OswNca~5Oa2; rssk=d%7DC9%40%3A%3B6692%3E%3E%3B%409%3Exqx%3Ew%3E%C2%80ygv%7Bg%3F11; cookie_prefs=T%3D0%2CP%3D0%2CF%3D0%2Ctype%3Dinitial; TLTSID=69612446283065076265852075731177; TLTDID=28083002222101133541775236872213; ts=vreXpYrS%3D1779625962%26vteXpYrS%3D1748091762%26vr%3D0247623e1970aa30bcb995acfe5d1522%26vt%3D0247623e1970aa30bcb995acfe5d1521%26vtyp%3Dnew; tsrce=privacynodeweb; x-pp-s=eyJ0IjoiMTc0ODA4OTk2MjkyNCIsImwiOiIwIiwibSI6IjAifQ; KHcl0EuY7AKSMgfvHl7J5E7hPtK=WDckqzzy9vIWdSfHBSr21ywQ9jcffPZH_af73lDsaeYEp7HG-hEXr5QXu_tU6ttG6FuinJp-AGS-6WTA; ddi=G3snUBqktJChviAUctibdWBY-7BqT26ut_Zj7uE-onOzLMQRnf06iPA3Rr8V-LWJyvzfllDpne-tl-SElQNe4CXdgBlGmzGoCGqWB3BQM65RWqUO; c=9ebad54a66acd3b3ddf3; sc_f=0wf7biK6sULawYka6_-wcAz-c70v2qMjLrQC7eRnBXEczlw-LaasRJuf02oPzSKZM0uVI6gd-GaFu3sSjCAptBETw9HNENV1VMx_UW"6c:T93d,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004412.00000000.144519.0128A000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004412.00000000.144519.0128A000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")6d:T87e,Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "11377057092,3468,100,,FindWindowExW,user32.dll,"00:37:18.968",RX=0,PX=0" (Indicator: "FindWindow"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp")6e:T492,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; File: "00000000-00004320.00000000.143308.008D1000.00000020.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")6f:Ta3a,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00006196.00000000.143256.010E0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00006196.00000000.143256.010E0000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")70:T108d,Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; File: "00000000-00009036.00000001.146814.00271000.00000040.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp")71:Teaa,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "RegEnumKeyExA" (Indicator: "RegEnumKey"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "RegEnumKeyA" (Indicator: "RegEnumKey"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00006196.00000000.143256.010E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00006196.00000000.143256.010E0000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")72:T6a0,Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "yncShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; Source: "00000000-00004412.00000000.144519.0128A000.00000040.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00006196.00000000.143256.010E0000.00000004.mdmp")73:T1381,"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "HB8Ri19.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "ao2FE12.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "3on26Nz.exe" file has an entrypoint instructions - "jmp 0x91448e,add byte ptr [esi], ah,or eax, 0,add byte ptr [eax - 0x18], ah,add byte ptr [eax], al,add byte ptr [eax], al,pop ebp,sub ebp, 0x10,sub ebp, 0x514484,jmp 0x9144aa,dec ebx,and eax, 0x4484b87b,push ecx,add byte ptr [ebx], al,lds eax, ptr [ecx + 0x4cc0],add byte ptr [ecx + 0x5fd], bh,mov edx, 0x11e1e971,xor byte ptr [eax], dl,inc eax,dec ecx,jne 0x9144c1,jmp 0x9144d4,or eax, 0xfa148866,mov esp, 0x714df8fa,jno 0x91454d," "5AU2Hf7.exe" file has an entrypoint instructions - "call 0x4fbb42,jmp 0x4fb30f,cmp ecx, dword ptr [0x55a048],jne 0x4fb49e,ret ,jmp 0x4fbc75,push ebp,mov ebp, esp,and dword ptr [0x55c328], 0,sub esp, 0x24,or dword ptr [0x55a050], 1,push 0xa,call dword ptr [0x52e0e0],test eax, eax,je 0x4fb673,and dword ptr [ebp - 0x10], 0,xor eax, eax,push ebx,push esi,push edi,xor ecx, ecx,lea edi, [ebp - 0x24],push ebx,cpuid ,mov esi, ebx,pop ebx,nop ,mov dword ptr [edi], eax,mov dword ptr [edi + 4], esi,mov dword ptr [edi + 8], ecx,xor ecx, ecx,mov dword ptr [edi + 0xc], edx,mov eax, dword ptr [ebp - 0x24],mov edi, dword ptr [ebp - 0x20]," "4ft667bN.exe" file has an entrypoint instructions - "jmp 0x7fffda,add ah, dh,add eax, 0,add byte ptr [eax - 0x18], ah,add byte ptr [eax], al,add byte ptr [eax], al,pop ebp,sub ebp, 0x10,sub ebp, 0x3fffd0,jmp 0x7ffff6,xchg dword ptr [ebx + esi], eax," "Qj7GR07.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "1uM06vb2.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "2HO7525.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x10,mov eax, 0x401000,call 0x402112,lcall 0x5de5, 0x8b10c483,jmp 0x79da64,inc esi,adc al, 0xdf,xor ecx, esp,in eax, 0xd,and dh, byte ptr [ebx - 0x3dd988ae],iretd ,mov dh, 0x6d,or byte ptr [ebx + edx*2], bh,cmp dword ptr [ebp - 0x72], esi,fisttp dword ptr [eax + edx*8 + 0x6e],push edx,jnp 0x4020fa,xor ah, byte ptr [ebp - 0x2d],and dword ptr [edi - 0x6ec68], 0xfd36230d,movsd dword ptr es:[edi], dword ptr [esi],mov dl, 0xcb,jmp 0x40214d,test cl, al,fdivr dword ptr [edx],mov ebx, fs,mul dword ptr [ebx + 0x38],fsubr qword ptr [ecx],add al, 0xf4,mov cl, 0x4a,push 0x6c563f73,outsd dx, dword ptr [esi],ret 0xdc30,"74:T55a,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004412.00000000.144519.0128A000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")75:T7d2,RegOpenKeyExA RegCloseKey RegCreateKeyExA RegDeleteValueA OpenProcessToken GetTempFileNameA FindFirstFileA GetVersionExA GetModuleHandleW LockResource GetTempPathA DeleteFileA GetFileAttributesA WriteFile GetStartupInfoW CreateDirectoryA FindNextFileA GetProcAddress TerminateProcess UnhandledExceptionFilter FindResourceA GetSystemInfo GetDriveTypeA LoadLibraryA CreateFileA CreateProcessA Sleep GetModuleFileNameA GetTickCount CreateThread LoadLibraryExA GetSystemDirectoryA GetModuleHandleA ShellExecuteA CredEnumerateA GetUserNameA RegEnumKeyExA RegEnumKeyA OpenProcess GetCommandLineW OutputDebugStringA GetFileAttributesW GetFileAttributesExW DeleteFileW IsDebuggerPresent GetFileSize GetModuleHandleExA GetTickCount64 FindFirstFileExW CreateToolhelp32Snapshot GetTempPathW GetComputerNameA FindNextFileW FindFirstFileW LoadLibraryExW CreateFileW CopyFileA VirtualAllocEx GetCommandLineA GetModuleHandleExW Process32First GetModuleFileNameW Process32Next ReadProcessMemory CreateRemoteThread GetFileSizeEx WriteProcessMemory GetCursorPos connect socket send WSAStartup recv closesocket RegOpenKeyExW GetUserNameW CreateProcessAsUserW CreateProcessWithLogonW RegDeleteKeyW SetSecurityDescriptorDacl RegDeleteValueW RegCreateKeyExW RegEnumKeyExW IcmpSendEcho GetTempFileNameW GetComputerNameW CreateDirectoryW GetSystemDirectoryW FindResourceExW ExitThread GetDriveTypeW Process32FirstW CopyFileW Process32NextW CreateProcessW OutputDebugStringW CopyFileExW DeviceIoControl LoadLibraryW VirtualAlloc GetVersionExW ShellExecuteExW ShellExecuteW FindWindowExW FindWindowW GetWindowThreadProcessId GetClipboardData SetKeyboardState InternetOpenUrlW HttpSendRequestW InternetReadFile FtpGetFileSize HttpQueryInfoW FtpOpenFileW InternetCloseHandle InternetQueryOptionW InternetOpenW InternetQueryDataAvailable InternetCrackUrlW InternetConnectW accept bind recvfrom sendto listen76:Tf68,Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "RegConnectRegistryW" (Indicator: "RegConnectRegistry"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "RegCreateKeyExW" (Indicator: "RegCreateKey"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "RegConnectRegistryW" (Indicator: "RegConnectRegistry"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "RegCreateKeyExW" (Indicator: "RegCreateKey"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006196.00000000.143256.010E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006196.00000000.143256.010E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006196.00000000.143256.010E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006196.00000000.143256.010E0000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")77:T518,"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" trying to touch file "C:\52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" trying to touch file "C:\Windows\SysWOW64\AcLayers.dll" "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" trying to touch file "C:\Windows\SysWOW64\mpr.dll" "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" trying to touch file "C:\Windows\SysWOW64\sfc.dll"78:T7aa,"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "")79:Tc8c,Found reference to API "MoveFileW" (Indicator: "MoveFile"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "MoveFileW" (Indicator: "MoveFile"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006196.00000000.143256.010E0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006196.00000000.143256.010E0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006196.00000000.143256.010E0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006196.00000000.143256.010E0000.00000004.mdmp")7a:T1145,Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "AddAce" (Indicator: "AddAce"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetAce" (Indicator: "GetAce"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "CopySid" (Indicator: "CopySid"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; File: "00000000-00004412.00000000.144519.00F82000.00000040.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp")7b:T274b,"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00002988) "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00002988) "HB8Ri19.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006560) "HB8Ri19.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006560) "HB8Ri19.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006560) "HB8Ri19.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006560) "HB8Ri19.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006560) "HB8Ri19.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00006560) "HB8Ri19.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00006560) "ao2FE12.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008952) "ao2FE12.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008952) "ao2FE12.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008952) "ao2FE12.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008952) "ao2FE12.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00008952) "ao2FE12.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00008952) "ao2FE12.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00008952) "Qj7GR07.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006196) "Qj7GR07.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006196) "Qj7GR07.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006196) "Qj7GR07.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006196) "Qj7GR07.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006196) "Qj7GR07.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00006196) "Qj7GR07.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00006196) "1uM06vb2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004320) "1uM06vb2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004320) "1uM06vb2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004320) "1uM06vb2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004320) "1uM06vb2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004320) "1uM06vb2.exe" called "LoadLibrary" with a parameter %TEMP%\IXP003.TMP\1uM06vb2.exe (UID: 00000000-00004320) "1uM06vb2.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00004320) "1uM06vb2.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004320) "1uM06vb2.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00004320) "1uM06vb2.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00004320) "1uM06vb2.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00004320) "1uM06vb2.exe" called "LoadLibrary" with a parameter MLANG.dll (UID: 00000000-00004320) "1uM06vb2.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00004320) "1uM06vb2.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00004320) "1uM06vb2.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00004320) "2HO7525.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter SHFolder.dll (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter %TEMP%\IXP003.TMP\2HO7525.ENU (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter %TEMP%\IXP003.TMP\2HO7525.EN (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004412) "2HO7525.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004412) "3on26Nz.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00009036) "3on26Nz.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00009036) "3on26Nz.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00009036) "3on26Nz.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00009036) "3on26Nz.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00009036) "3on26Nz.exe" called "LoadLibrary" with a parameter SHFolder.dll (UID: 00000000-00009036) "3on26Nz.exe" called "LoadLibrary" with a parameter %TEMP%\IXP002.TMP\3on26Nz.ENU (UID: 00000000-00009036) "3on26Nz.exe" called "LoadLibrary" with a parameter %TEMP%\IXP002.TMP\3on26Nz.EN (UID: 00000000-00009036) "3on26Nz.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00009036) "3on26Nz.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00009036) "3on26Nz.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00009036) "3on26Nz.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00009036) "3on26Nz.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00009036) "3on26Nz.exe" called "LoadLibrary" with a parameter WININET.DLL (UID: 00000000-00009036)7c:Tbca,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "00000000-00004320.00000000.143308.008D1000.00000020.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002988.00000000.143070.00BF1000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00002988.00000000.143070.00BF1000.00000020.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00006196.00000000.143256.01221000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00006196.00000000.143256.01221000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")7d:Ta7e,Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "RegDeleteKeyExW" (Indicator: "RegDeleteKey"; File: "00000000-00004320.00000000.143308.008D1000.00000020.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp") Found reference to API "RegDeleteKeyExW" (Indicator: "RegDeleteKey"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00004320.00000000.143308.030F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00004412.00000000.144519.037B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00006196.00000000.143256.010E0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00006196.00000000.143256.010E0000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")7e:Ta87,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: 2HO7525.exe.log] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00002988-00000C2A-1245189186] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00002988-00000C2A-1245384640] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00002988-00000BC1-1245455417] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00006560-00000BC1-1246405860] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00008952-00000BC1-1247331447] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00006196-00000BC1-1248134168] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00004412-00000C2A-1269008857] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00004412-00000C2A-1269677851] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00004412-00000C2A-1269992695] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004412-00000C2A-1270115971] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00004412-00000C2A-1270534895] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00004412-00000C2A-1270581958] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00004412-00000C2A-1270686002] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00004412-00000C2A-1270826488] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00004412-00000C2A-1270904441] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00004412-00000C2A-1271365514]7f:T93e,"1uM06vb2.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "D50F2187E2CCDB0100000000000000000000000002000000"), "1uM06vb2.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "42F1C583E2CCDB0100000000000000000000000002000000"), "1uM06vb2.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "AC392286E2CCDB0100000000000000000000000002000000"), "1uM06vb2.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "A436A782E2CCDB0100000000000000000000000002000000"), "1uM06vb2.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "77B84A7FE2CCDB0100000000000000000000000002000000"), "1uM06vb2.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "1ED8C381E2CCDB0100000000000000000000000002000000"), "1uM06vb2.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "B480E684E2CCDB0100000000000000000000000002000000"), "1uM06vb2.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "E864BB80E2CCDB0100000000000000000000000002000000")80:T7ed,"2HO7525.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEBEHAVIORMONITORING"; Value: "01000000") "2HO7525.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEIOAVPROTECTION"; Value: "01000000") "2HO7525.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEONACCESSPROTECTION"; Value: "01000000") "2HO7525.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEREALTIMEMONITORING"; Value: "01000000") "2HO7525.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLESCANONREALTIMEENABLE"; Value: "01000000") "3on26Nz.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{007A4500-95BB-485F-BA69-2CD1B09ED391}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEBEHAVIORMONITORING"; Value: "01000000") "3on26Nz.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{007A4500-95BB-485F-BA69-2CD1B09ED391}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEONACCESSPROTECTION"; Value: "01000000") "3on26Nz.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{007A4500-95BB-485F-BA69-2CD1B09ED391}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLESCANONREALTIMEENABLE"; Value: "01000000") "3on26Nz.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{007A4500-95BB-485F-BA69-2CD1B09ED391}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEREALTIMEMONITORING"; Value: "01000000") "3on26Nz.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{007A4500-95BB-485F-BA69-2CD1B09ED391}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEIOAVPROTECTION"; Value: "01000000")81:T1054,"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000e39972109f300300000000c0fa6f009aac9972109f300318fb6f00a58f9972109f300301000000b87dc348000000003a24c7490000000003000000ccfb6f000a0000008c18000010fc6f0048fb6f005d00000003000000d0fa6f00d8fa6f00e4fd6f00b0bf9972b017373afeffffff24fc6f00551198723a24c74900000000 (UID: 00000000-00002988) "HB8Ri19.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000e39972208b54030000000018f6fa009aac9972208b540370f6fa00a58f9972208b540301000000a5d3776c00000000a0da1d3a000000000300000024f7fa000a000000401f000068f7fa00a0f6fa005b0000000300000028f6fa0030f6fa003cf9fa00b0bf9972c5b4161efeffffff7cf7fa0055119872a0da1d3a00000000 (UID: 00000000-00006560) "ao2FE12.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000e39972a09e92030000000078f4fd009aac9972a09e9203d0f4fd00a58f9972a09e9203010000008af8131400000000b4cd353c000000000300000084f5fd000a000000d01f0000c8f5fd0000f5fd005f0000000300000088f4fd0090f4fd009cf7fd00b0bf99724a9d7566feffffffdcf5fd0055119872b4cd353c00000000 (UID: 00000000-00008952) "Qj7GR07.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000e39972f08710010000000080f607019aac9972f0871001d8f60701a58f9972f08710010100000022a67c1c000000007c46d54900000000030000008cf707010a000000801c0000d0f7070108f707015f0000000300000090f6070198f60701a4f90701b0bf9972eac1e06ffeffffffe4f70701551198727c46d54900000000 (UID: 00000000-00006196) "2HO7525.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000000000000000000001e530c0173400c01b8fb6f01a0400c016cfb6f011cf30c010f00000030720c0100000000100000001cf30c010f00000030720c01a04c0c0106000000024e0c01060000005a4e0c01016d0c01a28c0c01b8fb6f01214e0c01c4fb6f017804bb051cf30c010f00000006000000a1920c01 (UID: 00000000-00004412) "2HO7525.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000e0f8006cfb6f01605906018e0000008efaf8008fe2f800b8fb6f01bce2f8006cfb6f01605906018e000000c444f900ee13127710000000605906018e000000c444f900b4f1f8000600000072f5f80006000000caf5f8000140f9009e92f900b8fb6f0191f5f800c4fb6f011800f005605906018e00000006000000e598f900 (UID: 00000000-00004412) "2HO7525.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000fc6f01bce2f800c4fb6f018c200d0132a20c01a3a20c0100c0b8001ff00c01020200008c200d0100c0f80024fc6f01e8fb6f0100c0b80074ae04012a8b6e55702df405d04700002cfc6f0191f5f80032a20c01a3a20c0100c0b8008c200d0100c0f8008cfc6f0128fc6f0100c0b800d84808012a8b6e55702df40506020000 (UID: 00000000-00004412) "2HO7525.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000005c000000000063000000000000000100000074001400000058537e03000000000100000001000000000000002c000000a0777f0300000000140000000a000000000000000000000000006f00603e7e0314000000000000000000000000000000000000000000000000006e00000000006700000004000004 (UID: 00000000-00004412) "3on26Nz.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000000000000000000001eb3560073a05600fcf83f01a0a05600b0f83f01c458570012000000acd256000000000010000000c458570012000000acd25600a0ac56000600000002ae5600060000005aae560001ce560046ed5600fcf83f0121ae560008f93f0178049f05c4585700120000000600000045f35600 (UID: 00000000-00009036) "3on26Nz.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000f83f013800000000000000000000005e4c3f009f323f00fcf83f01cc323f00b0f83f01609b5100ac0000002c9f3f004000000010000000609b5100ac0000002c9f3f0084433f000e00000042473f000e0000009a473f00019a3f0042f83f00fcf83f0161473f0008f93f015c04bb05609b5100ac0000000e00000089fe3f00 (UID: 00000000-00009036) "3on26Nz.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000bb05b12f3f004c27bb05b01801000000bb05004001001806540054f7000054f70000ed2f3f000040bb05000001000c065400b8303f0010f73f01f060670000103f0054f7000010f73f01cb323f007e035700ef03570000103f00f06067005027bb0578f93f0128f73f0100103f000100000000000000a4d4440046020000 (UID: 00000000-00009036)82:T492,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; File: "00000000-00004320.00000000.143308.008D1000.00000020.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004320.00000000.143308.0096C000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00006196.00000000.143256.0122A000.00000002.mdmp")18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":["evasive"],"file_activity":{"dropped_files":[],"extracted_files":[{"name":"rage131MP.tmp","sha256":"a78829e6fec04755708783ae424037f3dea145f5ce90d2856c56e5a41a4a9030","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"verdict":"undetected"},{"name":"urlref_httpswww.linkedin.comlogin","sha256":"f5b129acaabc17af9ec3c4832d65617b14cc26fcf6e773e1418725c2ab5229c8","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"verdict":"undetected"},{"name":"urlref_httpssteamcommunity.comopenidloginform","sha256":"f585fabed192fed23855629abb430e42fe80f059811f05bf51792a352c7dea33","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"verdict":"undetected"},{"name":"1uM06vb2.exe","sha256":"af5fb3d87196726ddf119ba2fa84ab11233e8e33080ec6846f79a08ca3256b4c","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"verdict":"undetected"},{"name":"ao2FE12.exe","sha256":"14b46c200af9d627d376ce5809e3223f745f8079bd0deb2e239f14cb095a4ebd","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"verdict":"undetected"},{"name":"3on26Nz.exe","sha256":"501af35a2c0ac6df75734312942ca93ad19338022a00fff36441c4cb96c57c8c","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"verdict":"undetected"},{"name":"2HO7525.exe","sha256":"a3cf01cc1676f1ed1b8c99e0fec006243eee183afbf9f9d798e4730fa7eac4e5","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"verdict":"undetected"},{"name":"gpt.ini","sha256":"77c7c10b4c860d5ddf4e057e713383e61e9f21bcf0ec4cfbbc16193f2e28f340","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Registry.pol","sha256":"40322dca674b039c9bdf85b7dc9e50aa9abba625523aa4ac69df3c8d6011e6d0","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"verdict":"undetected"},{"name":"MPGPH131.exe","sha256":"501af35a2c0ac6df75734312942ca93ad19338022a00fff36441c4cb96c57c8c","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"verdict":"undetected"},{"name":"RageMP131.exe","sha256":"501af35a2c0ac6df75734312942ca93ad19338022a00fff36441c4cb96c57c8c","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"verdict":"undetected"},{"name":"5AU2Hf7.exe","sha256":"90c6ca6dc866e17cc63fa0858b66f7c563439333d88ba4f7f1a44d38dc756410","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"verdict":"undetected"},{"name":"D23EF1D2","sha256":"2ddda95595ba57b7c2871e395e37211d3bdb2f55b4b01b80e3ffcc29dd8fd164","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Qj7GR07.exe","sha256":"defdbed83a29d3cf90fe4eaaec4d9e6e68d686f69d018400cd213191ff964d5f","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"verdict":"undetected"},{"name":"urlref_httpswww.youtube.com","sha256":"02dbbefb747b302459ae34bc82ddc5170838dceb8a4390bd13ec27c37fa91030","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"verdict":"undetected"},{"name":"urlref_httpsinstagram.comaccountslogin","sha256":"91f9555366cf5abbadfbef6a477b90576d41acead318dafa8c0ce8b945cdd50c","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"verdict":"undetected"},{"name":"HB8Ri19.exe","sha256":"abc4ebb398d835ab119bbf81728935a70b8b8655293d7b97fa4e05c72bcf9c3a","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"verdict":"undetected"},{"name":"4ft667bN.exe","sha256":"5c0c11c0e6ad3e4d78ec9d0543d677f10fecb583c14091d2d90bf644e39db502","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"verdict":"undetected"},{"name":"2HO7525.exe.log","sha256":"c120afd1b8a0f7d3825754023f3c58ad3fa1e7bc97024a37d2f73ee2880babdd","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"verdict":"undetected"}],"files_deleted":[],"files_written":[{"path":"%TEMP%\\rage131MP.tmp","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"path":"%TEMP%\\IXP000.TMP\\TMP4351$.TMP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"path":"%TEMP%\\IXP001.TMP\\TMP4351$.TMP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"path":"%TEMP%\\IXP002.TMP\\3on26Nz.exe","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"path":"%TEMP%\\IXP003.TMP\\2HO7525.exe","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\GroupPolicy\\gpt.ini","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"path":"%TEMP%\\IXP000.TMP\\HB8Ri19.exe","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"path":"%TEMP%\\IXP002.TMP\\Qj7GR07.exe","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"path":"%TEMP%\\IXP003.TMP\\TMP4351$.TMP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\GroupPolicy\\Machine\\Registry.pol","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\RageMP131\\RageMP131.exe","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"path":"%TEMP%\\IXP000.TMP\\5AU2Hf7.exe","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"path":"%TEMP%\\IXP001.TMP\\4ft667bN.exe","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\2HO7525.exe.log","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\GroupPolicy\\gpt.ini","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\MPGPH131\\MPGPH131.exe","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"path":"%TEMP%\\IXP001.TMP\\ao2FE12.exe","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"path":"%TEMP%\\IXP002.TMP\\TMP4351$.TMP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"path":"%TEMP%\\IXP003.TMP\\1uM06vb2.exe","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"path":"%TEMP%\\D23EF1D2","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4320:64:WilError_01","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"name":"Local\\SM0:4320:64:WilError_01","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"name":"Local\\SM0:4320:168:WilStaging_02","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"name":"SM0:4320:64:WilError_01","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4320:64:WilError_01","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4320:168:WilStaging_02","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]}]},"network_activity":{"contacted_hosts":[{"address":"157.240.11.35","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"142.250.191.42","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"142.250.191.35","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"35.186.247.156","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"151.101.194.133","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"151.101.3.1","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"172.66.0.227","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"104.18.20.94","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"172.64.154.50","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"34.149.66.134","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"192.55.233.1","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"18.213.53.78","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"3.212.240.169","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"151.101.1.21","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"142.250.189.164","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"104.18.23.33","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"142.250.189.194","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"104.18.22.33","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"23.47.169.131","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"64.233.180.84","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"150.171.22.12","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"151.101.195.1","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"108.138.128.122","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"104.18.21.177","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"151.101.196.159","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"104.18.36.146","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"193.233.132.62","country":"Russian Federation","port":50500,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"142.251.214.131","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"3.87.180.44","country":"United States","port":3478,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"151.101.2.133","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"74.125.250.129","country":"United States","port":19302,"protocol":"UDP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"34.36.73.246","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"104.19.229.21","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"151.101.67.52","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"162.159.140.229","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"142.251.46.206","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"151.101.1.35","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"142.250.191.46","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"57.144.180.128","country":"Belgium","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"57.144.180.34","country":"Belgium","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"57.144.180.192","country":"Belgium","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"142.250.189.214","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"146.75.92.159","country":"Sweden","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"44.205.66.24","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"142.250.188.3","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"57.144.180.1","country":"Belgium","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"142.251.46.177","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"35.190.10.96","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"34.106.92.18","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"address":"104.19.230.21","country":"United States","port":443,"protocol":"UDP","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]}],"dns_resolutions":[{"address":"162.159.140.229","country":"United States","domain":"api.twitter.com","registrar_creation_date":"2000-01-21T16:28:17+00:00","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_name_servers":"r01-01.ns.twtrdns.net","registrar_organization":"Twitter, Inc.","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":477},{"address":"151.101.1.35","country":"United States","domain":"c6.paypal.com","registrar_creation_date":"1999-07-14T22:32:11+00:00","registrar_name":"MarkMonitor, Inc.","registrar_name_servers":"ns2.p57.dynect.net","registrar_organization":"PayPal Inc.","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":156},{"address":"151.101.67.52","country":"United States","domain":"community.fastly.steamstatic.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":10730},{"address":"3.212.240.169","country":"United States","domain":"lnkd.demdex.net","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":248},{"address":"142.251.46.206","country":"United States","domain":"play.google.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":300},{"address":"23.47.169.131","country":"United States","domain":"store.steampowered.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":20},{"address":"142.250.191.46","country":"United States","domain":"www.youtube.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":158},{"address":"18.213.53.78","country":"United States","domain":"dpm.demdex.net","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":255},{"address":"151.101.2.133","country":"United States","domain":"li.protechts.net","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":16632},{"address":"57.144.180.128","country":"Belgium","domain":"static.xx.fbcdn.net","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":3600},{"address":"104.18.22.33","country":"United States","domain":"talon-service-prod.ecosec.on.epicgames.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":300},{"address":"142.250.191.35","country":"United States","domain":"www.recaptcha.net","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":300},{"address":"104.18.36.146","country":"United States","domain":"video.twimg.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":900},{"address":"104.19.229.21","country":"United States","domain":"js.hcaptcha.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":300},{"address":"151.101.3.1","country":"United States","domain":"paypalobjects.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":255},{"address":"74.125.250.129","country":"United States","domain":"stun.l.google.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":300},{"address":"151.101.195.1","country":"United States","domain":"www.paypalobjects.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":1796},{"address":"162.159.140.229","country":"United States","domain":"api.x.com","registrar_creation_date":"1993-04-02T05:00:00+00:00","registrar_name":"GoDaddy.com, LLC","registrar_name_servers":"NS72.DOMAINCONTROL.COM","registrar_organization":"Domains By Proxy, LLC","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":640},{"address":"34.106.92.18","country":"United States","domain":"b.stats.paypal.com","registrar_creation_date":"1999-07-14T22:32:11+00:00","registrar_name":"MarkMonitor, Inc.","registrar_name_servers":"ns2.p57.dynect.net","registrar_organization":"PayPal Inc.","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":235},{"address":"34.149.66.134","country":"United States","domain":"browser-intake-us5-datadoghq.com","registrar_creation_date":"2021-09-06T12:57:13+00:00","registrar_name":"Amazon Registrar, Inc.","registrar_name_servers":"ns-cloud-b4.googledomains.com","registrar_organization":"Whois Privacy Service","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":113},{"address":"108.138.128.122","country":"United States","domain":"ddbm2.paypal.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":203},{"address":"57.144.180.1","country":"Belgium","domain":"fbcdn.net","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":60},{"address":"151.101.67.52","country":"United States","domain":"store.fastly.steamstatic.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":5156},{"address":"3.87.180.44","country":"United States","domain":"use1-turn.fpjs.io","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":60},{"address":"142.250.191.42","country":"United States","domain":"fonts.googleapis.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":142},{"address":"172.66.0.227","country":"United States","domain":"t.co","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":335},{"address":"44.205.66.24","country":"United States","domain":"tracking.epicgames.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":60},{"address":"172.66.0.227","country":"United States","domain":"twitter.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":64},{"address":"151.101.196.159","country":"United States","domain":"abs.twimg.com","registrar_creation_date":"2008-09-22T18:33:28+00:00","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_name_servers":"d01-01.ns.twtrdns.net","registrar_organization":"Twitter, Inc.","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":258},{"address":"104.19.229.21","country":"United States","domain":"api.hcaptcha.com","registrar_creation_date":"2018-01-12T18:55:34+00:00","registrar_name":"NAMECHEAP INC","registrar_name_servers":"josh.ns.cloudflare.com","registrar_organization":"WhoisGuard, Inc.","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":300},{"address":"151.101.1.21","country":"United States","domain":"c.paypal.com","registrar_creation_date":"1999-07-14T22:32:11+00:00","registrar_name":"MarkMonitor, Inc.","registrar_name_servers":"ns2.p57.dynect.net","registrar_organization":"PayPal Inc.","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":286},{"address":"172.64.154.50","country":"United States","domain":"platform.linkedin.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":225},{"address":"34.106.92.18","country":"United States","domain":"slc.stats.paypal.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":10},{"address":"142.250.189.164","country":"United States","domain":"www.google.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":174},{"address":"104.18.22.33","country":"United States","domain":"talon-website-prod.ecosec.on.epicgames.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":300},{"address":"157.240.11.35","country":"United States","domain":"www.facebook.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":2577},{"address":"151.101.2.133","country":"United States","domain":"client.protechts.net","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":3000},{"address":"142.250.189.194","country":"United States","domain":"googleads.g.doubleclick.net","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":116},{"address":"172.64.154.50","country":"United States","domain":"static.licdn.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":66},{"address":"150.171.22.12","country":"United States","domain":"www.linkedin.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":300},{"address":"151.101.1.21","country":"United States","domain":"www.paypal.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":1297},{"address":"35.186.247.156","country":"United States","domain":"sentry.io","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":2209},{"address":"151.101.195.1","country":"United States","domain":"t.paypal.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":189},{"address":"142.250.188.3","country":"United States","domain":"www.gstatic.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":300},{"address":"142.251.46.177","country":"United States","domain":"csp.withgoogle.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":214},{"address":"142.250.189.214","country":"United States","domain":"i.ytimg.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":300},{"address":"146.75.92.159","country":"Sweden","domain":"pbs.twimg.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":900},{"address":"104.18.20.94","country":"United States","domain":"www.epicgames.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":3600},{"address":"35.190.10.96","country":"United States","domain":"collector-pxdojv695v.protechts.net","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":11005},{"address":"34.36.73.246","country":"United States","domain":"tzm.protechts.net","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":154},{"address":"57.144.180.34","country":"Belgium","domain":"www.instagram.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":3600},{"address":"104.19.229.21","country":"United States","domain":"newassets.hcaptcha.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":300},{"address":"162.159.140.229","country":"United States","domain":"x.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":7},{"address":"57.144.180.128","country":"Belgium","domain":"connect.facebook.net","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":3600},{"address":"57.144.180.1","country":"Belgium","domain":"fbsbx.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":60},{"address":"142.251.214.131","country":"United States","domain":"fonts.gstatic.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":234},{"address":"104.18.21.177","country":"United States","domain":"static-assets-prod.unrealengine.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":300},{"address":"64.233.180.84","country":"United States","domain":"accounts.google.com","registrar_creation_date":"1997-09-15T00:00:00+00:00","registrar_name":"MarkMonitor, Inc.","registrar_name_servers":"ns1.google.com","registrar_organization":"Google Inc.","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":300},{"address":"57.144.180.1","country":"Belgium","domain":"facebook.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":60},{"address":"57.144.180.34","country":"Belgium","domain":"instagram.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":60},{"address":"57.144.180.192","country":"Belgium","domain":"static.cdninstagram.com","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"ttl":3600}],"http_requests":[{"header":"GET /login HTTP/1.1\nHost: store.steampowered.com\nConnection: keep-alive\nsec-ch-ua: \"Microsoft Edge\";v=\"107\", \"Chromium\";v=\"107\", \"Not=A?Brand\";v=\"24\"\nsec-ch-ua-mobile: ?0\nsec-ch-ua-platform: \"Windows\"\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\nSec-Fetch-Site: none\nSec-Fetch-Mode: navigate\nSec-Fetch-User: ?1\nSec-Fetch-Dest: document\nAccept-Encoding: gzip, deflate, br\nAccept-Language: en-US,en;q=0.9","host":"store.steampowered.com","host_ip":"23.47.169.131:443","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"url":"/login"},{"header":"GET /dynamicstore/saledata/?cc=US HTTP/1.1\nHost: store.steampowered.com\nConnection: keep-alive\nsec-ch-ua: \"Microsoft Edge\";v=\"107\", \"Chromium\";v=\"107\", \"Not=A?Brand\";v=\"24\"\nAccept: */*\nX-Requested-With: XMLHttpRequest\nsec-ch-ua-mobile: ?0\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56\nsec-ch-ua-platform: \"Windows\"\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: cors\nSec-Fetch-Dest: empty\nReferer: https://store.steampowered.com/login\nAccept-Encoding: gzip, deflate, br\nAccept-Language: en-US,en;q=0.9\nCookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; browserid=412753823171828074; sessionid=cbc7147d8b8442a93863abf7; timezoneOffset=-25200,0","host":"store.steampowered.com","host_ip":"23.47.169.131:443","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"url":"/dynamicstore/saledata/?cc=US"},{"header":"$22","host":"store.steampowered.com","host_ip":"23.47.169.131:443","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"url":"/favicon.ico"},{"header":"GET /ns?c=d93f0c70-38d6-11f0-a732-c5bcabf5e228 HTTP/1.1\nHost: tzm.protechts.net\nConnection: keep-alive\nsec-ch-ua: \"Microsoft Edge\";v=\"107\", \"Chromium\";v=\"107\", \"Not=A?Brand\";v=\"24\"\nsec-ch-ua-mobile: ?0\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56\nsec-ch-ua-platform: \"Windows\"\nAccept: */*\nOrigin: https://li.protechts.net\nSec-Fetch-Site: same-site\nSec-Fetch-Mode: cors\nSec-Fetch-Dest: empty\nReferer: https://li.protechts.net/\nAccept-Encoding: gzip, deflate, br\nAccept-Language: en-US,en;q=0.9","host":"tzm.protechts.net","host_ip":"34.36.73.246:443","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"url":"/ns?c=d93f0c70-38d6-11f0-a732-c5bcabf5e228"},{"header":"$23","host":"b.stats.paypal.com","host_ip":"34.106.92.18:443","method":"GET","response_code":"302","response_phrase":"Found","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"url":"/v1/counter.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w"},{"header":"$24","host":"slc.stats.paypal.com","host_ip":"34.106.92.18:443","method":"GET","response_code":"200","response_phrase":"OK","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"url":"/v1/counter2.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w"}]},"process_activity":{"all_imported_dlls":["advapi32.dll","vulkan-1.dll","npmproxy.dll","netprofm.dll","mfreadwrite.dll","ucrtbase_clr0400.dll","ntmarta.dll","activeds.dll","uxtheme.dll","mpr.dll","Windows.UI.dll","vk_swiftshader.dll","d3d11.dll","mdmregistration.dll","microsoft_apis.dll","comctl32.dll","ffmpeg.dll","telclient.dll","webauthn.dll","cryptsp.dll","WofUtil.dll","iertutil.dll","dssec.dll","twinapi.dll","dhcpcsvc6.dll","samcli.dll","mfperfhelper.dll","Windows.Devices.Bluetooth.dll","rsaenh.dll","rasadhlp.dll","bcrypt.dll","dsrole.dll","winhttp.dll","KernelBase.dll","sapi.dll","IPHLPAPI.DLL","onramp.dll","sspicli.dll","msmpeg2vdec.dll","DWrite.dll","KBDUS.DLL","VxSSL32.dll","kernel32.dll","wevtapi.dll","wldp.dll","CoreMessaging.dll","winmmbase.dll","wininet.dll","user32.dll","wkscli.dll","mscoreei.dll","actxprxy.dll","aepic.dll","MMDevAPI.dll","adsldpc.dll","winsta.dll","imm32.dll","fwpolicyiomgr.dll","sechost.dll","setupapi.dll","mscoree.dll","gpapi.dll","sfc_os.dll","cabinet.dll","twinapi.appcore.dll","edputil.dll","biwinrt.dll","msvcrt.dll","mfsensorgroup.dll","mfplat.dll","Windows.Web.dll","ResourcePolicyClient.dll","directmanipulation.dll","urlmon.dll","oneds.dll","comdlg32.dll","nlaapi.dll","msctf.dll","FWPUCLNT.DLL","Windows.Networking.HostName.dll","rpcrt4.dll","cryptbase.dll","MFCaptureEngine.dll","psapi.dll","wtsapi32.dll","apphelp.dll","version.dll","kernel.appcore.dll","dwmapi.dll","oleaut32.dll","profapi.dll","dcomp.dll","nsi.dll","dhcpcsvc.dll","wintrust.dll","crypt32.dll","fwbase.dll","sfc.dll","System.ni.dll","dsuiext.dll","authz.dll","win32u.dll","dpapi.dll","oleacc.dll","libEGL.dll","gdi32full.dll","msvcp110_win.dll","FirewallAPI.dll","feclient.dll","cryptnet.dll","dmcmnutils.dll","CompPkgSup.dll","ucrtbase.dll","cldapi.dll","ws2_32.dll","imagehlp.dll","BitsProxy.dll","rmclient.dll","MSWB7.dll","Windows.Devices.Radios.dll","d3dcompiler_47.dll","vcruntime140_clr0400.dll","Windows.Security.Authentication.Web.Core.dll","OneCoreUAPCommonProxyStub.dll","userenv.dll","winmm.dll","secur32.dll","dxgi.dll","clrjit.dll","TextInputFramework.dll","propsys.dll","msasn1.dll","wsock32.dll","clr.dll","clbcatq.dll","ncrypt.dll","logoncli.dll","mscorlib.ni.dll","mf.dll","Windows.System.UserProfile.DiagnosticsSettings.dll","bcryptprimitives.dll","ieframe.dll","Wldap32.dll","advpack.dll","devenum.dll","OneCoreCommonProxyStub.dll","msvcp_win.dll","msedge.dll","shlwapi.dll","UIAutomationCore.dll","ksuser.dll","GdiPlus.dll","windows.storage.dll","devobj.dll","Windows.System.Profile.RetailInfo.dll","taskschd.dll","dbghelp.dll","wow64cpu.dll","CoreUIComponents.dll","gdi32.dll","deviceassociation.dll","mlang.dll","pcacli.dll","dnsapi.dll","Windows.Media.dll","netutils.dll","mfcore.dll","RTWorkQ.dll","cfgmgr32.dll","ntdsapi.dll","StructuredQuery.dll","powrprof.dll","mscms.dll","framedynos.dll","Windows.Security.Authentication.OnlineId.dll","fltLib.dll","WinTypes.dll","ntdll.dll","wlanapi.dll","msacm32.dll","linkinfo.dll","Windows.Networking.Connectivity.dll","DolbyDecMFT.dll","msdmo.dll","shfolder.dll","wow64.dll","dxva2.dll","libGLESv2.dll","shell32.dll","msedge_elf.dll","tbs.dll","PCPKsp.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","DataExchange.dll","vaultcli.dll","srumapi.dll","mswsock.dll","Windows.Networking.dll","Windows.Devices.Enumeration.dll","DevDispItemProvider.dll","Windows.Shell.ServiceHostBuilder.dll","netapi32.dll","ntasn1.dll","ole32.dll","AcLayers.dll","msvproc.dll","wow64win.dll","atlthunk.dll","SHCore.dll","gpedit.dll","combase.dll","dsreg.dll"],"processes":[{"command_line":"","icon":"$25","name":"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe","normalized_path":"C:\\52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe","pid":2988,"ppid":0,"sha256":"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919","uid":"00000000-00002988"},{"command_line":"","name":"HB8Ri19.exe","normalized_path":"%TEMP%\\IXP000.TMP\\HB8Ri19.exe","parent_uid":"00000000-00002988","pid":6560,"ppid":2988,"sha256":"abc4ebb398d835ab119bbf81728935a70b8b8655293d7b97fa4e05c72bcf9c3a","uid":"00000000-00006560"},{"command_line":"","name":"ao2FE12.exe","normalized_path":"%TEMP%\\IXP001.TMP\\ao2FE12.exe","parent_uid":"00000000-00006560","pid":8952,"ppid":6560,"sha256":"14b46c200af9d627d376ce5809e3223f745f8079bd0deb2e239f14cb095a4ebd","uid":"00000000-00008952"},{"command_line":"","name":"Qj7GR07.exe","normalized_path":"%TEMP%\\IXP002.TMP\\Qj7GR07.exe","parent_uid":"00000000-00008952","pid":6196,"ppid":8952,"sha256":"defdbed83a29d3cf90fe4eaaec4d9e6e68d686f69d018400cd213191ff964d5f","uid":"00000000-00006196"},{"command_line":"","name":"1uM06vb2.exe","normalized_path":"%TEMP%\\IXP003.TMP\\1uM06vb2.exe","parent_uid":"00000000-00006196","pid":4320,"ppid":6196,"sha256":"af5fb3d87196726ddf119ba2fa84ab11233e8e33080ec6846f79a08ca3256b4c","uid":"00000000-00004320"},{"command_line":"--single-argument https://accounts.google.com/","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004320","pid":9148,"ppid":4320,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00009148"},{"command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=107.0.5304.110 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 \"--annotation=prod=Microsoft Edge\" --annotation=ver=107.0.1418.56 --initial-client-data=0x194,0x198,0x19c,0x170,0x1a4,0x7ffa6a3eb208,0x7ffa6a3eb218,0x7ffa6a3eb228","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":8376,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00008376"},{"command_line":"--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1884 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:2","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":3596,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00003596"},{"command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:3","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":7116,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00007116"},{"command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2052 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:8","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":5520,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00005520"},{"command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1748112860761909 --launch-time-ticks=2249301955 --mojo-platform-channel-handle=3004 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:1","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":4384,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00004384"},{"command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1748112860761909 --launch-time-ticks=2249592227 --mojo-platform-channel-handle=3016 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:1","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":6952,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00006952"},{"command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3436 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:8","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":5248,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00005248"},{"command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --time-ticks-at-unix-epoch=-1748112860761909 --launch-time-ticks=2250345277 --mojo-platform-channel-handle=4216 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:1","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":2172,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00002172"},{"command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --time-ticks-at-unix-epoch=-1748112860761909 --launch-time-ticks=2251015993 --mojo-platform-channel-handle=4464 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:1","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":3096,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00003096"},{"command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --time-ticks-at-unix-epoch=-1748112860761909 --launch-time-ticks=2252653133 --mojo-platform-channel-handle=5316 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:1","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":6672,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00006672"},{"command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --time-ticks-at-unix-epoch=-1748112860761909 --launch-time-ticks=2253426940 --mojo-platform-channel-handle=5500 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:1","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":6592,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00006592"},{"command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --time-ticks-at-unix-epoch=-1748112860761909 --launch-time-ticks=2254454615 --mojo-platform-channel-handle=5712 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:1","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":7484,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00007484"},{"command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5928 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:8","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":7896,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00007896"},{"command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --time-ticks-at-unix-epoch=-1748112860761909 --launch-time-ticks=2256118184 --mojo-platform-channel-handle=5948 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:1","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":7592,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00007592"},{"command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --time-ticks-at-unix-epoch=-1748112860761909 --launch-time-ticks=2257949224 --mojo-platform-channel-handle=6304 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:1","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":2108,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00002108"},{"command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6476 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:8","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":1476,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00001476"},{"command_line":"--type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6624 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:8","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":4192,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00004192"},{"command_line":"--type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6668 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:8","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":8416,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00008416"},{"command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=6696 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:8","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":4176,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00004176"},{"command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --time-ticks-at-unix-epoch=-1748112860761909 --launch-time-ticks=2260322126 --mojo-platform-channel-handle=6844 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:1","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":4696,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00004696"},{"command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --time-ticks-at-unix-epoch=-1748112860761909 --launch-time-ticks=2261621540 --mojo-platform-channel-handle=7580 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:1","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":2740,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00002740"},{"command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --time-ticks-at-unix-epoch=-1748112860761909 --launch-time-ticks=2261918887 --mojo-platform-channel-handle=7628 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:1","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":792,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00000792"},{"command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --time-ticks-at-unix-epoch=-1748112860761909 --launch-time-ticks=2263312133 --mojo-platform-channel-handle=6856 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:1","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":972,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00000972"},{"command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --time-ticks-at-unix-epoch=-1748112860761909 --launch-time-ticks=2263747685 --mojo-platform-channel-handle=8064 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:1","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":8372,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00008372"},{"command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --time-ticks-at-unix-epoch=-1748112860761909 --launch-time-ticks=2265748589 --mojo-platform-channel-handle=7212 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:1","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":4092,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00004092"},{"command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.PageScreenshotProcessor --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=6332 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:8","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":8924,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00008924"},{"command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=9476 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:8","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":8568,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00008568"},{"command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --time-ticks-at-unix-epoch=-1748112860761909 --launch-time-ticks=2281334918 --mojo-platform-channel-handle=1896 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:1","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":6480,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00006480"},{"command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=8648 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:8","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":5788,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00005788"},{"command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=8600 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:8","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":6348,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00006348"},{"command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --time-ticks-at-unix-epoch=-1748112860761909 --launch-time-ticks=2294592354 --mojo-platform-channel-handle=9308 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:1","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":8328,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00008328"},{"command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --time-ticks-at-unix-epoch=-1748112860761909 --launch-time-ticks=2300263908 --mojo-platform-channel-handle=6000 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:1","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":8960,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00008960"},{"command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --time-ticks-at-unix-epoch=-1748112860761909 --launch-time-ticks=2304676612 --mojo-platform-channel-handle=6040 --field-trial-handle=2264,i,6293079219013056366,1286324040962790876,131072 /prefetch:1","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00009148","pid":5320,"ppid":9148,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00005320"},{"command_line":"--single-argument https://www.facebook.com/login","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004320","pid":8324,"ppid":4320,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00008324"},{"command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=107.0.5304.110 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 \"--annotation=prod=Microsoft Edge\" --annotation=ver=107.0.1418.56 --initial-client-data=0x194,0x198,0x19c,0x170,0x1c0,0x7ffa6a3eb208,0x7ffa6a3eb218,0x7ffa6a3eb228","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008324","pid":7148,"ppid":8324,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00007148"},{"command_line":"--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 --field-trial-handle=2036,i,16666889504772284010,3878968591908090565,131072 /prefetch:2","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008324","pid":7968,"ppid":8324,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00007968"},{"command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=2036,i,16666889504772284010,3878968591908090565,131072 /prefetch:3","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008324","pid":3396,"ppid":8324,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00003396"},{"command_line":"--single-argument https://store.steampowered.com/login","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004320","pid":7348,"ppid":4320,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00007348"},{"command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=107.0.5304.110 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 \"--annotation=prod=Microsoft Edge\" --annotation=ver=107.0.1418.56 --initial-client-data=0x194,0x198,0x19c,0x170,0x1c0,0x7ffa6a3eb208,0x7ffa6a3eb218,0x7ffa6a3eb228","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007348","pid":4268,"ppid":7348,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00004268"},{"command_line":"--single-argument https://steamcommunity.com/openid/loginform","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004320","pid":5408,"ppid":4320,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00005408"},{"command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=107.0.5304.110 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 \"--annotation=prod=Microsoft Edge\" --annotation=ver=107.0.1418.56 --initial-client-data=0x194,0x198,0x19c,0x158,0x1c0,0x7ffa6a3eb208,0x7ffa6a3eb218,0x7ffa6a3eb228","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005408","pid":5768,"ppid":5408,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00005768"},{"command_line":"--single-argument https://www.epicgames.com/id/login","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004320","pid":7360,"ppid":4320,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00007360"},{"command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=107.0.5304.110 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 \"--annotation=prod=Microsoft Edge\" --annotation=ver=107.0.1418.56 --initial-client-data=0x194,0x198,0x19c,0x170,0x1c0,0x7ffa6a3eb208,0x7ffa6a3eb218,0x7ffa6a3eb228","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007360","pid":7396,"ppid":7360,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00007396"},{"command_line":"--single-argument https://www.linkedin.com/login","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004320","pid":3480,"ppid":4320,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00003480"},{"command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=107.0.5304.110 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 \"--annotation=prod=Microsoft Edge\" --annotation=ver=107.0.1418.56 --initial-client-data=0x194,0x198,0x19c,0x150,0x1c0,0x7ffa6a3eb208,0x7ffa6a3eb218,0x7ffa6a3eb228","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003480","pid":6692,"ppid":3480,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00006692"},{"command_line":"--single-argument https://www.paypal.com/signin","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004320","pid":528,"ppid":4320,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00000528"},{"command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=107.0.5304.110 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 \"--annotation=prod=Microsoft Edge\" --annotation=ver=107.0.1418.56 --initial-client-data=0x194,0x198,0x19c,0x170,0x1c0,0x7ffa6a3eb208,0x7ffa6a3eb218,0x7ffa6a3eb228","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000528","pid":4400,"ppid":528,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00004400"},{"command_line":"--single-argument https://www.youtube.com/","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004320","pid":388,"ppid":4320,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00000388"},{"command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=107.0.5304.110 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 \"--annotation=prod=Microsoft Edge\" --annotation=ver=107.0.1418.56 --initial-client-data=0x194,0x198,0x19c,0x170,0x1c0,0x7ffa6a3eb208,0x7ffa6a3eb218,0x7ffa6a3eb228","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00000388","pid":1324,"ppid":388,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00001324"},{"command_line":"--single-argument https://twitter.com/i/flow/login","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004320","pid":4284,"ppid":4320,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00004284"},{"command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=107.0.5304.110 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 \"--annotation=prod=Microsoft Edge\" --annotation=ver=107.0.1418.56 --initial-client-data=0x1b0,0x1b4,0x1b8,0x18c,0x1cc,0x7ffa6a3eb208,0x7ffa6a3eb218,0x7ffa6a3eb228","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004284","pid":7192,"ppid":4284,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00007192"},{"command_line":"--single-argument https://instagram.com/accounts/login","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00004320","pid":7496,"ppid":4320,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00007496"},{"command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=107.0.5304.110 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 \"--annotation=prod=Microsoft Edge\" --annotation=ver=107.0.1418.56 --initial-client-data=0x194,0x198,0x19c,0x170,0x1b8,0x7ffa6a3eb208,0x7ffa6a3eb218,0x7ffa6a3eb228","name":"msedge.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00007496","pid":4356,"ppid":7496,"sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","uid":"00000000-00004356"},{"command_line":"","name":"2HO7525.exe","normalized_path":"%TEMP%\\IXP003.TMP\\2HO7525.exe","parent_uid":"00000000-00006196","pid":4412,"ppid":6196,"sha256":"a3cf01cc1676f1ed1b8c99e0fec006243eee183afbf9f9d798e4730fa7eac4e5","uid":"00000000-00004412"},{"command_line":"","name":"3on26Nz.exe","normalized_path":"%TEMP%\\IXP002.TMP\\3on26Nz.exe","parent_uid":"00000000-00008952","pid":9036,"ppid":8952,"sha256":"501af35a2c0ac6df75734312942ca93ad19338022a00fff36441c4cb96c57c8c","uid":"00000000-00009036"},{"command_line":"schtasks /create /f /RU \"uD0xdzD\" /tr \"%ALLUSERSPROFILE%\\MPGPH131\\MPGPH131.exe\" /tn \"MPGPH131 HR\" /sc HOURLY /rl HIGHEST","name":"schtasks.exe","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00000000-00009036","pid":7660,"ppid":9036,"sha256":"42661ab5aa20d0973113e10c53b988cab16e9f7ffe91c70ca69bb65d4eeb6fb8","uid":"00000000-00007660"},{"command_line":"schtasks /create /f /RU \"uD0xdzD\" /tr \"%ALLUSERSPROFILE%\\MPGPH131\\MPGPH131.exe\" /tn \"MPGPH131 LG\" /sc ONLOGON /rl HIGHEST","name":"schtasks.exe","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00000000-00009036","pid":804,"ppid":9036,"sha256":"42661ab5aa20d0973113e10c53b988cab16e9f7ffe91c70ca69bb65d4eeb6fb8","uid":"00000000-00000804"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\DELEGATEFOLDERS\\\\","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\ENIGMA PROTECTOR\\","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\ENIGMA PROTECTOR\\FB0CD20013B33CD2-EA80541D7E84BC6D\\","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\ENIGMA PROTECTOR\\FB0CD20013B33CD2-EA80541D7E84BC6D\\1D23E801FF916F1C-DF69CE3484AE41BB\\","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]}],"keys_deleted":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\WEXTRACT_CLEANUP3\\WEXTRACT_CLEANUP3","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]}],"keys_modified":[]},"sample_flags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"sandbox_reports":[{"analysis_start_time":"2025-05-24T12:31:14+00:00","contacted_countries":["BEL","RUS","SWE","USA"],"environment_description":"Windows 10 64 bit","environment_id":160,"id":"6831bc119e5f12d4570e6bec","indicators_count":{"informative":249,"malicious":16,"suspicious":69},"is_in_unified_schema":true,"state":"SUCCESS","submit_name":"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919","tags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"threat_score":100,"verdict":"malicious"}],"stats":{"contacted_hosts_count":50,"contacted_urls_count":6,"dns_resolutions_count":61,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":19,"files_deleted_count":0,"files_written_count":25,"http_requests_count":6,"imported_dlls_count":212,"injected_processes_count":0,"mutex_created_count":7,"process_count":63,"registry_keys_created_count":9,"registry_keys_deleted_count":1,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":10,"script_calls_count":0,"spawned_processes_count":63}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{"malware_families":[{"sources":[{"report_id":"","report_type":"quickscan"}],"value":"Crifi.Generic"}]},"av_detections":{"engines":{"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan/Win.Avkiller","verdict":"malicious"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"TR/Redcap.yrizz","verdict":"malicious"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Gen:Heur.Crifi.1","verdict":"malicious"},"clamav":{"data_source":"MetaDefender","name":"ClamAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Win.Downloader.Crifi-10009295-0","verdict":"malicious"},"cmc":{"data_source":"MetaDefender","name":"CMC","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"comodo":{"data_source":"MetaDefender","name":"Comodo","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware","verdict":"malicious"},"cylance":{"data_source":"MetaDefender","name":"Cylance","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware_-10","verdict":"malicious"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Gen:Heur.Crifi.1 (B)","verdict":"malicious"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"gridinsoft":{"data_source":"MetaDefender","name":"Gridinsoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Spy.Win32.Redline.lu!heur","verdict":"malicious"},"huorong":{"data_source":"MetaDefender","name":"Huorong","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan ( 005aad751 )","verdict":"malicious"},"lionic":{"data_source":"MetaDefender","name":"Lionic","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"mcafee":{"data_source":"MetaDefender","name":"McAfee","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"nanoav":{"data_source":"MetaDefender","name":"NANOAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"netgate":{"data_source":"MetaDefender","name":"NETGATE","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"rocketcyber":{"data_source":"MetaDefender","name":"RocketCyber","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"tachyon":{"data_source":"MetaDefender","name":"TACHYON","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"varist":{"data_source":"MetaDefender","name":"Varist","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"W32/Kryptik.JKR.gen!Eldorado","verdict":"malicious"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.Win32.Genus.UWO","verdict":"malicious"},"virusblokada":{"data_source":"MetaDefender","name":"VirusBlokAda","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"webrootsmd":{"data_source":"MetaDefender","name":"Webroot SMD","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware_47.7","verdict":"malicious"},"zillya":{"data_source":"MetaDefender","name":"Zillya!","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.Injurer.Win32.12592","verdict":"malicious"}}},"incidents":[{"details":[{"detail":"Detected many DNS responses with a low TTL"}],"details_count":1,"name":"Spreading","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"details":[{"detail":"Contacts 61 domains and 61 hosts"}],"details_count":1,"name":"Network Behavior","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"details":[{"detail":"Found a string that may be used as part of an injection method"}],"details_count":1,"name":"Spyware","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"details_count":5,"name":"Persistence","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"}],"details_count":2,"name":"Fingerprint","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"References security related windows services"},{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"},{"detail":"Tries to disable Windows defender Anti Spyware"},{"detail":"Tries to disable Windows defender via registry"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"details_count":7,"name":"Evasive","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Timestomp"},{"attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hide Artifacts"},{"attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion"},{"attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Code Signing"},{"attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Dynamic API Resolution"},{"attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Network Connections Discovery"},{"attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Dead Drop Resolver"},{"attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Keylogging"},{"attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Proxy"},{"attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Symmetric Cryptography"},{"attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Imports crypto-related APIs"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Encrypted for Impact"},{"attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Create Process with Token"},{"attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Sets the 'ThreadHideFromDebugger' thread data structure"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Debugger Evasion"},{"attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"User Activity Based Checks"},{"attack_id":"T1070.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/009","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Clear Persistence"},{"attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Credentials from Password Stores"},{"attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Language Discovery"},{"attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Discovery","technique":"Application Window Discovery"},{"attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"malicious","value":"Makes HTTPS connections using an insecure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Encrypted Channel"},{"attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Resource Development","technique":"Domains"},{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"malicious","value":"Modifies Windows Auto-Updates feature"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Persistence","technique":"Modify Registry"},{"attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Persistence","technique":"Account Manipulation"},{"attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"malicious","value":"Tries to disable Windows defender Anti Spyware"},{"type":"malicious","value":"Tries to disable Windows defender via registry"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains ability to block user input (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Disable or Modify Tools"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an APIs used to retrieve process information"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Discovery","technique":"Software Discovery"},{"attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Application Layer Protocol"},{"attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Contains ability to to enumerates the credentials (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Windows Credential Manager"},{"attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Execution","technique":"Shared Modules"},{"attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Web Protocols"},{"attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Domain Generation Algorithms"},{"attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Scheduled Transfer"},{"attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Persistence","technique":"Create or Modify System Process"},{"attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Persistence","technique":"Boot or Logon Autostart Execution"},{"attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism"},{"attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information"},{"attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Reflective Code Loading"},{"attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Discovery","technique":"Remote System Discovery"},{"attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"May execute SQL queries"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"Queries list of installed browsers"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Local System"},{"attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"},{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Non-Application Layer Protocol"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Found system commands related strings"},{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current hardware profile (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads system mouse configuration"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an APIs used to retrieve geographical location information"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Collection","technique":"Clipboard Data"},{"attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Data Encoding"},{"attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Exfiltration Over Web Service"},{"attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Execution","technique":"Component Object Model"},{"attack_id":"T1484.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1484/001","identifiers":[{"type":"malicious","value":"Modifies Group policy settings registry keys"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Group Policy Modification"},{"attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Collection","technique":"Screen Capture"},{"attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Ingress Tool Transfer"},{"attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Impact","technique":"Service Stop"},{"attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Persistence","technique":"Component Object Model Hijacking"},{"attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Persistence","technique":"DLL Side-Loading"},{"attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Owner/User Discovery"},{"attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Collection","technique":"Email Collection"},{"attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Non-Standard Port"},{"attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Access Token Manipulation"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"},{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Imports SHEmptyRecycleBin API"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal"},{"attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"System Binary Proxy Execution"},{"attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Information Repositories"},{"attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Collection","technique":"Automated Collection"},{"attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Management Instrumentation"},{"attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Software Packing"},{"attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Input Capture"},{"attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"},{"type":"informative","value":"Imports windows networking-related APIs"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Discovery","technique":"Network Share Discovery"},{"attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Collection","technique":"Local Data Staging"},{"attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Impact","technique":"System Shutdown/Reboot"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Discovery","technique":"Device Driver Discovery"},{"attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Web Service"},{"attack_id":"T1574.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/010","identifiers":[{"type":"malicious","value":"References security related windows services"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Persistence","technique":"Services File Permissions Weakness"},{"attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Contains ability to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking"},{"attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Bypass User Account Control"},{"attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection"},{"attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File Deletion"},{"attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Time Based Evasion"},{"attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hidden Window"},{"attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Masquerading"},{"attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Reconnaissance","technique":"Gather Victim Network Information"},{"attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder"},{"attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"ListPlanting"},{"attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Embedded Payloads"},{"attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Credential Access","technique":"OS Credential Dumping"},{"attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Time Discovery"},{"attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"malicious","value":"Requested access to a critical system service"},{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Service Discovery"},{"attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"malicious","value":"Detected many DNS responses with a low TTL"},{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Command and Control","technique":"DNS"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Imports GetCommandLine API"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"},{"attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Command Shell"},{"attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Execution","technique":"Service Execution"},{"attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Persistence","technique":"Shortcut Modification"},{"attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft"},{"attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information"},{"attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Contains ability to retrieve information set for devices (API string)"},{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Execution Guardrails"},{"attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal from Tools"},{"attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Execution","technique":"Inter-Process Communication"},{"attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Persistence","technique":"Windows Service"},{"attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to create a remote thread (API string)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection"},{"attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification"},{"attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Location Discovery"},{"attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Found a reference to an external IP address lookup service"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Network Configuration Discovery"},{"attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Lateral Tool Transfer"},{"attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Standard Encoding"},{"attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}],"tactic":"Execution","technique":"Scheduled Task"}],"rule_matches":{},"sandbox_signatures":[{"category":"Anti-Reverse Engineering","description":"\"2HO7525.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4412)","id":"api-1","level":"suspicious","mitre_attack_id":"T1562.001","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","origin":"API Call","relevance":10,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains key cryptographic functions (API string)\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: HTTP request contains Base64 encoded artifacts\n Matched sigs: Imports crypto-related APIs\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","id":"summary-28","level":"informative","mitre_attack_id":"T1027","name":"Shows ability to obfuscate file or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"1uM06vb2.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004320)","id":"api-142","level":"informative","mitre_attack_id":"T1010","name":"Calls an API possibly used to retrieve a handle to the foreground window","origin":"API Call","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe\" queries basic process information of the \"C:\\52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe\" (UID: 2988)","id":"api-235","level":"informative","mitre_attack_id":"T1057","name":"Queries basic information of the specified process","origin":"API Call","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"Found http requests in header \"GET /login\"\n Found http requests in header \"GET /dynamicstore/saledata/?cc=US\"\n Found http requests in header \"GET /favicon.ico\"\n Found http requests in header \"GET /ns?c=d93f0c70-38d6-11f0-a732-c5bcabf5e228\"\n Found http requests in header \"GET /v1/counter.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w\"\n Found http requests in header \"GET /v1/counter2.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w\"","id":"network-62","level":"informative","mitre_attack_id":"T1071.001","name":"Communicates with HTTP webserver (GET/POST requests)","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-539","level":"informative","mitre_attack_id":"T1071.001","name":"Contains reference to Windows internet services (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"2HO7525.exe\" called \"GetComputerNameA\" (UID: 00000000-00004412)\n \"2HO7525.exe\" called \"GetComputerNameW\" (UID: 00000000-00004412)\n \"3on26Nz.exe\" called \"GetComputerNameA\" (UID: 00000000-00009036)\n \"3on26Nz.exe\" called \"GetComputerNameW\" (UID: 00000000-00009036)","id":"api-141","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve computer name","origin":"API Call","relevance":2,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$26","id":"string-85","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to enumerate process and/or its information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-220","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to create/control drivers (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"$27","id":"string-272","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"$28","id":"api-7","level":"informative","mitre_attack_id":"T1129","name":"Loads modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-403","level":"informative","mitre_attack_id":"T1056","name":"Contains ability to register/read input devices (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$29","id":"string-88","level":"informative","mitre_attack_id":"T1056.001","name":"Contains ability to retrieve information about pressed keystrokes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$2a","id":"string-121","level":"informative","mitre_attack_id":"T1033","name":"Contains ability to retrieve usernames and/or user information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"2HO7525.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\2HO7525.exe.log\"\n \"2HO7525.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\2HO7525.exe.log\"","id":"api-159","level":"informative","mitre_attack_id":"T1074.001","name":"Writes log files","origin":"API Call","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$2b","id":"string-761","level":"informative","mitre_attack_id":"T1590","name":"Able to access user sensitive domain","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"$2c","id":"module-9","level":"informative","mitre_attack_id":"T1027","name":"Loads the Bcrypt module DLL","origin":"Loaded Module","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"$2d","id":"target-67","level":"informative","mitre_attack_id":"T1057","name":"Process launched with changed environment","origin":"Monitored Target","relevance":10,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"HB8Ri19.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"ao2FE12.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Qj7GR07.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"1uM06vb2.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"2HO7525.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"2HO7525.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"4412\"}\n \"3on26Nz.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"3on26Nz.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"9036\"}","id":"api-103","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used for taking snapshot of the specified processes","origin":"API Call","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-453","level":"informative","mitre_attack_id":"T1071.001","name":"Contains ability to set options for internet handles (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"HB8Ri19.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"ao2FE12.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Qj7GR07.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"1uM06vb2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"1uM06vb2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"2HO7525.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"2HO7525.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"3on26Nz.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","id":"registry-26","level":"informative","mitre_attack_id":"T1614.001","name":"Reads the windows installation language","origin":"Registry Access","relevance":2,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006196.00000000.143256.0122A000.00000002.mdmp\")","id":"string-423","level":"informative","mitre_attack_id":"T1074.001","name":"Contains ability to create directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"$2e","id":"registry-25","level":"informative","mitre_attack_id":"T1082","name":"Reads information about supported languages","origin":"Registry Access","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$2f","id":"api-161","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (non-executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 72FC0000","id":"module-4","level":"malicious","mitre_attack_id":"T1559.001","name":"Loads the task scheduler COM API","origin":"Loaded Module","relevance":5,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$30","id":"api-0","level":"malicious","mitre_attack_id":"T1055","name":"Writes data to a remote process","origin":"API Call","relevance":6,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"DecryptFileA\" (Indicator: \"DecryptFile\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"DecryptFileA\" (Indicator: \"DecryptFile\"; Source: \"00000000-00002988.00000000.143070.00BF1000.00000020.mdmp\")\n Found reference to API \"DecryptFileA\" (Indicator: \"DecryptFile\"; Source: \"00000000-00006196.00000000.143256.01221000.00000020.mdmp\")","id":"string-212","level":"informative","mitre_attack_id":"T1140","name":"Contains ability to perform decryption (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-450","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to determine if process is running under WOW64 (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-143","level":"informative","mitre_attack_id":"T1614.001","name":"Contains ability to retrieve system language (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Dropped file: \"2HO7525.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\2HO7525.exe.log]- [targetUID: 00000000-00004412]\n Dropped file: \"RageMP131.exe\" - Location: [%LOCALAPPDATA%\\RageMP131\\RageMP131.exe]- [targetUID: 00000000-00009036]","id":"binary-37","level":"informative","mitre_attack_id":"T1036","name":"Drops files inside appdata directory","origin":"Binary File","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"Connection was made using TLSv1.0 [tls.handshake.version: 0x0301]","id":"network-53","level":"malicious","mitre_attack_id":"T1573","name":"Makes HTTPS connections using an insecure TLS/SSL version","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004412.00000000.144519.0128A000.00000040.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006196.00000000.143256.0122A000.00000002.mdmp\")","id":"string-345","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to disable/close registry key (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$31","id":"binary-0","level":"informative","mitre_attack_id":"T1105","name":"Dropped files","origin":"Binary File","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; File: \"00000000-00004320.00000000.143308.008D1000.00000020.mdmp\")\n Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-82","level":"informative","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$32","id":"stream-139","level":"informative","mitre_attack_id":"T1027.005","name":"Contains XOR operation loops [Stream disassembly]","origin":"Hybrid Analysis Technology","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002988)\n \"HB8Ri19.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006560)\n \"ao2FE12.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00008952)\n \"Qj7GR07.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006196)\n \"1uM06vb2.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004320)","id":"api-297","level":"informative","mitre_attack_id":"T1003","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","origin":"API Call","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"00000000-00004412.00000000.144519.00F82000.00000040.mdmp\")\n Found reference to API \"OpenSCManager\" (Indicator: \"OpenSCManager\"; File: \"00000000-00004412.00000000.144519.00F82000.00000040.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00004412.00000000.144519.00F82000.00000040.mdmp\")\n Found reference to API \"OpenSCManager\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00004412.00000000.144519.00F82000.00000040.mdmp\")\n Found reference to API \"3199,,OpenSCManagerW,advapi3\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00004412.00000000.144519.037B0000.00000004.mdmp\")","id":"string-191","level":"informative","mitre_attack_id":"T1007","name":"Able to enumerate service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Spawned process \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe\" (UID: 00000000-00002988)\n Spawned process \"HB8Ri19.exe\" (UID: 00000000-00006560)\n Spawned process \"ao2FE12.exe\" (UID: 00000000-00008952)\n Spawned process \"Qj7GR07.exe\" (UID: 00000000-00006196)\n Spawned process \"1uM06vb2.exe\" (UID: 00000000-00004320)\n Spawned process \"2HO7525.exe\" (UID: 00000000-00004412)\n Spawned process \"3on26Nz.exe\" (UID: 00000000-00009036)\n Spawned process \"schtasks.exe\" with commandline \"schtasks /create /f /RU \"uD0xdzD\" /tr \"%ALLUSERSPROFILE%\\\\MPGPH131\\\\MPGPH131.exe\" /tn \"MPGPH131 HR\" /sc HOURLY /rl HIGHEST\" (UID: 00000000-00007660)\n Spawned process \"schtasks.exe\" with commandline \"schtasks /create /f /RU \"uD0xdzD\" /tr \"%ALLUSERSPROFILE%\\\\MPGPH131\\\\MPGPH131.exe\" /tn \"MPGPH131 LG\" /sc ONLOGON /rl HIGHEST\" (UID: 00000000-00000804)","id":"target-14","level":"malicious","mitre_attack_id":"T1057","name":"Spawns a lot of processes","origin":"Monitored Target","relevance":8,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"$33","id":"string-120","level":"informative","mitre_attack_id":"T1012","name":"Contains registry location strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"$34","id":"string-315","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create/open files (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00006196.00000000.143256.0122A000.00000002.mdmp\")","id":"string-534","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to read files (API string)","origin":"File/Memory","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"$35","id":"string-10","level":"informative","name":"Found a reference to a known community page","origin":"File/Memory","relevance":2,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$36","id":"string-193","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to query volume/memory size (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-314","level":"informative","mitre_attack_id":"T1016","name":"Contains ability to retrieve internet settings (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"\"0.0.0.0\"\n \"255.255.255.255\"\n \"1.0.0.0\"\n \"193.233.132.62:50500\"\n Potential IP \"64.124.12.162\" found in string \"p=df71f49f24334867a915d13fd6c1a524&i=64.124.12.162&t=1748089922.233&a=21&s=UNIFIED_LOGINNP:g_L S\"\n \"192.168.0.2\"","id":"string-14","level":"informative","mitre_attack_id":"T1071","name":"Found potential IP address in binary/memory","origin":"File/Memory","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"Contacted domain: \"browser-intake-us5-datadoghq.com\" has high entropy\n Contacted domain: \"collector-pxdojv695v.protechts.net\" has high entropy\n Contacted domain: \"community.fastly.steamstatic.com\" has high entropy\n Contacted domain: \"csp.withgoogle.com\" has high entropy\n Contacted domain: \"fonts.googleapis.com\" has high entropy\n Contacted domain: \"googleads.g.doubleclick.net\" has high entropy\n Contacted domain: \"paypalobjects.com\" has high entropy\n Contacted domain: \"platform.linkedin.com\" has high entropy\n Contacted domain: \"tracking.epicgames.com\" has high entropy\n Contacted domain: \"use1-turn.fpjs.io\" has high entropy\n Contacted domain: \"www.paypalobjects.com\" has high entropy","id":"network-81","level":"informative","mitre_attack_id":"T1568.002","name":"High entropy domain detected","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"System Security","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\n Observed string: \"SHUTDOWN\" (Indicator: \"shutdown\") in Source: 47579-2603-008E661F\n Observed string: \"SHUTDOWN\" (Indicator: \"shutdown\") in Source: 00000000-00004320.00000000.143308.0096C000.00000002.mdmp\n Observed string: \"SHUTDOWN\" (Indicator: \"shutdown\") in Source: 00000000-00004412.00000000.144519.00F82000.00000040.mdmp","id":"string-406","level":"informative","mitre_attack_id":"T1529","name":"Contains ability to shutdown system","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"System Security","description":"\"wuauserv\" (Indicator: \"wuauserv\") in Source: 00000000-00004412-00000C80-10822976808","id":"string-43","level":"malicious","mitre_attack_id":"T1574.010","name":"References security related windows services","origin":"File/Memory","relevance":7,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$37","id":"string-171","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the OS information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"3on26Nz.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")","id":"registry-174","level":"informative","mitre_attack_id":"T1652","name":"Tries to retrieve device driver information","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"Raw size of \".rsrc\" is \"0x4edc00\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x44b600\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x2e3a00\" greater than 0x100000\n Raw size of \".text\" is \"0x12c800\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x10e200\" greater than 0x100000","id":"static-125","level":"informative","name":"PE file has a big raw size section","origin":"Static Parser","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\" was detected as \"Microsoft visual C++ 8\"\n \"HB8Ri19.exe\" was detected as \"Microsoft visual C++ 8\"\n \"ao2FE12.exe\" was detected as \"Microsoft visual C++ 8\"\n \"5AU2Hf7.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"Qj7GR07.exe\" was detected as \"Microsoft visual C++ 8\"\n \"1uM06vb2.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"2HO7525.exe\" was detected as \"Enigma Protector v1.1X-1.3X -> Sukhov vladimir & Serge N. Markin\"","id":"static-18","level":"informative","mitre_attack_id":"T1027.002","name":"Matched Compiler/Packer signature","origin":"Static Parser","relevance":10,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"details too long to display","id":"network-60","level":"informative","mitre_attack_id":"T1132","name":"HTTP requests contain Base64 strings","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$38","id":"api-139","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to load a resource in memory","origin":"API Call","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-545","level":"informative","mitre_attack_id":"T1547.009","name":"Contains ability to register hotkeys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"$39","id":"string-3","level":"informative","mitre_attack_id":"T1071","name":"Found potential URL in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-107","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the host's architecture (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Raw size of \"\" is zero","id":"static-5","level":"informative","mitre_attack_id":"T1027","name":"PE file contains zero-sized sections","origin":"Static Parser","relevance":10,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"\"store.steampowered.com\"\n \"tzm.protechts.net\"\n \"b.stats.paypal.com\"\n \"slc.stats.paypal.com\"","id":"network-0","level":"informative","mitre_attack_id":"T1071","name":"Contacts domains","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$3a","id":"binary-33","level":"informative","mitre_attack_id":"T1105","name":"Drops executable files inside temp directory","origin":"Binary File","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$3b","id":"registry-0","level":"suspicious","mitre_attack_id":"T1547.001","name":"Modifies auto-execute functionality by setting/creating a value in the registry","origin":"Registry Access","relevance":8,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"$3c","id":"network-2","level":"informative","mitre_attack_id":"T1071.001","name":"GETs files from a webserver","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$3d","id":"registry-172","level":"informative","mitre_attack_id":"T1012","name":"Queries registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$3e","id":"string-189","level":"informative","mitre_attack_id":"T1529","name":"Contains ability to reboot/shutdown the operating system (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"\"23.47.169.131:443\"\n \"64.233.180.84:443\"\n \"157.240.11.35:443\"\n \"151.101.67.52:443\"\n \"104.18.20.94:443\"\n \"150.171.22.12:443\"\n \"172.64.154.50:443\"\n \"151.101.1.21:443\"\n \"151.101.195.1:443\"\n \"108.138.128.122:443\"\n \"151.101.3.1:443\"\n \"142.250.191.46:443\"\n \"57.144.180.128:443\"\n \"172.66.0.227:443\"\n \"162.159.140.229:443\"\n \"57.144.180.34:443\"\n \"57.144.180.192:443\"\n \"104.18.21.177:443\"\n \"142.250.189.214:443\"","id":"network-1","level":"informative","mitre_attack_id":"T1071","name":"Contacts server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"LoadUserProfileW\" (Indicator: \"LoadUserProfile\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"LoadUserProfileW\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-225","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to impersonate another user on the local machine (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to detect presence of virtual environment (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Found a reference to an external IP address lookup service\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Possibly tries to evade analysis by sleeping many times\n Matched sigs: Contains ability to detect sandbox (imports API)","id":"summary-29","level":"informative","mitre_attack_id":"T1480","name":"Shows ability to use execution guardrails","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$3f","id":"api-102","level":"informative","mitre_attack_id":"T1083","name":"Calls an API typically used for searching a directory for files","origin":"API Call","relevance":5,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$40","id":"string-318","level":"informative","mitre_attack_id":"T1055.001","name":"Contains ability to load/free library (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-241","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to download a file from a URL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$41","id":"string-83","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerate files on disk (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"System Security","description":"$42","id":"string-426","level":"informative","mitre_attack_id":"T1222","name":"Contains ability to modify file attributes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$43","id":"string-89","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve information about the current system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"00000000-00009036.00000001.146814.00271000.00000040.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"00000000-00009036.00000001.146814.00271000.00000040.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-\"; File: \"00000000-00009036.00000001.146814.00271000.00000040.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\"; File: \"00000000-00009036.00000001.146814.00271000.00000040.mdmp\")","id":"string-338","level":"informative","mitre_attack_id":"T1132","name":"Contains ability to perform Base64 encoding/decoding","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"1uM06vb2.exe\" called \"IsWow64Process\" with parameter \"4320\" - (UID: 00000000-00004320)\n \"2HO7525.exe\" called \"IsWow64Process\" with parameter \"4412\" - (UID: 00000000-00004412)\n \"3on26Nz.exe\" called \"IsWow64Process\" with parameter \"9036\" - (UID: 00000000-00009036)","id":"api-146","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used to determine if process is running under WOW64","origin":"API Call","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002988)\n \"HB8Ri19.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006560)\n \"ao2FE12.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008952)\n \"Qj7GR07.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006196)\n \"1uM06vb2.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004320)","id":"api-124","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get product type","origin":"API Call","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"1uM06vb2.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"1uM06vb2.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"2HO7525.exe\" called \"GetUserNameA\" (UID: 00000000-00004412)\n \"3on26Nz.exe\" called \"GetUserNameA\" (UID: 00000000-00009036)","id":"api-135","level":"informative","mitre_attack_id":"T1033","name":"Calls an API typically used to retrieve user name","origin":"API Call","relevance":2,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$44","id":"string-306","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to impersonate access tokens (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-132","level":"informative","mitre_attack_id":"T1098","name":"Contains ability to modify the user configuration/privilege (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"cpuid at 00000000-00004320-47579-329-008ECF92","id":"stream-13","level":"suspicious","mitre_attack_id":"T1082","name":"Contains ability to query CPU information","origin":"Hybrid Analysis Technology","relevance":10,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: HTTP request contains Base64 encoded artifacts\n Matched sigs: Contains XOR operation loops [Stream disassembly]","id":"summary-32","level":"informative","mitre_attack_id":"T1140","name":"Shows ability to deobfuscate/decode files or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-248","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine timezone (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"$45","id":"api-8","level":"informative","mitre_attack_id":"T1129","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","origin":"API Call","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"System Security","description":"$46","id":"string-316","level":"informative","mitre_attack_id":"T1489","name":"Contains ability to terminate a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$47","id":"string-249","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to retrieve file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")","id":"string-739","level":"informative","mitre_attack_id":"T1082","name":"Able to retrieve geographical location information","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"$48","id":"string-204","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create a new process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"00000000-00004320.00000000.143308.008D1000.00000020.mdmp\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"00000000-00004320.00000000.143308.008D1000.00000020.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-553","level":"informative","mitre_attack_id":"T1070","name":"Contains ability to modify file system redirection (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"3on26Nz.exe\" has an entrypoint in section \".data\"\n \"4ft667bN.exe\" has an entrypoint in section \".data\"","id":"static-4","level":"suspicious","mitre_attack_id":"T1027","name":"Entrypoint in PE header is within an uncommon section","origin":"Static Parser","relevance":10,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"HTTPS traffic to \"23.47.169.131\" on port \"443\"\n HTTPS traffic to \"64.233.180.84\" on port \"443\"\n HTTPS traffic to \"157.240.11.35\" on port \"443\"\n HTTPS traffic to \"151.101.67.52\" on port \"443\"\n HTTPS traffic to \"104.18.20.94\" on port \"443\"\n HTTPS traffic to \"150.171.22.12\" on port \"443\"\n HTTPS traffic to \"172.64.154.50\" on port \"443\"\n HTTPS traffic to \"151.101.1.21\" on port \"443\"\n HTTPS traffic to \"151.101.195.1\" on port \"443\"\n HTTPS traffic to \"108.138.128.122\" on port \"443\"\n HTTPS traffic to \"151.101.3.1\" on port \"443\"\n HTTPS traffic to \"142.250.191.46\" on port \"443\"\n HTTPS traffic to \"57.144.180.128\" on port \"443\"\n HTTPS traffic to \"172.66.0.227\" on port \"443\"\n HTTPS traffic to \"162.159.140.229\" on port \"443\"\n HTTPS traffic to \"57.144.180.34\" on port \"443\"\n HTTPS traffic to \"57.144.180.192\" on port \"443\"\n HTTPS traffic to \"104.18.21.177\" on port \"443\"\n HTTPS traffic to \"142.250.189.214\" on port \"443\"","id":"network-38","level":"informative","mitre_attack_id":"T1573","name":"Uses HTTPS for communication","origin":"Network Traffic","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 5AU2Hf7.exe]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 1uM06vb2.exe]","id":"static-88","level":"informative","mitre_attack_id":"T1106","name":"Imports GetCommandLine API","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"System Security","description":"\"2HO7525.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004412)","id":"api-111","level":"informative","mitre_attack_id":"T1134","name":"Calls an API typically used to enable or disable privileges in the specified access token","origin":"API Call","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$49","id":"binary-1","level":"suspicious","mitre_attack_id":"T1105","name":"Drops executable files","origin":"Binary File","relevance":10,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"\"3on26Nz.exe\" called \"CopyFileA\" to copy %TEMP%\\IXP002.TMP\\3on26Nz.exe to new location %LOCALAPPDATA%\\RageMP131\\RageMP131.exe (UID: 00000000-00009036)\n \"3on26Nz.exe\" called \"CopyFileA\" to copy %TEMP%\\IXP002.TMP\\3on26Nz.exe to new location %ALLUSERSPROFILE%\\MPGPH131\\MPGPH131.exe (UID: 00000000-00009036)","id":"api-123","level":"informative","mitre_attack_id":"T1005","name":"Calls an API typically used to copy file from one location to another","origin":"API Call","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"System Security","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: HB8Ri19.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: ao2FE12.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 5AU2Hf7.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: Qj7GR07.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 1uM06vb2.exe]","id":"static-191","level":"informative","mitre_attack_id":"T1489","name":"Calls an API used to open a process handle","origin":"Static Parser","relevance":5,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"$4a","id":"string-550","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to find and load resources of specific modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$4b","id":"api-125","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get system version information","origin":"API Call","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$4c","id":"api-126","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$4d","id":"api-43","level":"suspicious","mitre_attack_id":"T1105","name":"Writes a PE file header to disc","origin":"API Call","relevance":10,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$4e","id":"registry-78","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to read software policies","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"$4f","id":"network-72","level":"informative","mitre_attack_id":"T1071.001","name":"GETs files from a webserver (HTTPS)","origin":"Network Traffic","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","id":"summary-27","level":"informative","mitre_attack_id":"T1119","name":"Shows ability to send encrypted data to the internet","origin":"Indicator Combinations","relevance":2,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"2580437920,6284,3024,,RtlGetVersion,NTDLL.dll,\"00:37:11.687\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp\")","id":"string-86","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve information about operating system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"$50","id":"network-35","level":"malicious","mitre_attack_id":"T1071.004","name":"Detected many DNS responses with a low TTL","origin":"Network Traffic","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"\"2HO7525.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 6FF40000","id":"module-3","level":"informative","mitre_attack_id":"T1129","name":"Loads the .NET runtime environment","origin":"Loaded Module","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"DecryptFileA\" (Indicator: \"DecryptFile\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")","id":"string-438","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to perform AES/RC4 encryption (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00006196.00000000.143256.0122A000.00000002.mdmp\")","id":"string-312","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve path in which Windows is installed (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$51","id":"string-317","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve address of exported function from a DLL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"\"2HO7525.exe\" is setting 'ThreadHideFromDebugger' data for thread ID 0x2f4\n \"3on26Nz.exe\" is setting 'ThreadHideFromDebugger' data for its current thread","id":"api-84","level":"suspicious","mitre_attack_id":"T1622","name":"Sets the 'ThreadHideFromDebugger' thread data structure","origin":"API Call","relevance":10,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"\"3on26Nz.exe\" reads file \"C:\\Windows\\SysWOW64\\GroupPolicy\\gpt.ini\"\n \"3on26Nz.exe\" reads file \"C:\\Windows\\System32\\GroupPolicy\\gpt.ini\"","id":"api-6","level":"suspicious","mitre_attack_id":"T1083","name":"Reads configuration files (.ini files)","origin":"API Call","relevance":4,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"\"1uM06vb2.exe\" touched \"Internet Shortcut\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\\TREATAS\")\n \"1uM06vb2.exe\" touched \"Property System Both Class Factory\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\\PROGID\")\n \"1uM06vb2.exe\" touched \"Microsoft Url History Service\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\\TREATAS\")\n \"1uM06vb2.exe\" touched \"ShellItemArray Shell Namespace helper\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\\PROGID\")\n \"1uM06vb2.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"1uM06vb2.exe\" touched \"Network\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\SHELLFOLDER\")\n \"3on26Nz.exe\" touched \"Group Policy Object\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{EA502722-A23D-11D1-A7D3-0000F87571E3}\")","id":"registry-72","level":"informative","mitre_attack_id":"T1546.015","name":"Overview of unique CLSIDs touched in registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"$52","id":"certificate-3","level":"informative","mitre_attack_id":"T1583.001","name":"Short-term SSL certificate detected","origin":"Certificate Data","relevance":5,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"System Security","description":"$53","id":"registry-173","level":"informative","mitre_attack_id":"T1007","name":"Queries services related registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"1uM06vb2.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"20010918\"\n \"cx\": \"32\"\n \"cy\": \"32\"}\n \"1uM06vb2.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"20010918\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","id":"api-105","level":"informative","mitre_attack_id":"T1113","name":"Calls an API possibly used to take screenshots","origin":"API Call","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"/BH5aEs\" (Indicator: \"aes\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found string \"AESg\" (Indicator: \"aes\"; Source: \"00000000-00004412.00000000.144519.0128A000.00000040.mdmp\")\n Found string \"AES_Wrap\" (Indicator: \"aes\"; Source: \"00000000-00004412.00000000.144519.0128A000.00000040.mdmp\")\n Found string \"hX~AeSlZ\" (Indicator: \"aes\"; Source: \"00000000-00004412.00000000.144519.0128A000.00000040.mdmp\")\n Found string \"/* RIJNDAEL by Joan Daemen and Vincent Rijmen */\" (Indicator: \"rijndael\"; Source: \"00000000-00004412.00000000.144519.05F00000.00000040.mdmp\")","id":"string-57","level":"informative","mitre_attack_id":"T1027","name":"Contains CRYPTO related strings","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"3on26Nz.exe\" (Thread ID: 8444) slept \"525\" times (threshold: 500)","id":"api-47","level":"suspicious","mitre_attack_id":"T1497.003","name":"Possibly tries to evade analysis by sleeping many times","origin":"API Call","relevance":10,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"ControlService\" (Indicator: \"ControlService\"; File: \"00000000-00004412.00000000.144519.00F82000.00000040.mdmp\")\n Found reference to API \"ChangeServiceConfig\" (Indicator: \"ChangeServiceConfig\"; File: \"00000000-00004412.00000000.144519.00F82000.00000040.mdmp\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00004412.00000000.144519.00F82000.00000040.mdmp\")\n Found reference to API \"ChangeServiceConfig\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00004412.00000000.144519.00F82000.00000040.mdmp\")","id":"string-192","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to modify system service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found PE header \"MZ\" - Source: \"00000000-00004412.00000000.144519.0128A000.00000040.mdmp\")","id":"memorydump-8","level":"informative","mitre_attack_id":"T1055","name":"Found PE header in memory","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")","id":"string-148","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to register a top-level exception handler (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"\"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"HB8Ri19.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"ao2FE12.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"3on26Nz.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"5AU2Hf7.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"4ft667bN.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Qj7GR07.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"1uM06vb2.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","id":"static-153","level":"informative","name":"Uses 32 bit executable PE","origin":"Static Parser","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"$54","id":"string-601","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to communicate with network (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for Djb2 Hash Algorithm matched on file \"1uM06vb2.exe\"","id":"yara-542","level":"informative","mitre_attack_id":"T1027","name":"YARA signature match - Djb2 Hash Algorithm","origin":"YARA Signature","relevance":5,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$55","id":"api-121","level":"informative","mitre_attack_id":"T1070.004","name":"Calls an API typically used to remove a directory","origin":"API Call","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$56","id":"string-201","level":"informative","mitre_attack_id":"T1614","name":"Able to query system locale information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$57","id":"registry-137","level":"informative","mitre_attack_id":"T1005","name":"Queries list of installed browsers","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"$58","id":"static-157","level":"informative","mitre_attack_id":"T1027","name":"Matched Compiler/Packer signature (DIE)","origin":"Static Parser","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"\"abs.twimg.com\"\n \"accounts.google.com\"\n \"api.hcaptcha.com\"\n \"api.twitter.com\"\n \"api.x.com\"\n \"b.stats.paypal.com\"\n \"browser-intake-us5-datadoghq.com\"\n \"c.paypal.com\"\n \"c6.paypal.com\"\n \"client.protechts.net\"\n \"collector-pxdojv695v.protechts.net\"\n \"community.fastly.steamstatic.com\"\n \"connect.facebook.net\"\n \"csp.withgoogle.com\"\n \"ddbm2.paypal.com\"\n \"dpm.demdex.net\"\n \"facebook.com\"\n \"fbcdn.net\"\n \"fbsbx.com\"\n \"fonts.googleapis.com\"\n \"fonts.gstatic.com\"\n \"googleads.g.doubleclick.net\"\n \"i.ytimg.com\"\n \"instagram.com\"\n \"js.hcaptcha.com\"","id":"network-51","level":"informative","mitre_attack_id":"T1071.004","name":"Queries DNS server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"rage131MP.tmp\" has type \"ASCII text with no line terminators\" - Location: [%TEMP%\\rage131MP.tmp]","id":"binary-53","level":"informative","mitre_attack_id":"T1105","name":"Drops temp files","origin":"Binary File","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"Found string \"fonts.googleapis.com\" (Indicator: \".googleapis.com\"; File: \"PCAP\")","id":"string-186","level":"informative","mitre_attack_id":"T1102","name":"Found domain strings related to cloud services(possible C&C communication)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"$59","id":"static-6","level":"suspicious","mitre_attack_id":"T1027.009","name":"Section contains high entropy","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"$5a","id":"api-128","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to create a process","origin":"API Call","relevance":5,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-122","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-239","level":"informative","mitre_attack_id":"T1548.002","name":"Contains ability to bypass UAC using COM object (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"\"UDP connection to 64.233.180.84\"\n \"UDP connection to 104.18.20.94\"\n \"UDP connection to 172.64.154.50\"\n \"UDP connection to 57.144.180.34\"\n \"UDP connection to 142.250.191.46\"\n \"UDP connection to 57.144.180.192\"\n \"UDP connection to 57.144.180.128\"\n \"UDP connection to 142.250.188.3\"\n \"UDP connection to 104.18.21.177\"\n \"UDP connection to 157.240.11.35\"\n \"UDP connection to 142.250.191.35\"\n \"UDP connection to 142.251.46.206\"\n \"UDP connection to 74.125.250.129\"\n \"UDP connection to 34.149.66.134\"\n \"UDP connection to 35.186.247.156\"\n \"UDP connection to 35.190.10.96\"\n \"UDP connection to 142.250.189.164\"\n \"UDP connection to 104.18.22.33\"\n \"UDP connection to 142.250.189.194\"\n \"UDP connection to 142.251.214.131\"\n \"UDP connection to 104.19.230.21\"\n \"UDP connection to 57.144.180.1\"","id":"network-5","level":"suspicious","mitre_attack_id":"T1095","name":"Sends UDP traffic","origin":"Network Traffic","relevance":7,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"11377057092,3468,100,,FindWindowExW,user32.dll,\"00:37:18.968\",RX=0,PX=0\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00004320.00000000.143308.030F0000.00000004.mdmp\")","id":"string-413","level":"informative","mitre_attack_id":"T1010","name":"Contains ability to find open windows (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: HB8Ri19.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: ao2FE12.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: 3on26Nz.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: 5AU2Hf7.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: 4ft667bN.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: Qj7GR07.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: 1uM06vb2.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: 2HO7525.exe)","id":"static-79","level":"informative","mitre_attack_id":"T1027.007","name":"Contains ability to dynamically determine API calls","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"\"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\" has an executable section named \".text\"\n \"HB8Ri19.exe\" has an executable section named \".text\"\n \"ao2FE12.exe\" has an executable section named \".text\"\n \"3on26Nz.exe\" has an executable section named \"\"\n \"3on26Nz.exe\" has an executable section named \".rsrc\"\n \"3on26Nz.exe\" has an executable section named \".data\"\n \"5AU2Hf7.exe\" has an executable section named \".text\"\n \"4ft667bN.exe\" has an executable section named \"\"\n \"4ft667bN.exe\" has an executable section named \".rsrc\"\n \"4ft667bN.exe\" has an executable section named \".data\"\n \"Qj7GR07.exe\" has an executable section named \".text\"\n \"1uM06vb2.exe\" has an executable section named \".text\"\n \"2HO7525.exe\" has an executable section named \"\"","id":"static-80","level":"informative","name":"PE file contains executable sections","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"$5b","id":"target-103","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes that are not known child processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"1uM06vb2.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"1uM06vb2.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"1uM06vb2.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"1uM06vb2.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\"\n \"1uM06vb2.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"\n \"1uM06vb2.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"\n \"3on26Nz.exe\" touched file \"C:\\Windows\\SysWOW64\\GroupPolicy\\gpt.ini\"\n \"3on26Nz.exe\" touched file \"C:\\Windows\\System32\\GroupPolicy\\Machine\\Registry.pol\"\n \"3on26Nz.exe\" touched file \"C:\\Windows\\System32\\GroupPolicy\\gpt.ini\"","id":"api-55","level":"informative","mitre_attack_id":"T1083","name":"Touches files in the Windows directory","origin":"API Call","relevance":7,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-547","level":"informative","mitre_attack_id":"T1562.001","name":"Contains ability to block user input (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Sample file \"sample.bin\" has high entropy 7.995116844110976","id":"binary-71","level":"informative","mitre_attack_id":"T1027","name":"Sample file has high entropy (likely encrypted/compressed content)","origin":"Binary File","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4320:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4320:64:WilError_01\"\n \"Local\\SM0:4320:64:WilError_01\"\n \"Local\\SM0:4320:168:WilStaging_02\"\n \"SM0:4320:64:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:4320:64:WilError_01\"","id":"mutant-0","level":"informative","mitre_attack_id":"T1480","name":"Creates mutants","origin":"Created Mutant","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"\"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"HB8Ri19.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"ao2FE12.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"5AU2Hf7.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"Qj7GR07.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"1uM06vb2.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"2HO7525.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","id":"static-146","level":"informative","name":"PE file contains Debug data directory","origin":"Static Parser","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"Virtual size of \".rsrc\" is \"0x4ee000\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x44c000\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x2e4000\" greater than 0x100000\n Virtual size of \"\" is \"0x12d000\" greater than 0x100000\n Virtual size of \"\" is \"0x29d000\" greater than 0x100000\n Virtual size of \".text\" is \"0x12c6e8\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x10f000\" greater than 0x100000\n Virtual size of \"\" is \"0x2fe000\" greater than 0x100000","id":"static-124","level":"informative","name":"PE file has a big virtual size section","origin":"Static Parser","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"Found HTTPS GET request to https://store.steampowered.com/login\n Found HTTPS GET request to https://store.steampowered.com/dynamicstore/saledata/?cc=US\n Found HTTPS GET request to https://store.steampowered.com/favicon.ico\n Found HTTPS GET request to https://tzm.protechts.net/ns?c=d93f0c70-38d6-11f0-a732-c5bcabf5e228\n Found HTTPS GET request to https://b.stats.paypal.com/v1/counter.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w\n Found HTTPS GET request to https://slc.stats.paypal.com/v1/counter2.cgi?r=cD1kZjcxZjQ5ZjI0MzM0ODY3YTkxNWQxM2ZkNmMxYTUyNCZpPTY0LjEyNC4xMi4xNjImdD0xNzQ4MDg5OTIyLjIzMyZhPTIxJnM9VU5JRklFRF9MT0dJTk5QOuhnXwfc6Ew-g11Mgnx-qp3w","id":"network-66","level":"informative","mitre_attack_id":"T1071.001","name":"Sends GET/POST requests (HTTPS)","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00009036-00000C2B-1274182110\")","id":"string-730","level":"informative","mitre_attack_id":"T1083","name":"Able to determine the valid logical drives on the computer","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00006196.00000000.143256.0122A000.00000002.mdmp\")","id":"string-354","level":"informative","mitre_attack_id":"T1082","name":"Contains reference to mutex-related activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")","id":"string-167","level":"informative","mitre_attack_id":"T1543","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"\"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77020000\n \"HB8Ri19.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77020000\n \"ao2FE12.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77020000\n \"Qj7GR07.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77020000\n \"1uM06vb2.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77020000\n \"2HO7525.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77020000\n \"3on26Nz.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77020000\n \"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77020000","id":"module-10","level":"informative","mitre_attack_id":"T1129","name":"Loads the RPC (Remote Procedure Call) module DLL","origin":"Loaded Module","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"System Security","description":"$5c","id":"static-87","level":"informative","mitre_attack_id":"T1134.001","name":"Imports system security related APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"2HO7525.exe\" called \"FileTimeToLocalFileTime\" with parameter 00947d69c344da01 & 00bc1ebd8844da01 (UID: 00000000-00004412)\n \"3on26Nz.exe\" called \"FileTimeToLocalFileTime\" with parameter 00947d69c344da01 & 00bc1ebd8844da01 (UID: 00000000-00009036)","id":"api-223","level":"suspicious","mitre_attack_id":"T1070.006","name":"Calls an API typically used to query local/system time as file time","origin":"API Call","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Process \"schtasks.exe\" with commandline \"schtasks /create /f /RU \"uD0xdzD\" /tr \"%ALLUSERSPROFILE%\\\\MPGPH131\\\\MPGPH131.exe\" /tn \"MPGPH131 HR\" /sc HOURLY /rl HIGHEST\" (UID: 00000000-00007660)\n Process \"schtasks.exe\" with commandline \"schtasks /create /f /RU \"uD0xdzD\" /tr \"%ALLUSERSPROFILE%\\\\MPGPH131\\\\MPGPH131.exe\" /tn \"MPGPH131 LG\" /sc ONLOGON /rl HIGHEST\" (UID: 00000000-00000804)","id":"target-13","level":"malicious","mitre_attack_id":"T1053.005","name":"Schedules a task to be executed at a specific time and date","origin":"Monitored Target","relevance":8,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"$5d","id":"certificate-0","level":"informative","mitre_attack_id":"T1553.002","name":"The input sample is signed with a certificate","origin":"Certificate Data","relevance":10,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-206","level":"informative","mitre_attack_id":"T1059.003","name":"Contains ability to retrieve the command-line string for the current process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"\"1uM06vb2.exe\" failed to load missing module \"%WINDIR%\\System32\\Windows.UI.AppDefaults.dll\" - [base:0; Status:ffffffffc0000135]\n \"2HO7525.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoree.dll\" - [base:0; Status:ffffffffc0000135]\n \"2HO7525.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\ole32.dll\" - [base:0; Status:ffffffffc0000135]\n \"2HO7525.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\api-ms-win-core-winrt-l1-1-0.dll\" - [base:0; Status:ffffffffc0000135]\n \"2HO7525.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ntdll.dll\" - [base:0; Status:ffffffffc0000135]","id":"api-22","level":"informative","mitre_attack_id":"T1574.002","name":"Fails to load modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"System Destruction","description":"$5e","id":"api-25","level":"suspicious","mitre_attack_id":"T1070.004","name":"Opens file with deletion access rights","origin":"API Call","relevance":7,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"HB8Ri19.exe\" claimed CRC 4565077 while the actual is CRC 5225016\n \"ao2FE12.exe\" claimed CRC 3112942 while the actual is CRC 4565077\n \"Qj7GR07.exe\" claimed CRC 1140917 while the actual is CRC 1447501\n \"1uM06vb2.exe\" claimed CRC 944812 while the actual is CRC 1140917","id":"static-0","level":"suspicious","mitre_attack_id":"T1027","name":"CRC value set in PE header does not match actual value","origin":"Static Parser","relevance":10,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: 3on26Nz.exe]\n Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: 5AU2Hf7.exe]","id":"static-82","level":"informative","mitre_attack_id":"T1486","name":"Imports crypto-related APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"2HO7525.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004412)","id":"api-296","level":"informative","mitre_attack_id":"T1497","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","origin":"API Call","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"\"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\" has an writable section named \".data\"\n \"HB8Ri19.exe\" has an writable section named \".data\"\n \"ao2FE12.exe\" has an writable section named \".data\"\n \"3on26Nz.exe\" has an writable section named \"\"\n \"3on26Nz.exe\" has an writable section named \".rsrc\"\n \"3on26Nz.exe\" has an writable section named \".data\"\n \"5AU2Hf7.exe\" has an writable section named \".data\"\n \"4ft667bN.exe\" has an writable section named \"\"\n \"4ft667bN.exe\" has an writable section named \".rsrc\"\n \"4ft667bN.exe\" has an writable section named \".data\"\n \"Qj7GR07.exe\" has an writable section named \".data\"\n \"1uM06vb2.exe\" has an writable section named \".data\"\n \"2HO7525.exe\" has an writable section named \"\"","id":"static-95","level":"informative","name":"PE file contains writable sections","origin":"Static Parser","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"$5f","id":"memorydump-2","level":"informative","mitre_attack_id":"T1071","name":"Found potential URLs in memory dumps","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"Found HTTPS url \"https://ipinfo.io\"\n Found HTTPS url \"https://www.maxmind.com\"","id":"string-98","level":"informative","mitre_attack_id":"T1573","name":"Possibly tries to communicate over SSL connection (HTTPS)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$60","id":"string-427","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")","id":"string-532","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the host name of a computer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"System Security","description":"$61","id":"string-729","level":"informative","mitre_attack_id":"T1489","name":"Able to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"System Security","description":"\"2HO7525.exe\" called \"OpenServiceA\" to access the \"WinDefend\" service (\"Windows Defender\")\n \"2HO7525.exe\" called \"OpenServiceA\" to access the \"wuauserv\" service (\"Windows Update\")","id":"api-79","level":"malicious","mitre_attack_id":"T1007","name":"Requested access to a critical system service","origin":"API Call","relevance":10,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"$62","id":"string-16","level":"informative","mitre_attack_id":"T1213","name":"Contains SQL queries","origin":"File/Memory","relevance":2,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"$63","id":"string-605","level":"informative","mitre_attack_id":"T1005","name":"May execute SQL queries","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"\"wzWksi{m\"\n \"p=df71f49f24334867a915d13fd6c1a524&i=64.124.12.162&t=1748089922.233&a=21&s=UNIFIED_LOGINNP:g_L S\"","id":"network-20","level":"informative","mitre_attack_id":"T1132.001","name":"HTTP request contains Base64 encoded artifacts","origin":"Network Traffic","relevance":7,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$64","id":"string-78","level":"informative","mitre_attack_id":"T1113","name":"Contains ability to capture screen (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$65","id":"api-140","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to find a resource in a module","origin":"API Call","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$66","id":"string-226","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$67","id":"string-304","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to modify registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"1uM06vb2.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"2HO7525.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","id":"api-108","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve information about the current system","origin":"API Call","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006196.00000000.143256.0122A000.00000002.mdmp\")","id":"string-164","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve the fully qualified path of module (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002988.00000000.143070.00BF1000.00000020.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006196.00000000.143256.01221000.00000020.mdmp\")","id":"string-437","level":"informative","mitre_attack_id":"T1134","name":"Contains ability to retrieve token privileges information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")","id":"string-79","level":"informative","mitre_attack_id":"T1055.001","name":"Contains ability to create a remote thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00006196.00000000.143256.0122A000.00000002.mdmp\")","id":"string-208","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to show a graphical window (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006196.00000000.143256.0122A000.00000002.mdmp\")","id":"string-205","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"System Security","description":"$68","id":"string-474","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to access device drivers","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-661","level":"informative","mitre_attack_id":"T1497.002","name":"Able to identify virtual environment by using user activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"StartService\" (Indicator: \"StartService\"; File: \"00000000-00004412.00000000.144519.00F82000.00000040.mdmp\")\n Found reference to API \"StartService\" (Indicator: \"StartService\"; Source: \"00000000-00004412.00000000.144519.00F82000.00000040.mdmp\")","id":"string-209","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to start a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcessWithLogon\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")","id":"string-168","level":"informative","mitre_attack_id":"T1134.002","name":"Contains ability to create process with token (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004412.00000000.144519.037B0000.00000004.mdmp\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006196.00000000.143256.0122A000.00000002.mdmp\")","id":"string-320","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to pass information to a window procedure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$69","id":"string-721","level":"informative","mitre_attack_id":"T1055.015","name":"Able to visualize and control listed components (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"2HO7525.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00004412)","id":"api-147","level":"informative","mitre_attack_id":"T1614","name":"Calls an API typically used to retrieve local language","origin":"API Call","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"WNetUseConnectionW\" (Indicator: \"WNetUseConnection\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"WNetCancelConnection2W\" (Indicator: \"WNetCancelConnection\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")","id":"string-113","level":"informative","mitre_attack_id":"T1135","name":"Contains ability to provide information and utilities for managing network resources (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00006196.00000000.143256.0122A000.00000002.mdmp\")","id":"string-80","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to determine disk drive type (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00006196.00000000.143256.0122A000.00000002.mdmp\")","id":"string-319","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to set/get the last-error code for a calling thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"\"2HO7525.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 71F20000","id":"module-7","level":"informative","mitre_attack_id":"T1620","name":"Loads the CLR Loader DLL","origin":"Loaded Module","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"$6a","id":"target-25","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"$6b","id":"network-78","level":"informative","mitre_attack_id":"T1132","name":"HTTP requests contain custom Base62 strings","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found GetCursorPos() in an import section (Source: 5AU2Hf7.exe)\n Found GetCursorPos() in an import section (Source: 1uM06vb2.exe)","id":"static-132","level":"informative","mitre_attack_id":"T1497","name":"Contains ability to detect sandbox (imports API)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"File type \"PE32 executable (GUI) Intel 80386 for MS Windows 8 sections\" was dropped at \"%ALLUSERSPROFILE%\\MPGPH131\\MPGPH131.exe\"","id":"binary-27","level":"malicious","mitre_attack_id":"T1036","name":"Drops executable files to the application program directory (%ProgramData%)","origin":"Binary File","relevance":7,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$6c","id":"string-92","level":"informative","mitre_attack_id":"T1055","name":"Contains ability to inject code into another process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$6d","id":"string-141","level":"informative","mitre_attack_id":"T1010","name":"Contains ability to retrieve open application windows (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"1uM06vb2.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"2HO7525.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"3on26Nz.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","id":"api-264","level":"informative","mitre_attack_id":"T1055.003","name":"Creates a thread in a self process","origin":"API Call","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-210","level":"informative","mitre_attack_id":"T1559","name":"Contains ability to create/connect to a named pipe (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004320.00000000.143308.030F0000.00000004.mdmp\")\n Found string \"F+ncalrpc:[OLE4E2B4BB3501DE7EC1F7A9858353C]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004320.00000000.143308.030F0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEE40F95A2F684F177344C8457808A]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004320.00000000.143308.030F0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE4E2B4BB3501DE7EC1F7A9858353C]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004320.00000000.143308.030F0000.00000004.mdmp\")","id":"string-531","level":"informative","mitre_attack_id":"T1090","name":"Contains references to RPC protocol sequence strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"CredEnumerateA\" (Indicator: \"CredEnumerate\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")","id":"string-81","level":"informative","mitre_attack_id":"T1555.004","name":"Contains ability to to enumerates the credentials (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-439","level":"informative","mitre_attack_id":"T1055.003","name":"Contains ability to modify process memory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$6e","id":"string-247","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"\"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\HB8Ri19.exe\"","id":"api-267","level":"informative","mitre_attack_id":"T1005","name":"Writes files in a temp directory","origin":"API Call","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetCurrentHwProfileA\" (Indicator: \"GetCurrentHwProfile\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")","id":"string-159","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve information about the current hardware profile (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-478","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to retrieve process ID (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"System Security","description":"$6f","id":"string-308","level":"informative","mitre_attack_id":"T1070.004","name":"Contains ability to delete files/directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"External Systems","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","id":"avtest-8","level":"malicious","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","origin":"External System","relevance":10,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"SetupDiGetClassDevsA\" (Indicator: \"SetupDiGetClassDevs\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")","id":"string-253","level":"informative","mitre_attack_id":"T1497","name":"Contains ability to detect presence of virtual environment (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"2HO7525.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")\n \"3on26Nz.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","id":"registry-138","level":"informative","mitre_attack_id":"T1012","name":"Queries for Borland Delphi related registry entry","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\schtasks.exe\" [Source: 00000000-00009036-00000BC0-1275925664]","id":"string-170","level":"informative","name":"Possibly uses system binaries (Windows LOLbins)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-538","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to create a HTTP or FTP session (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$70","id":"string-207","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve file and directory information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00006196.00000000.143256.0122A000.00000002.mdmp\")","id":"string-131","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")","id":"string-183","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to check debugger is running (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: HB8Ri19.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: ao2FE12.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: Qj7GR07.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 1uM06vb2.exe]","id":"static-189","level":"informative","mitre_attack_id":"T1057","name":"Calls an APIs used to retrieve process information","origin":"Static Parser","relevance":5,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"1uM06vb2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"2HO7525.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"3on26Nz.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","id":"registry-35","level":"informative","mitre_attack_id":"T1082","name":"Reads the active computer name","origin":"Registry Access","relevance":5,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"\"wextract.pdb\"\n \"E:\\offDef\\offDef\\offDef\\obj\\Release\\offDef.pdb\"","id":"string-7","level":"informative","name":"Contains PDB pathways","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")","id":"string-228","level":"informative","mitre_attack_id":"T1095","name":"Contains ability to communicate with C2 using Sockets (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$71","id":"string-229","level":"informative","mitre_attack_id":"T1012","name":"Contains ability to query registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"System Destruction","description":"\"Qj7GR07.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP003.TMP\\2HO7525.exe\" for deletion\n \"Qj7GR07.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP003.TMP\\1uM06vb2.exe\" for deletion","id":"api-26","level":"suspicious","mitre_attack_id":"T1070.004","name":"Marks file for deletion","origin":"API Call","relevance":10,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"$72","id":"string-240","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute an application (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-269","level":"informative","mitre_attack_id":"T1564","name":"Contains reference to method used by Windows shell items (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"$73","id":"static-96","level":"informative","name":"PE file entrypoint instructions","origin":"Static Parser","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$74","id":"string-310","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to load modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"Found user-agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56","id":"network-22","level":"suspicious","mitre_attack_id":"T1071.001","name":"Uses a browser-related user-agent without launching browser","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$75","id":"static-1","level":"suspicious","mitre_attack_id":"T1106","name":"Imports suspicious APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"SetupDiGetClassDevsA\" (Indicator: \"SetupDiGetClassDevs\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")","id":"string-533","level":"informative","mitre_attack_id":"T1480","name":"Contains ability to retrieve information set for devices (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"1uM06vb2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\")\n \"1uM06vb2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\"; Key: \"USESHORTNAME\")\n \"1uM06vb2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\\SUPPORTEDPROTOCOLS\")\n \"1uM06vb2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\"; Key: \"APPENDPATH\")\n \"1uM06vb2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSEDGE.EXE\"; Key: \"PATH\")","id":"registry-55","level":"informative","mitre_attack_id":"T1518","name":"Reads the registry for installed applications","origin":"Registry Access","relevance":10,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"$76","id":"string-307","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to create/load registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36\" (Indicator: \"mozilla/5.0 (\"; File: \"00000000-00009036.00000001.146814.00271000.00000040.mdmp\")\n Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; File: \"00000000-00009036.00000001.146814.00271000.00000040.mdmp\")","id":"string-127","level":"informative","mitre_attack_id":"T1071.001","name":"Found user-agent related strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"\"https://www.paypal.com/signin\" (Indicator: \"paypal.com\")\n \"--single-argument https://www.paypal.com/signin\" (Indicator: \"paypal.com\")\n \"ttps://www.paypal.com/signin\" (Indicator: \"paypal.com\")","id":"string-135","level":"informative","name":"Found well known domains (string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\n \"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 00000000-00002988.00000000.143070.00BF1000.00000020.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 00000000-00006196.00000000.143256.01221000.00000020.mdmp","id":"string-96","level":"informative","mitre_attack_id":"T1012","name":"Found registry key string for installed applications","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SeAssignPrimaryTokenPrivilege\" (Indicator: \"SeAssignPrimaryTokenPrivilege\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"SeIncreaseQuotaPrivilege\" (Indicator: \"SeIncreaseQuotaPrivilege\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-97","level":"informative","mitre_attack_id":"T1548","name":"Contains ability to use security policy setting (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"2HO7525.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP003.TMP\\2HO7525.exe\" at 00000000-00004412-00000C17-1270579953","id":"api-11","level":"informative","mitre_attack_id":"T1082","name":"Queries volume information","origin":"API Call","relevance":2,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$77","id":"api-263","level":"informative","mitre_attack_id":"T1083","name":"Touches files","origin":"API Call","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"\"https://ipinfo.io/\" (Indicator: \"ipinfo.io\"; File: \"51397-3698-00292020\")\n \"https://www.maxmind.com/en/locate-my-ip-address\" (Indicator: \"maxmind.com\"; File: \"51397-3698-00292020\")","id":"string-56","level":"malicious","mitre_attack_id":"T1016","name":"Found a reference to an external IP address lookup service","origin":"File/Memory","relevance":6,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: 5AU2Hf7.exe]","id":"static-190","level":"informative","mitre_attack_id":"T1082","name":"Calls an APIs used to retrieve geographical location information","origin":"Static Parser","relevance":5,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"set cd door\" (Indicator: \"set \"; File: \"00000000-00004320.00000000.143308.008D1000.00000020.mdmp\")\n Found string \"set list\" (Indicator: \"set \"; File: \"00000000-00009036.00000001.146814.00271000.00000040.mdmp\")","id":"string-326","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve environment variable settings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$78","id":"registry-177","level":"informative","mitre_attack_id":"T1012","name":"Opens registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"2HO7525.exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config\"\n \"2HO7525.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll.aux\"\n \"2HO7525.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\2c3c912ea8f058f9d04c4650128feb3f\\system.ni.dll.aux\"\n \"3on26Nz.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\ixp002.tmp\\3on26nz.exe\"\n \"3on26Nz.exe\" reads file \"c:\\windows\\syswow64\\grouppolicy\\gpt.ini\"\n \"3on26Nz.exe\" reads file \"c:\\windows\\system32\\grouppolicy\\gpt.ini\"","id":"api-243","level":"informative","mitre_attack_id":"T1083","name":"Reads files","origin":"API Call","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-537","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to create a new HTTP request (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","id":"network-55","level":"informative","name":"JA3 SSL client fingerprint","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006196.00000000.143256.0122A000.00000002.mdmp\")","id":"string-535","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to write files (API string)","origin":"File/Memory","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"$79","id":"string-322","level":"informative","mitre_attack_id":"T1570","name":"Contains ability to move file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\ixp000.tmp\\hb8ri19.exe\"","id":"api-242","level":"informative","name":"Writes files","origin":"API Call","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")","id":"string-419","level":"informative","mitre_attack_id":"T1571","name":"Contains ability to open a port and listen for incoming connection (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"Observed import api \"SHEmptyRecycleBin\" which can \"empty the Recycle Bin on the specified drive\" [Source: 1uM06vb2.exe]","id":"static-84","level":"informative","mitre_attack_id":"T1070","name":"Imports SHEmptyRecycleBin API","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"System Security","description":"$7a","id":"string-114","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"1uM06vb2.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CONTROL PANEL\\MOUSE\";)\n \"1uM06vb2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\MOUSE\";)","id":"registry-202","level":"informative","mitre_attack_id":"T1082","name":"Reads system mouse configuration","origin":"Registry Access","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"$7b","id":"api-175","level":"informative","mitre_attack_id":"T1129","name":"Calls an API typically used to load libraries","origin":"API Call","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-188","level":"informative","mitre_attack_id":"T1115","name":"Contains ability to access clipboard data (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-115","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve data about the local computer (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00006196.00000000.143256.0122A000.00000002.mdmp\")","id":"string-161","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve/modify process thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"\"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"HB8Ri19.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"ao2FE12.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"Qj7GR07.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"2HO7525.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","id":"static-154","level":"informative","name":"File contains dynamic base/NX flags","origin":"Static Parser","sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"\"1uM06vb2.exe\" searching for class \"Shell_TrayWnd\"","id":"api-70","level":"informative","mitre_attack_id":"T1010","name":"Scanning for window names","origin":"API Call","relevance":10,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"Newly renewed or created SSL certificate: \"static-assets-prod.unrealengine.com\" (10 days old)","id":"certificate-4","level":"informative","mitre_attack_id":"T1583.001","name":"Recently renewed or created SSL certificate","origin":"Certificate Data","relevance":5,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-111","level":"informative","mitre_attack_id":"T1070","name":"Contains ability to empty the recycle bin (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"password?\" (Indicator: \"password\"; File: \"screen_3.png\")\n Found string \"notepad\\secret.datt\" (Indicator: \"secret\"; Source: \"00000000-00004412.00000000.144519.05F00000.00000040.mdmp, 00000000-00004412.00000000.144519.05F30000.00000040.mdmp\")","id":"string-475","level":"informative","mitre_attack_id":"T1555","name":"Contains string like password/secret","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"System Security","description":"$7c","id":"string-77","level":"informative","mitre_attack_id":"T1134","name":"Contains ability to modify access token privileges (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"PING\" (Indicator: \"ping\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-126","level":"suspicious","mitre_attack_id":"T1082","name":"Found system commands related strings","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00006196.00000000.143256.0122A000.00000002.mdmp\")","id":"string-409","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to set file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"1uM06vb2.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00004320)\n \"1uM06vb2.exe\" called \"GetUserNameExW\" with parameters (UID: 00000000-00004320)\n \"1uM06vb2.exe\" called \"GetUserNameExA\" with parameters (UID: 00000000-00004320)","id":"api-294","level":"informative","mitre_attack_id":"T1082","name":"Attempts to call APIs to gather system and hardware detail","origin":"API Call","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-222","level":"informative","mitre_attack_id":"T1016","name":"Contains ability to retrieve network parameters of a computer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"Discovered multiple strings which indicates a credential input page. (Source: screen_3.png | String(s): \"sign\"\n \"forgot\"\n \"email\"\n \"login\")\n (Source: screen_3.png)","id":"string-700","level":"informative","name":"Credential input page detected","origin":"File/Memory","relevance":5,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"TCP traffic to 193.233.132.62 on port 50500\n TCP traffic to 3.87.180.44 on port 3478","id":"network-7","level":"malicious","mitre_attack_id":"T1571","name":"Uses network protocols on unusual ports","origin":"Network Traffic","relevance":7,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"\"2HO7525.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\"; Key: \"DISABLEANTISPYWARE\"; Value: \"01000000\")\n \"3on26Nz.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{007A4500-95BB-485F-BA69-2CD1B09ED391}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\"; Key: \"DISABLEANTISPYWARE\"; Value: \"01000000\")","id":"registry-76","level":"malicious","mitre_attack_id":"T1562.001","name":"Tries to disable Windows defender Anti Spyware","origin":"Registry Access","relevance":7,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"External Systems","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA TCPv4 invalid checksum\" (SID: 2200074, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","id":"suricata-0","level":"informative","name":"Detected Suricata Alert","origin":"Suricata Alerts","relevance":10,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"details too long to display","id":"api-176","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to retrieve function addresses","origin":"API Call","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"details too long to display","id":"string-101","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute Windows APIs","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")","id":"string-257","level":"informative","mitre_attack_id":"T1049","name":"Contains ability to enumerate network resources (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Network Related","description":"Observed import api \"WNetAddConnection\" which can \"make a connection to a network resource\" [Source: 1uM06vb2.exe]\n Observed import api \"WNetCancelConnection\" which can \"cancel an existing network connection\" [Source: 1uM06vb2.exe]\n Observed import api \"WNetGetConnection\" which can \"retrieve the name of the network resource associated with a local device\" [Source: 1uM06vb2.exe]\n Observed import api \"WNetUseConnection\" which can \"make a connection to a network resource\" [Source: 1uM06vb2.exe]","id":"static-86","level":"informative","mitre_attack_id":"T1135","name":"Imports windows networking-related APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"System Security","description":"$7d","id":"string-230","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to delete registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"System Security","description":"\"2HO7525.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWSUPDATE\\AU\"; Key: \"NOAUTOUPDATE\"; Value: \"01000000\")\n \"3on26Nz.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{007A4500-95BB-485F-BA69-2CD1B09ED391}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\WINDOWSUPDATE\\AU\"; Key: \"NOAUTOUPDATE\"; Value: \"01000000\")","id":"registry-24","level":"malicious","mitre_attack_id":"T1112","name":"Modifies Windows Auto-Updates feature","origin":"Registry Access","relevance":9,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to create a new HTTP request (API string)\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Contains ability to create a HTTP or FTP session (API string)\n Matched sigs: Contacts server\n Matched sigs: Contacts domains\n Matched sigs: Spawned process connects to a network\n Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)","id":"summary-31","level":"informative","mitre_attack_id":"T1573.001","name":"Shows ability to use encryption for command and control traffic","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"\"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\IXP000.TMP (UID: 00000000-00002988)\n \"HB8Ri19.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\IXP001.TMP (UID: 00000000-00006560)\n \"ao2FE12.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\IXP002.TMP (UID: 00000000-00008952)\n \"Qj7GR07.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\IXP003.TMP (UID: 00000000-00006196)\n \"3on26Nz.exe\" called \"CreateDirectoryA\" with parameter %LOCALAPPDATA%\\RageMP131 (UID: 00000000-00009036)\n \"3on26Nz.exe\" called \"CreateDirectoryA\" with parameter %ALLUSERSPROFILE%\\MPGPH131 (UID: 00000000-00009036)","id":"api-122","level":"informative","mitre_attack_id":"T1074.001","name":"Calls an API typically used to create a directory","origin":"API Call","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"General","description":"$7e","id":"string-625","level":"informative","mitre_attack_id":"T1083","name":"References Windows file paths for DLLs (possible dropped files)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"Found string \"syswow64\\wbem\\wmiprvse.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp\")\n Found string \"system32\\wbem\\wmiprvse.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00002988.00000001.144989.032E0000.00000004.mdmp, 00000000-00002988.00000002.146910.032E0000.00000004.mdmp\")","id":"string-30","level":"suspicious","mitre_attack_id":"T1047","name":"Contains references to WMI/WMIC","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00004320.00000000.143308.0096C000.00000002.mdmp\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00006196.00000000.143256.0122A000.00000002.mdmp\")","id":"string-162","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve volume information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"System Security","description":"$7f","id":"registry-67","level":"informative","mitre_attack_id":"T1543.003","name":"Creates or modifies windows services","origin":"Registry Access","relevance":10,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"$80","id":"registry-77","level":"malicious","mitre_attack_id":"T1562.001","name":"Tries to disable Windows defender via registry","origin":"Registry Access","relevance":7,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; File: \"00000000-00004412.00000000.144519.00F82000.00000040.mdmp\")\n Found reference to API \"OpenService\" (Indicator: \"OpenService\"; File: \"00000000-00004412.00000000.144519.00F82000.00000040.mdmp\")\n Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; Source: \"00000000-00004412.00000000.144519.00F82000.00000040.mdmp\")\n Found reference to API \"OpenService\" (Indicator: \"OpenService\"; Source: \"00000000-00004412.00000000.144519.00F82000.00000040.mdmp\")","id":"string-544","level":"informative","mitre_attack_id":"T1569.002","name":"Contains ability to open a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$81","id":"api-222","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve OS information","origin":"API Call","relevance":2,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"System Security","description":"\"3on26Nz.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{007A4500-95BB-485F-BA69-2CD1B09ED391}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SYSTEM\"; Key: \"ENABLESMARTSCREEN\"; Value: \"00000000\")\n \"3on26Nz.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\GROUP POLICY OBJECTS\\{007A4500-95BB-485F-BA69-2CD1B09ED391}MACHINE\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SYSTEM\"; Key: \"**DEL.SHELLSMARTSCREENLEVEL\"; Value: \"20000000\")","id":"registry-148","level":"malicious","mitre_attack_id":"T1484.001","name":"Modifies Group policy settings registry keys","origin":"Registry Access","relevance":5,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$82","id":"string-365","level":"informative","mitre_attack_id":"T1029","name":"Contains ability to perform scheduled transfer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6831bc119e5f12d4570e6bec","report_type":"sandbox"}]}],"stats":{"attributions":{"campaigns_count":0,"cves_count":0,"malware_families_count":1,"threat_actors_count":0,"threat_types_count":0},"av":{"malicious_count":13,"suspicious_count":0,"total_engines":25},"mitre_attacks":{"total":102},"rule_matches":{"sigma_count":0,"suricata_count":0,"yara_count":0},"sandbox_signatures":{"informative_count":249,"malicious_count":16,"suspicious_count":19,"total":284}},"summary":{"score":100,"tags":["evasive"],"verdict":"malicious"}},"metadata":{"file_info":{"file_name":"file.exe","file_size":5202432,"file_type":["peexe","executable"],"file_type_id":"exe"},"hashes":{"imphash":"646167cce332c1c252cdcb1839e0cf48","md5":"9ffdb37177de3e04a48a989cd072dff1","sha1":"50d2acc6557c6c8ad46f962d1513cfa55f193c2e","sha256":"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919","sha512":"05ebcc318b7dc5f8979917da2c84e3efeef636a2c33693d6d75a82461f3ce92a1577c8f7a251b0b8fed6210747c13c508319381cfe3ab05e958cf3aa56d01b1b","ssdeep":"98304:s5Dn92RV8yMS1WSxhg8oSrFGg+5CQhm4ybCmU15OcNOQ8x7eR:gQUVgWSLgorFGbXhJOCH7OGsx","ssdeep_chunks":["98304:s5Dn92R","98304:5Dn92RV","98304:Dn92RV8","98304:n92RV8y","98304:92RV8yM","98304:2RV8yMS","98304:RV8yMS1","98304:V8yMS1W","98304:8yMS1WS","98304:yMS1WSx","98304:MS1WSxh","98304:S1WSxhg","98304:1WSxhg8","98304:WSxhg8o","98304:Sxhg8oS","98304:xhg8oSr","98304:hg8oSrF","98304:g8oSrFG","98304:8oSrFGg","98304:oSrFGg+","98304:SrFGg+5","98304:rFGg+5C","98304:FGg+5CQ","98304:Gg+5CQh","98304:g+5CQhm","98304:+5CQhm4","98304:5CQhm4y","98304:CQhm4yb","98304:Qhm4ybC","98304:hm4ybCm","98304:m4ybCmU","98304:4ybCmU1","98304:ybCmU15","98304:bCmU15O","98304:CmU15Oc","98304:mU15OcN","98304:U15OcNO","98304:15OcNOQ","98304:5OcNOQ8","98304:OcNOQ8x","98304:cNOQ8x7","98304:NOQ8x7e","98304:OQ8x7eR","196608:s5Dn92R","196608:5Dn92RV","196608:Dn92RV8","196608:n92RV8y","196608:92RV8yM","196608:2RV8yMS","196608:RV8yMS1","196608:V8yMS1W","196608:8yMS1WS","196608:yMS1WSx","196608:MS1WSxh","196608:S1WSxhg","196608:1WSxhg8","196608:WSxhg8o","196608:Sxhg8oS","196608:xhg8oSr","196608:hg8oSrF","196608:g8oSrFG","196608:8oSrFGg","196608:oSrFGg+","196608:SrFGg+5","196608:rFGg+5C","196608:FGg+5CQ","196608:Gg+5CQh","196608:g+5CQhm","196608:+5CQhm4","196608:5CQhm4y","196608:CQhm4yb","196608:Qhm4ybC","196608:hm4ybCm","196608:m4ybCmU","196608:4ybCmU1","196608:ybCmU15","196608:bCmU15O","196608:CmU15Oc","196608:mU15OcN","196608:U15OcNO","196608:15OcNOQ","196608:5OcNOQ8","196608:OcNOQ8x","196608:cNOQ8x7","196608:NOQ8x7e","196608:OQ8x7eR","98304:gQUVgWS","98304:QUVgWSL","98304:UVgWSLg","98304:VgWSLgo","98304:gWSLgor","98304:WSLgorF","98304:SLgorFG","98304:LgorFGb","98304:gorFGbX","98304:orFGbXh","98304:rFGbXhJ","98304:FGbXhJO","98304:GbXhJOC","98304:bXhJOCH","98304:XhJOCH7","98304:hJOCH7O","98304:JOCH7OG","98304:OCH7OGs","98304:CH7OGsx"]},"submissions":{"first_seen":1704977715000,"last_multi_scan":1748089874000,"last_seen":1748089874000}},"overall_status":"SUCCESS","report_ids":{"sandbox_job_ids":["6831bc119e5f12d4570e6bec"]},"schema_version":"1.0.9","sha256":"52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919","threat_score":100,"unified_at":"2026-09-16T19:49:39.777Z","unified_at_epoch_ms":1789588179777,"verdict":"malicious"}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Crifi.Generic Sample 52dd30e29abf… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 52dd30e29abf…. Malware family: Crifi.Generic. Threat score 100/100. 13/25 AV engines flagged this file. 16 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919"}],["$","meta","4",{"property":"og:title","content":"Malicious Crifi.Generic Sample 52dd30e29abf… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 52dd30e29abf…. Malware family: Crifi.Generic. Threat score 100/100. 13/25 AV engines flagged this file. 16 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/52dd30e29abf61d4e6ea0ca34e23649fe98c73d6529c5b5253825660f0d0f919"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Crifi.Generic Sample 52dd30e29abf… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 52dd30e29abf…. Malware family: Crifi.Generic. Threat score 100/100. 13/25 AV engines flagged this file. 16 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L83","11",{}]]