34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 86:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T426,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample 698ba27e47db… — Score 35/100 — Hybrid Analysis","description":"Suspicious verdict for sample 698ba27e47db…. Threat score 35/100. 0/24 AV engines flagged this file. 1 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d"],"about":{"@type":"SoftwareApplication","name":"AdvancedIPScanner.msi","applicationCategory":["msi","data"],"identifier":"698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d","additionalType":"Suspicious sample"},"threatScore":35,"antivirusDetections":{"malicious":0,"total":24},"behavioralIndicators":{"malicious":1,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T890,Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000002.228446.7396D000.00000002.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000002.228446.7396D000.00000002.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00003460.00000002.228446.7396D000.00000002.mdmp")37:T459,"Advanced_IP_Scanner_2.5.4594.1.exe" called "FindResourceW" with parameter "11111" - (UID: 00000000-00006340) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "FindResourceW" with parameter "42323676" - (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "FindResourceW" with parameter "42284020" - (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "FindResourceW" with parameter "56428972" - (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "FindResourceW" with parameter "5101352" - (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "FindResourceW" with parameter "42326124" - (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "FindResourceW" with parameter "50160420" - (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "FindResourceW" with parameter "42326220" - (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "FindResourceW" with parameter "50160660" - (UID: 00000000-00003460) "node.exe" called "FindResourceA" with parameter "2856201993088" - (UID: 00000000-00004172)38:T1137,Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found reference to API "NtSignalAndWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003460.00000000.224609.00401000.00000020.mdmp, 00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.7396D000.00000002.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000002.228446.7396D000.00000002.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.7396D000.00000002.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.7396D000.00000002.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00003460.00000002.228446.7396D000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003460.00000002.228446.7396D000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00003460.00000002.228446.7396D000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00003460.00000002.228446.7396D000.00000002.mdmp")39:Tb05,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000000.224609.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.02750000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.02750000.00000004.mdmp, 00000000-00003460.00000002.228446.7396D000.00000002.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.02750000.00000004.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000000.224609.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.02750000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.02750000.00000004.mdmp, 00000000-00003460.00000002.228446.7396D000.00000002.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00510000.00000002.mdmp, 00000000-00003460.00000003.232202.02750000.00000004.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.7396D000.00000002.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003460.00000002.228446.7396D000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003460.00000003.232202.00510000.00000002.mdmp")3a:Tb02,"msiexec.exe" queried SystemProcessInformation at 00000000-00002540-00000C15-1963601710 [PID: 2540] "msiexec.exe" queried SystemProcessInformation at 00000000-00002540-00000C15-1963608211 [PID: 2540] "Advanced_IP_Scanner_2.5.4594.1.exe" queried SystemProcessInformation at 00000000-00006340-00000C15-1966476918 [PID: 6340] "Advanced_IP_Scanner_2.5.4594.1.exe" queried SystemProcessInformation at 00000000-00006340-00000C15-1966483271 [PID: 6340] "Advanced_IP_Scanner_2.5.4594.1.exe" queried SystemProcessInformation at 00000000-00006340-00000C15-1966801965 [PID: 6340] "Advanced_IP_Scanner_2.5.4594.1.exe" queried SystemProcessInformation at 00000000-00006340-00000C15-1966808239 [PID: 6340] "Advanced_IP_Scanner_2.5.4594.1.exe" queried SystemProcessInformation at 00000000-00006340-00000C15-1967072007 [PID: 6340] "Advanced_IP_Scanner_2.5.4594.1.exe" queried SystemProcessInformation at 00000000-00006340-00000C15-1967078474 [PID: 6340] "Advanced_IP_Scanner_2.5.4594.1.exe" queried SystemProcessInformation at 00000000-00006340-00000C15-1967490918 [PID: 6340] "Advanced_IP_Scanner_2.5.4594.1.exe" queried SystemProcessInformation at 00000000-00006340-00000C15-1967497294 [PID: 6340] "Advanced_IP_Scanner_2.5.4594.1.tmp" queried SystemProcessInformation at 00000000-00003460-00000C15-1968988888 [PID: 3460] "Advanced_IP_Scanner_2.5.4594.1.tmp" queried SystemProcessInformation at 00000000-00003460-00000C15-1968995236 [PID: 3460] "Advanced_IP_Scanner_2.5.4594.1.tmp" queried SystemProcessInformation at 00000000-00003460-00000C15-1969247429 [PID: 3460] "Advanced_IP_Scanner_2.5.4594.1.tmp" queried SystemProcessInformation at 00000000-00003460-00000C15-1969254053 [PID: 3460] "Advanced_IP_Scanner_2.5.4594.1.tmp" queried SystemProcessInformation at 00000000-00003460-00000C15-1974832965 [PID: 3460] "Advanced_IP_Scanner_2.5.4594.1.tmp" queried SystemProcessInformation at 00000000-00003460-00000C15-1974839303 [PID: 3460] "node.exe" queried SystemProcessInformation at 00000000-00004172-00000C15-1970982982 [PID: 4172] "node.exe" queried SystemProcessInformation at 00000000-00004172-00000C15-1970989995 [PID: 4172] "node.exe" queried SystemProcessInformation at 00000000-00004172-00000C15-1971509978 [PID: 4172] "node.exe" queried SystemProcessInformation at 00000000-00004172-00000C15-1971517051 [PID: 4172] "node.exe" queried SystemProcessInformation at 00000000-00004172-00000C15-1972764150 [PID: 4172] "node.exe" queried SystemProcessInformation at 00000000-00004172-00000C15-1972770460 [PID: 4172] "node.exe" queried SystemProcessInformation at 00000000-00004172-00000C15-1973128674 [PID: 4172] "node.exe" queried SystemProcessInformation at 00000000-00004172-00000C15-1973135227 [PID: 4172] "node.exe" queried SystemProcessInformation at 00000000-00004172-00000C15-1973455366 [PID: 4172]3b:T420,Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004172-00000C2C-1972909032") Found reference to API "BCryptGenerateKeyPair" (Indicator: "BCryptGenerateKeyPair"; Source: "00000000-00004172-00000C2C-1972983440") Found reference to API "BCryptImportKeyPair" (Indicator: "BCryptImportKey"; Source: "00000000-00004172-00000C2C-1976016083") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00004172-00000C2C-1976165822") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004172-00000C2C-1976249942") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00004172-00000C2C-1976551986") Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "00000000-00004172-00000C2C-1976658076") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00004172-00000C2C-1978640262")3c:Tcf7,Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00003460-27305-169-004AE038 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00003460-27305-435-004D5400 Assembly shows XOR instruction xor dword ptr [eax] eax in Stream UID: 00000000-00003460-27305-946-004E2888 Assembly shows XOR instruction xor dx cx in Stream UID: 00000000-00003460-27305-961-004AAA60 Assembly shows XOR instruction xor edx ebx in Stream UID: 00000000-00003460-27305-961-004AAA60 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00003460-27305-1090-004CE214 Assembly shows XOR instruction xor al 8Ah in Stream UID: 00000000-00003460-27305-1413-004A5C00 Assembly shows XOR instruction xor byte ptr [edi+00h] al in Stream UID: 00000000-00003460-27305-1567-00481160 Assembly shows XOR instruction xor dword ptr [edi+00h] eax in Stream UID: 00000000-00003460-27305-1567-00481160 Assembly shows XOR instruction xor eax dword ptr [esi+00h] in Stream UID: 00000000-00003460-27305-1567-00481160 Assembly shows XOR instruction xor byte ptr [esi] ch in Stream UID: 00000000-00003460-27305-1567-00481160 Assembly shows XOR instruction xor al 46h in Stream UID: 00000000-00003460-27305-1567-00481160 Assembly shows XOR instruction xor al 69h in Stream UID: 00000000-00003460-27305-1567-00481160 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00003460-27305-1657-004331E0 Assembly shows XOR instruction xor al 00h in Stream UID: 00000000-00003460-27305-1688-0047041C Assembly shows XOR instruction xor ah 01h in Stream UID: 00000000-00003460-27305-1843-004571BA Assembly shows XOR instruction xor al 76h in Stream UID: 00000000-00003460-27305-2486-004375F4 Assembly shows XOR instruction xor cl dh in Stream UID: 00000000-00003460-27305-2495-0042F490 Assembly shows XOR instruction xor byte ptr [edx] 41h in Stream UID: 00000000-00003460-27305-2664-0041329C Assembly shows XOR instruction xor ebx ecx in Stream UID: 00000000-00003460-27305-2664-0041329C Assembly shows XOR instruction xor al byte ptr [ebp-01h] in Stream UID: 00000000-00003460-27305-2713-004136B4 Assembly shows XOR instruction xor bl 01h in Stream UID: 00000000-00003460-27305-3141-0042A46C Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00003460-27305-3219-00433F84 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00003460-27305-3273-004359A0 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00003460-27305-3355-0047CEB0 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00003460-27305-3543-00458630 Assembly shows XOR instruction xor al byte ptr [edx+000000B8h] in Stream UID: 00000000-00003460-27305-3559-00458278 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00003460-27305-3928-004727C8 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00003460-27305-3956-00474314 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00003460-27305-4057-0047BFB0 Assembly shows XOR instruction xor bl 01h in Stream UID: 00000000-00003460-27305-4513-004B7788 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00003460-27305-4513-004B7788 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00003460-27305-4635-004C38F03d:T4fc9,Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "CryptoAPI/10" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "Keep" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC2g6%2FINQymOI%2F7ORlOCUsJ HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "User" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC2g6%2FINQymOI%2F7ORlOCUsJ HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "CryptoAPI/10" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC2g6%2FINQymOI%2F7ORlOCUsJ HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "ocsp" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC2g6%2FINQymOI%2F7ORlOCUsJ HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEQCQrAhyIP3Fp8RrXMcN9z0G HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "2BTDManQQU9ndq3T" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEQCQrAhyIP3Fp8RrXMcN9z0G HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "Keep" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEQCQrAhyIP3Fp8RrXMcN9z0G HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "User" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEQCQrAhyIP3Fp8RrXMcN9z0G HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "CryptoAPI/10" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEQCQrAhyIP3Fp8RrXMcN9z0G HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "ocsp" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEQCQrAhyIP3Fp8RrXMcN9z0G HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "2Ff8i6MV" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSAYR8YRRAaQhWyHV9gpA%2FKam%2FS4QQUOnSlDGfGQlDC%2FbX8x7spNIL0erkCEQDnTvJVsFBP%2Btum3%2Ff8i6MV HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "Keep" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSAYR8YRRAaQhWyHV9gpA%2FKam%2FS4QQUOnSlDGfGQlDC%2FbX8x7spNIL0erkCEQDnTvJVsFBP%2Btum3%2Ff8i6MV HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "User" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSAYR8YRRAaQhWyHV9gpA%2FKam%2FS4QQUOnSlDGfGQlDC%2FbX8x7spNIL0erkCEQDnTvJVsFBP%2Btum3%2Ff8i6MV HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "CryptoAPI/10" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSAYR8YRRAaQhWyHV9gpA%2FKam%2FS4QQUOnSlDGfGQlDC%2FbX8x7spNIL0erkCEQDnTvJVsFBP%2Btum3%2Ff8i6MV HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "ocsp" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSAYR8YRRAaQhWyHV9gpA%2FKam%2FS4QQUOnSlDGfGQlDC%2FbX8x7spNIL0erkCEQDnTvJVsFBP%2Btum3%2Ff8i6MV HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "POST" in header "POST / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.37 (KHTML, like Gecko) Chrome/111.3.7.22 Safari/537.37Host: machinegirl.carvelpolman.workers.devContent-Length: 66Cache-Control: no-cache" Contains base64 string in header "like" in header "POST / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.37 (KHTML, like Gecko) Chrome/111.3.7.22 Safari/537.37Host: machinegirl.carvelpolman.workers.devContent-Length: 66Cache-Control: no-cache" Contains base64 string in header "carvelpolman" in header "POST / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.37 (KHTML, like Gecko) Chrome/111.3.7.22 Safari/537.37Host: machinegirl.carvelpolman.workers.devContent-Length: 66Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.37 (KHTML, like Gecko) Chrome/111.3.7.22 Safari/537.37Host: machinegirl.carvelpolman.workers.devContent-Length: 78Cache-Control: no-cache" Contains base64 string in header "like" in header "POST / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.37 (KHTML, like Gecko) Chrome/111.3.7.22 Safari/537.37Host: machinegirl.carvelpolman.workers.devContent-Length: 78Cache-Control: no-cache" Contains base64 string in header "carvelpolman" in header "POST / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.37 (KHTML, like Gecko) Chrome/111.3.7.22 Safari/537.37Host: machinegirl.carvelpolman.workers.devContent-Length: 78Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST /youtubei/v1/like/like HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonAccept-Language: en-US,en;q=0.9Referer: https://mystrdc.com/watch?v=DKGnCg7jK3sOrigin: https://mystrdc.comContent-Length: 2497Host: bluepeak.normanitavo.workers.dev" Contains base64 string in header "Keep" in header "POST /youtubei/v1/like/like HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonAccept-Language: en-US,en;q=0.9Referer: https://mystrdc.com/watch?v=DKGnCg7jK3sOrigin: https://mystrdc.comContent-Length: 2497Host: bluepeak.normanitavo.workers.dev" Contains base64 string in header "AliveContent" in header "POST /youtubei/v1/like/like HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonAccept-Language: en-US,en;q=0.9Referer: https://mystrdc.com/watch?v=DKGnCg7jK3sOrigin: https://mystrdc.comContent-Length: 2497Host: bluepeak.normanitavo.workers.dev" Contains base64 string in header "Type" in header "POST /youtubei/v1/like/like HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonAccept-Language: en-US,en;q=0.9Referer: https://mystrdc.com/watch?v=DKGnCg7jK3sOrigin: https://mystrdc.comContent-Length: 2497Host: bluepeak.normanitavo.workers.dev" Contains base64 string in header "Language" in header "POST /youtubei/v1/like/like HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonAccept-Language: en-US,en;q=0.9Referer: https://mystrdc.com/watch?v=DKGnCg7jK3sOrigin: https://mystrdc.comContent-Length: 2497Host: bluepeak.normanitavo.workers.dev" Contains base64 string in header "9Referer" in header "POST /youtubei/v1/like/like HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonAccept-Language: en-US,en;q=0.9Referer: https://mystrdc.com/watch?v=DKGnCg7jK3sOrigin: https://mystrdc.comContent-Length: 2497Host: bluepeak.normanitavo.workers.dev" Contains base64 string in header "2497Host" in header "POST /youtubei/v1/like/like HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonAccept-Language: en-US,en;q=0.9Referer: https://mystrdc.com/watch?v=DKGnCg7jK3sOrigin: https://mystrdc.comContent-Length: 2497Host: bluepeak.normanitavo.workers.dev" Contains base64 string in header "bluepeak" in header "POST /youtubei/v1/like/like HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonAccept-Language: en-US,en;q=0.9Referer: https://mystrdc.com/watch?v=DKGnCg7jK3sOrigin: https://mystrdc.comContent-Length: 2497Host: bluepeak.normanitavo.workers.dev" Contains base64 string in header "Keep" in header "GET /watch?v=blIXru4gcOw HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Cookie: YSC=fbpQFdCbj4L; SOCS=CAESEwgDEgk0OTk3NTk3NzUaAmVuIAEaBgiA_LyaBg; VISITOR_PRIVACY_METADATA=-l7jaAFkAwAfAAAATs6p5QAAAABwIN5esCIsWXmZ-yuRsP6ii-5Mu-IeerrE0gKh8YIEeiN87oRCJ7dbX9OyYH66LkNIrNC1RsXCbQSS5Sxz7Vst9WT-8CKmeQ; __Secure-1PSIDTS=sidts-FFAreA7; HSID=h7tnnkCHYYG; SID=Es0c62fslY8Sec-Ch-Ua: "Not.A/Brand";v="99", "Chromium";v="136"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentUpgrade-Insecure-Requests: 1Host: cedar-stone.normanitavo.workers.dev" Contains base64 string in header "Language" in header "GET /watch?v=blIXru4gcOw HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Cookie: YSC=fbpQFdCbj4L; SOCS=CAESEwgDEgk0OTk3NTk3NzUaAmVuIAEaBgiA_LyaBg; VISITOR_PRIVACY_METADATA=-l7jaAFkAwAfAAAATs6p5QAAAABwIN5esCIsWXmZ-yuRsP6ii-5Mu-IeerrE0gKh8YIEeiN87oRCJ7dbX9OyYH66LkNIrNC1RsXCbQSS5Sxz7Vst9WT-8CKmeQ; __Secure-1PSIDTS=sidts-FFAreA7; HSID=h7tnnkCHYYG; SID=Es0c62fslY8Sec-Ch-Ua: "Not.A/Brand";v="99", "Chromium";v="136"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentUpgrade-Insecure-Requests: 1Host: cedar-stone.normanitavo.workers.dev" Contains base64 string in header "CAESEwgDEgk0OTk3NTk3NzUaAmVuIAEaBgiA" in header "GET /watch?v=blIXru4gcOw HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Cookie: YSC=fbpQFdCbj4L; SOCS=CAESEwgDEgk0OTk3NTk3NzUaAmVuIAEaBgiA_LyaBg; VISITOR_PRIVACY_METADATA=-l7jaAFkAwAfAAAATs6p5QAAAABwIN5esCIsWXmZ-yuRsP6ii-5Mu-IeerrE0gKh8YIEeiN87oRCJ7dbX9OyYH66LkNIrNC1RsXCbQSS5Sxz7Vst9WT-8CKmeQ; __Secure-1PSIDTS=sidts-FFAreA7; HSID=h7tnnkCHYYG; SID=Es0c62fslY8Sec-Ch-Ua: "Not.A/Brand";v="99", "Chromium";v="136"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentUpgrade-Insecure-Requests: 1Host: cedar-stone.normanitavo.workers.dev" Contains base64 string in header "yuRsP6ii" in header "GET /watch?v=blIXru4gcOw HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Cookie: YSC=fbpQFdCbj4L; SOCS=CAESEwgDEgk0OTk3NTk3NzUaAmVuIAEaBgiA_LyaBg; VISITOR_PRIVACY_METADATA=-l7jaAFkAwAfAAAATs6p5QAAAABwIN5esCIsWXmZ-yuRsP6ii-5Mu-IeerrE0gKh8YIEeiN87oRCJ7dbX9OyYH66LkNIrNC1RsXCbQSS5Sxz7Vst9WT-8CKmeQ; __Secure-1PSIDTS=sidts-FFAreA7; HSID=h7tnnkCHYYG; SID=Es0c62fslY8Sec-Ch-Ua: "Not.A/Brand";v="99", "Chromium";v="136"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentUpgrade-Insecure-Requests: 1Host: cedar-stone.normanitavo.workers.dev" Contains base64 string in header "Chromium" in header "GET /watch?v=blIXru4gcOw HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Cookie: YSC=fbpQFdCbj4L; SOCS=CAESEwgDEgk0OTk3NTk3NzUaAmVuIAEaBgiA_LyaBg; VISITOR_PRIVACY_METADATA=-l7jaAFkAwAfAAAATs6p5QAAAABwIN5esCIsWXmZ-yuRsP6ii-5Mu-IeerrE0gKh8YIEeiN87oRCJ7dbX9OyYH66LkNIrNC1RsXCbQSS5Sxz7Vst9WT-8CKmeQ; __Secure-1PSIDTS=sidts-FFAreA7; HSID=h7tnnkCHYYG; SID=Es0c62fslY8Sec-Ch-Ua: "Not.A/Brand";v="99", "Chromium";v="136"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentUpgrade-Insecure-Requests: 1Host: cedar-stone.normanitavo.workers.dev" Contains base64 string in header "0Sec" in header "GET /watch?v=blIXru4gcOw HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Cookie: YSC=fbpQFdCbj4L; SOCS=CAESEwgDEgk0OTk3NTk3NzUaAmVuIAEaBgiA_LyaBg; VISITOR_PRIVACY_METADATA=-l7jaAFkAwAfAAAATs6p5QAAAABwIN5esCIsWXmZ-yuRsP6ii-5Mu-IeerrE0gKh8YIEeiN87oRCJ7dbX9OyYH66LkNIrNC1RsXCbQSS5Sxz7Vst9WT-8CKmeQ; __Secure-1PSIDTS=sidts-FFAreA7; HSID=h7tnnkCHYYG; SID=Es0c62fslY8Sec-Ch-Ua: "Not.A/Brand";v="99", "Chromium";v="136"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentUpgrade-Insecure-Requests: 1Host: cedar-stone.normanitavo.workers.dev" Contains base64 string in header "Platform" in header "GET /watch?v=blIXru4gcOw HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Cookie: YSC=fbpQFdCbj4L; SOCS=CAESEwgDEgk0OTk3NTk3NzUaAmVuIAEaBgiA_LyaBg; VISITOR_PRIVACY_METADATA=-l7jaAFkAwAfAAAATs6p5QAAAABwIN5esCIsWXmZ-yuRsP6ii-5Mu-IeerrE0gKh8YIEeiN87oRCJ7dbX9OyYH66LkNIrNC1RsXCbQSS5Sxz7Vst9WT-8CKmeQ; __Secure-1PSIDTS=sidts-FFAreA7; HSID=h7tnnkCHYYG; SID=Es0c62fslY8Sec-Ch-Ua: "Not.A/Brand";v="99", "Chromium";v="136"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentUpgrade-Insecure-Requests: 1Host: cedar-stone.normanitavo.workers.dev" Contains base64 string in header "Site" in header "GET /watch?v=blIXru4gcOw HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Cookie: YSC=fbpQFdCbj4L; SOCS=CAESEwgDEgk0OTk3NTk3NzUaAmVuIAEaBgiA_LyaBg; VISITOR_PRIVACY_METADATA=-l7jaAFkAwAfAAAATs6p5QAAAABwIN5esCIsWXmZ-yuRsP6ii-5Mu-IeerrE0gKh8YIEeiN87oRCJ7dbX9OyYH66LkNIrNC1RsXCbQSS5Sxz7Vst9WT-8CKmeQ; __Secure-1PSIDTS=sidts-FFAreA7; HSID=h7tnnkCHYYG; SID=Es0c62fslY8Sec-Ch-Ua: "Not.A/Brand";v="99", "Chromium";v="136"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentUpgrade-Insecure-Requests: 1Host: cedar-stone.normanitavo.workers.dev" Contains base64 string in header "Mode" in header "GET /watch?v=blIXru4gcOw HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Cookie: YSC=fbpQFdCbj4L; SOCS=CAESEwgDEgk0OTk3NTk3NzUaAmVuIAEaBgiA_LyaBg; VISITOR_PRIVACY_METADATA=-l7jaAFkAwAfAAAATs6p5QAAAABwIN5esCIsWXmZ-yuRsP6ii-5Mu-IeerrE0gKh8YIEeiN87oRCJ7dbX9OyYH66LkNIrNC1RsXCbQSS5Sxz7Vst9WT-8CKmeQ; __Secure-1PSIDTS=sidts-FFAreA7; HSID=h7tnnkCHYYG; SID=Es0c62fslY8Sec-Ch-Ua: "Not.A/Brand";v="99", "Chromium";v="136"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentUpgrade-Insecure-Requests: 1Host: cedar-stone.normanitavo.workers.dev" Contains base64 string in header "User" in header "GET /watch?v=blIXru4gcOw HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Cookie: YSC=fbpQFdCbj4L; SOCS=CAESEwgDEgk0OTk3NTk3NzUaAmVuIAEaBgiA_LyaBg; VISITOR_PRIVACY_METADATA=-l7jaAFkAwAfAAAATs6p5QAAAABwIN5esCIsWXmZ-yuRsP6ii-5Mu-IeerrE0gKh8YIEeiN87oRCJ7dbX9OyYH66LkNIrNC1RsXCbQSS5Sxz7Vst9WT-8CKmeQ; __Secure-1PSIDTS=sidts-FFAreA7; HSID=h7tnnkCHYYG; SID=Es0c62fslY8Sec-Ch-Ua: "Not.A/Brand";v="99", "Chromium";v="136"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentUpgrade-Insecure-Requests: 1Host: cedar-stone.normanitavo.workers.dev" Contains base64 string in header "1Sec" in header "GET /watch?v=blIXru4gcOw HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Cookie: YSC=fbpQFdCbj4L; SOCS=CAESEwgDEgk0OTk3NTk3NzUaAmVuIAEaBgiA_LyaBg; VISITOR_PRIVACY_METADATA=-l7jaAFkAwAfAAAATs6p5QAAAABwIN5esCIsWXmZ-yuRsP6ii-5Mu-IeerrE0gKh8YIEeiN87oRCJ7dbX9OyYH66LkNIrNC1RsXCbQSS5Sxz7Vst9WT-8CKmeQ; __Secure-1PSIDTS=sidts-FFAreA7; HSID=h7tnnkCHYYG; SID=Es0c62fslY8Sec-Ch-Ua: "Not.A/Brand";v="99", "Chromium";v="136"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentUpgrade-Insecure-Requests: 1Host: cedar-stone.normanitavo.workers.dev" Contains base64 string in header "Dest" in header "GET /watch?v=blIXru4gcOw HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Cookie: YSC=fbpQFdCbj4L; SOCS=CAESEwgDEgk0OTk3NTk3NzUaAmVuIAEaBgiA_LyaBg; VISITOR_PRIVACY_METADATA=-l7jaAFkAwAfAAAATs6p5QAAAABwIN5esCIsWXmZ-yuRsP6ii-5Mu-IeerrE0gKh8YIEeiN87oRCJ7dbX9OyYH66LkNIrNC1RsXCbQSS5Sxz7Vst9WT-8CKmeQ; __Secure-1PSIDTS=sidts-FFAreA7; HSID=h7tnnkCHYYG; SID=Es0c62fslY8Sec-Ch-Ua: "Not.A/Brand";v="99", "Chromium";v="136"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentUpgrade-Insecure-Requests: 1Host: cedar-stone.normanitavo.workers.dev" Contains base64 string in header "Insecure" in header "GET /watch?v=blIXru4gcOw HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Cookie: YSC=fbpQFdCbj4L; SOCS=CAESEwgDEgk0OTk3NTk3NzUaAmVuIAEaBgiA_LyaBg; VISITOR_PRIVACY_METADATA=-l7jaAFkAwAfAAAATs6p5QAAAABwIN5esCIsWXmZ-yuRsP6ii-5Mu-IeerrE0gKh8YIEeiN87oRCJ7dbX9OyYH66LkNIrNC1RsXCbQSS5Sxz7Vst9WT-8CKmeQ; __Secure-1PSIDTS=sidts-FFAreA7; HSID=h7tnnkCHYYG; SID=Es0c62fslY8Sec-Ch-Ua: "Not.A/Brand";v="99", "Chromium";v="136"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentUpgrade-Insecure-Requests: 1Host: cedar-stone.normanitavo.workers.dev" Contains base64 string in header "Requests" in header "GET /watch?v=blIXru4gcOw HTTP/1.1Connection: Keep-AliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.9Cookie: YSC=fbpQFdCbj4L; SOCS=CAESEwgDEgk0OTk3NTk3NzUaAmVuIAEaBgiA_LyaBg; VISITOR_PRIVACY_METADATA=-l7jaAFkAwAfAAAATs6p5QAAAABwIN5esCIsWXmZ-yuRsP6ii-5Mu-IeerrE0gKh8YIEeiN87oRCJ7dbX9OyYH66LkNIrNC1RsXCbQSS5Sxz7Vst9WT-8CKmeQ; __Secure-1PSIDTS=sidts-FFAreA7; HSID=h7tnnkCHYYG; SID=Es0c62fslY8Sec-Ch-Ua: "Not.A/Brand";v="99", "Chromium";v="136"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentUpgrade-Insecure-Requests: 1Host: cedar-stone.normanitavo.workers.dev"3e:T682,Found XOR loop in file "aips_is_install_dll.dll" at offset 142709; code bytes = 30d0 Found XOR loop in file "aips_is_install_dll.dll" at offset 143103; code bytes = 30d0 Found XOR loop in file "aips_is_install_dll.dll" at offset 16097; code bytes = 33c1 Found XOR loop in file "aips_is_install_dll.dll" at offset 17790; code bytes = 33c1 Found XOR loop in file "aips_is_install_dll.dll" at offset 144990; code bytes = 8030 Found XOR loop in file "aips_is_install_dll.dll" at offset 146320; code bytes = 8030 Found XOR loop in file "aips_is_install_dll.dll" at offset 151503; code bytes = 8030 Found XOR loop in file "Advanced_IP_Scanner_2.5.4594.1.tmp" at offset 198812; code bytes = 8030 Found XOR loop in file "Advanced_IP_Scanner_2.5.4594.1.tmp" at offset 238891; code bytes = 8030 Found XOR loop in file "Advanced_IP_Scanner_2.5.4594.1.tmp" at offset 256609; code bytes = 8030 Found XOR loop in file "Advanced_IP_Scanner_2.5.4594.1.tmp" at offset 258788; code bytes = 8030 Found XOR loop in file "Advanced_IP_Scanner_2.5.4594.1.tmp" at offset 749523; code bytes = 8030 Found XOR loop in file "Advanced_IP_Scanner_2.5.4594.1.tmp" at offset 774554; code bytes = 8030 Found XOR loop in file "Advanced_IP_Scanner_2.5.4594.1.tmp" at offset 802212; code bytes = 8030 Found XOR loop in file "Advanced_IP_Scanner_2.5.4594.1.tmp" at offset 860185; code bytes = 8030 Found XOR loop in file "Advanced_IP_Scanner_2.5.4594.1.tmp" at offset 933405; code bytes = 8030 Found XOR loop in file "Advanced_IP_Scanner_2.5.4594.1.tmp" at offset 949377; code bytes = 8030 Found XOR loop in file "Advanced_IP_Scanner_2.5.4594.1.tmp" at offset 1087654; code bytes = 80303f:T4f8,file/memory contains long string with (Indicator: "GetCommandLine"; File: "aips_is_install_dll.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "_setup64.tmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00510000.00000002.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp")40:T492,Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\{BB39586C-D77A-4BC4-BBD8-F13B1E0EC26C}_is1" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00003460.00000000.224609.03320000.00000004.mdmp, 00000000-00003460.00000001.226527.03320000.00000004.mdmp, 00000000-00003460.00000003.232202.03320000.00000004.mdmp")41:T909,Found system information discovery API: "GetMonitorInfoA" in file "00000000-00003460.00000000.224609.00401000.00000020.mdmp" Found system information discovery API: "GetMonitorInfoW" in file "00000000-00003460.00000000.224609.00401000.00000020.mdmp" Found system information discovery API: "GetNativeSystemInfo" in file "00000000-00003460.00000000.224609.00401000.00000020.mdmp" Found system information discovery API: "ExpandEnvironmentStringsA" in file "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in file "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp" Found system information discovery API: "GetMonitorInfoA" in "00000000-00003460.00000000.224609.00401000.00000020.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00003460.00000000.224609.00401000.00000020.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00003460.00000000.224609.00401000.00000020.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.00510000.00000002.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosErrorNoTeb" in "00000000-00003460.00000002.228446.73911000.00000020.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00003460.00000002.228446.7396D000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsA" in "00000000-00003460.00000003.232202.00510000.00000002.mdmp"42:T58d,Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "00000000-00006340.00000003.232176.00401000.00000020.mdmp") Found reference to API "GetKeyboardType" (Indicator: "GetKeyboardType"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp") Found reference to API "GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000002.228446.7396D000.00000002.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; Source: "00000000-00003460.00000003.232202.00510000.00000002.mdmp")43:T15fb,file/memory contains long string with (Indicator: "sendmessage"; File: "aips_is_install_dll.dll") Found reference to API "FINDWINDOWBYCLASSNAME" (Indicator: "findwindow"; File: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found reference to API "FINDWINDOWBYWINDOWNAME" (Indicator: "findwindow"; File: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found reference to API "SENDMESSAGE" (Indicator: "sendmessage"; File: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found reference to API "POSTMESSAGE" (Indicator: "postmessage"; File: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found reference to API "function FindWindowByClassName(const ClassName: String): HWND;" (Indicator: "findwindow"; Source: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found reference to API "function FindWindowByWindowName(const WindowName: String): HWND;" (Indicator: "findwindow"; Source: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found reference to API "function SendMessage(const Wnd: HWND; const Msg, WParam, LParam: Longint): Longint;" (Indicator: "sendmessage"; Source: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found reference to API "function PostMessage(const Wnd: HWND; const Msg, WParam, LParam: Longint): Boolean;" (Indicator: "postmessage"; Source: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found reference to API "FINDWINDOWBYCLASSNAME" (Indicator: "findwindow"; Source: "00000000-00003460.00000000.224609.00401000.00000020.mdmp, 00000000-00003460.00000001.226527.035A0000.00000004.mdmp, 00000000-00003460.00000002.228446.035A0000.00000004.mdmp, 00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found reference to API "FINDWINDOWBYWINDOWNAME" (Indicator: "findwindow"; Source: "00000000-00003460.00000000.224609.00401000.00000020.mdmp, 00000000-00003460.00000001.226527.035A0000.00000004.mdmp, 00000000-00003460.00000002.228446.035A0000.00000004.mdmp, 00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found reference to API "SENDMESSAGE" (Indicator: "sendmessage"; Source: "00000000-00003460.00000000.224609.00401000.00000020.mdmp, 00000000-00003460.00000000.224609.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.035A0000.00000004.mdmp, 00000000-00003460.00000002.228446.02750000.00000004.mdmp, 00000000-00003460.00000002.228446.035A0000.00000004.mdmp, 00000000-00003460.00000003.232202.02750000.00000004.mdmp, 00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found reference to API "POSTMESSAGE" (Indicator: "postmessage"; Source: "00000000-00003460.00000000.224609.00401000.00000020.mdmp, 00000000-00003460.00000001.226527.035A0000.00000004.mdmp, 00000000-00003460.00000002.228446.035A0000.00000004.mdmp, 00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.7396D000.00000002.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.7396D000.00000002.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp") Found reference to API "FindWindowW" (Indicator: "findwindow"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp") Found reference to API "InSendMessageEx" (Indicator: "sendmessage"; Source: "00000000-00003460.00000002.228446.7396D000.00000002.mdmp")44:T677,"Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetWindowTextW" with parameter "Select the language to use during the installation:" - (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetWindowTextW" with parameter "4f004b00" - (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetWindowTextW" with parameter "&Cancel" - (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetWindowTextW" with parameter "Welcome to the Advanced IP Scanner 2.5.1 Setup Wizard" - (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetWindowTextW" with parameter "Specify whether you want to install Advanced IP Scanner 2.5.1 or just run it" - (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetWindowTextW" with parameter "&Advanced settings" - (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetWindowTextW" with parameter "Run portable version (no installation needed)" - (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetWindowTextW" with parameter "&Run" - (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetWindowTextW" with parameter "Program will be installed. For advanced settings set "Advanced settings" checkbox." - (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetWindowTextW" with parameter "&Install" - (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetWindowTextW" with parameter "Select action:" - (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetWindowTextW" with parameter "&Next >" - (UID: 00000000-00003460)45:T2d92,"Advanced_IP_Scanner_2.5.4594.1.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006340) "Advanced_IP_Scanner_2.5.4594.1.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005d97e55f70fe1900cfe2f87500002b7664fe1900000000006cfe1900000000000af4bb741f000000641141000000000013001400641141005900887784fe190014842c76200000005c3a4000a4fe19006b3a40009cfe1900b0f37e02586a4000016e4000b0f37e02d4fe190026984000c8fe19000d3a40001f00000088114100d0a940000e2e4000216140000e000000 (UID: 00000000-00006340) "Advanced_IP_Scanner_2.5.4594.1.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000b48f3300b8f8190065098b771200000000000000d06cfa750200000018065500b48f3300d8f8190065098b771200000000000000d06cfa75f0b9737612000000ecf81900ae2e88770200000000000000d06cfa75fcf81900e16cfa75020000000000000024f919006820b67502000000000000002afe2bae70927b760000000064f91900201bbb75ffffffff74f919005810b6753c10b6757afe2bae70927b769cb97376f0b9737654f9190050f919000d0000000d000000504197767cc8d076000000004041977670f91900e8f91900608db9754612f0dbfeffffff80f91900900fb6755041977690f9190006258a767cc8d076504197769cf91900 (UID: 00000000-00006340) "Advanced_IP_Scanner_2.5.4594.1.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006340) "Advanced_IP_Scanner_2.5.4594.1.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006340) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbd258a7bcfe1900cfe2f87500002b76b0fe190000000000b8fe1900000000000af4bb749100000064e14f00000000001300140059008877c0eb2d76d0fe190014842c762000000048454000f0fe190057454000e8fe1900b0f38402c8a3400001ab4000b0f3840220ff19001a19410014ff1900f94440009100000088e14f00a033410022304000a98640000d000000 (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000000001cf6d6c0c4c6f63616c650000000000000000000000000000000000000000000000000000010000000000000000010000000300000004000000010000000000000001cf6d6c0c4c435479706500000000000000000000000000000000000000000000000000003fb1d810bcfe19008bc1be74010000000cff1900280f4100090400000c000000a8fe1900020000002c000000f8fe19003e304000c652400088e14f000904000071314100793141000d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020ff1900f1e14f00 (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000027d258a790fe1900cfe2f8750000537584fe1900000000008cfe1900000000000af4bb7491000000ccf784020000000015001600ccf7840259008877a4fe190014842c7600005375ccf784020af4bb74efd258a7e4fe19002af4bb74000000004bb1d810000053754c3a48000000537500000000ccf7840200000000306e2c7600000000f4fe190075c3be74010000000cff190060feec763e3040009d52400008ff1900629640006a96400090e84f00000053750000000044ff190060394800000053754c3a48004f000000 (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000027d258a790fe1900cfe2f8750000537584fe1900000000008cfe1900000000000af4bb7491000000ccf784020000000015001600ccf7840259008877a4fe190014842c7600005375ccf784020af4bb74efd258a7e4fe19002af4bb74000000004bb1d810000053754c3a48000000537500000000ccf7840200000000306e2c7600000000f4fe190075c3be74010000000cff190060feec763e3040009d52400008ff1900629640006a96400090e84f00000053750000000044ff190060394800 (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000008233a870ecfb1900000000009cfe1900e018c574fa2f7804feffffff1cfe1900c650867750fd1900e8fb7200e8fb72000000000009508677030000000000c575065186770000000050fe19007c9d8302000000000000000000000000000000000af4bb7409000000000000002074c8757c9d83020000000009000000e8fb7200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000000000000000000000000000000063d258a754fe1900cfe2f8750000c57548fe19000000000050fe1900000000000af4bb74910000007c9d8302000000000f001000590088772074c87568fe190014842c760000c5757c9d83022fd258a7a8fe1900a8fe19002af4bb743d01000007b1d8100000c575fc534e000000c575000000007c9d830200000000306e2c763d010000b8fe190075c3be7401000000d0fe19002074c8753e3040009d524000ccfe1900629640006a96400000dd2c7600002b760000000020ff19000b534e000000c575fc534e0001000000090000000010000000000100fffffeffff00000008000000d8210000000001000600004f (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000001900c656867748f61900000000008875770000000000887577000074887748f619000000000088757700e0f61900ec748877ac7577002cf71900000000002f7588777a6fa77378000000000000001c040000000000007a6fa773000000002e009f73f8f6190000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ff000000a10300000000000000000000008000000000000000000000000000000000000000000000000000001c040000000000007a6fa773000000002e009f73f8f61900b02586779fda58a7f4f6190080738877b5020000750000007a6fa77334f71900 (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000000000000000b2520000b2520000182d720067d77700182d7200000000000000000038f51900b0e889770703d2d0feffffffe0f4190002cb8677e8020000f00200001c047200b0f4190040000000000072000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000f002000000000000000000005e00000000000000e80200000800100000007200000000000000000000000000fcf41900feba8677080010000000000000000000906fc5730000000048f51900b52cfb750000720008001000e802000075091d294000000000000000 (UID: 00000000-00003460) "node.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004172) "node.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000003d0599020000e8de3f14b500000030bb6b3ef77f0000f43d043bf77f0000000000000000000028000000000000000a000000000000000000493ef77f00002800000000000000172e003bf77f00002f0455d676f00000284e380599020000902b3d0599020000e8de3f14b5000000284e3805990200009055b838f77f000000000000000000002a420f8cfb7f0000d06de10299020000000000000000000000101a3ef77f0000304e380599020000906d380599020000c0494d3d990200000040300599020000204e380599020000906d3805990200000040300599020000304e380599020000906d380599020000284e380599020000c0494d3d99020000 (UID: 00000000-00004172) "node.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004172) "node.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004172)46:T4a7,GetVersionExW@KERNEL32.DLL at 00000000-00003460-27305-69-004123B0 GetVersion@KERNEL32.DLL at 00000000-00003460-27305-77-004FE000 GetVersion@KERNEL32.DLL at 00000000-00003460-27305-78-00408DD4 GetVersion@KERNEL32.DLL at 00000000-00003460-27305-914-004CB3D8 GetVersion@KERNEL32.DLL at 00000000-00003460-27305-1112-004B8070 GetVersion@KERNEL32.DLL at 00000000-00003460-27305-3458-0044D8D0 GetVersion@KERNEL32.DLL at 00000000-00003460-27305-4073-0047F2E8 GetVersion@KERNEL32.DLL at 00000000-00003460-27305-4078-0047FAC0 GetVersionExW@KERNEL32.DLL at 00000000-00003460-27305-4297-004A4714 GetVersion@KERNEL32.DLL at 00000000-00003460-27305-4573-004BEC60 GetVersion@KERNEL32.DLL at 00000000-00003460-27305-4575-004BEDC8 GetVersion@KERNEL32.DLL at 00000000-00003460-27305-5130-004FE754 GetVersionExW@KERNEL32.DLL at 00000000-00003460-27305-5137-004E56A4 GetVersion@KERNEL32.DLL at 00000000-00003460-27305-6699-004BED1C GetVersion@KERNEL32.DLL at 00000000-00003460-27305-6700-004BEB1C GetVersion@KERNEL32.DLL at 00000000-00003460-27305-6887-004A9B00 GetVersion@KERNEL32.DLL at 00000000-00003460-27305-9878-004A8520 GetVersionExW@KERNEL32.DLL at 00000000-00003460-27305-9951-004FE93747:T91e,Found reference to API "function FindWindowByClassName(const ClassName: String): HWND;" (Indicator: "FindWindow"; Source: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found reference to API "function FindWindowByWindowName(const WindowName: String): HWND;" (Indicator: "FindWindow"; Source: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000002.228446.7396D000.00000002.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp") Found reference to API "235882,5724,109,,GetWindowTextW,user32.dll,"00:58:57.140",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00003460.00000001.226527.00720000.00000004.mdmp") Found reference to API "88318532852,5724,109,,GetWindowTextW,user32.dll,"01:00:25.343",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00003460.00000003.232202.06EF0000.00000004.mdmp")48:Tb42,Observed string: "ver mindst [mb] MB ledig diskplads." (Indicator: "ver ") in Source: 00000000-00003460.00000000.224609.035A0000.00000004.mdmp 00000000-00003460.00000001.226527.035A0000.00000004.mdmp 00000000-00003460.00000002.228446.035A0000.00000004.mdmp 00000000-00003460.00000003.232202.035A0000.00000004.mdmp Observed string: "ver mindst %1 KB ledig diskplads for at kunne installere programmet, men det valgte drev har kun %2 KB ledig diskplads." (Indicator: "ver ") in Source: 00000000-00003460.00000000.224609.035A0000.00000004.mdmp 00000000-00003460.00000001.226527.035A0000.00000004.mdmp 00000000-00003460.00000002.228446.035A0000.00000004.mdmp 00000000-00003460.00000003.232202.035A0000.00000004.mdmp Observed string: "ver %1 med Service Pack %2 eller senere." (Indicator: "ver ") in Source: 00000000-00003460.00000000.224609.035A0000.00000004.mdmp 00000000-00003460.00000001.226527.035A0000.00000004.mdmp 00000000-00003460.00000002.228446.035A0000.00000004.mdmp 00000000-00003460.00000003.232202.035A0000.00000004.mdmp Observed string: "ver %1 version %2 eller senere." (Indicator: "ver ") in Source: 00000000-00003460.00000000.224609.035A0000.00000004.mdmp 00000000-00003460.00000001.226527.035A0000.00000004.mdmp 00000000-00003460.00000002.228446.035A0000.00000004.mdmp 00000000-00003460.00000003.232202.035A0000.00000004.mdmp Observed string: "Ver %1" (Indicator: "ver ") in Source: 00000000-00003460.00000001.226527.030A0000.00000004.mdmp Observed string: "ver n" (Indicator: "ver ") in Source: 00000000-00003460.00000002.228446.031E0000.00000004.mdmp Observed string: "ver minst [mb] MB diskutrymme." (Indicator: "ver ") in Source: 00000000-00003460.00000002.228446.031E0000.00000004.mdmp Observed string: "ver minst [mb] MB h" (Indicator: "ver ") in Source: 00000000-00003460.00000002.228446.031E0000.00000004.mdmp Observed string: "ver" (Indicator: "ver") in Source: 00000000-00003460.00000002.228446.031E0000.00000004.mdmp Observed string: "ver uppdatera." (Indicator: "ver ") in Source: 00000000-00003460.00000002.228446.031E0000.00000004.mdmp Observed string: "ver denna fil, eller v" (Indicator: "ver ") in Source: 00000000-00003460.00000002.228446.031E0000.00000004.mdmp Observed string: "ver denna fil (ej rekommenderat), eller v" (Indicator: "ver ") in Source: 00000000-00003460.00000002.228446.031E0000.00000004.mdmp Observed string: "ver den?" (Indicator: "ver ") in Source: 00000000-00003460.00000002.228446.031E0000.00000004.mdmp Observed string: "ver f" (Indicator: "ver ") in Source: 00000000-00003460.00000002.228446.031E0000.00000004.mdmp Observed string: "ver %1 Service Pack %2 eller nyare." (Indicator: "ver ") in Source: 00000000-00003460.00000002.228446.031E0000.00000004.mdmp Observed string: "ver %1, version %2 eller senare." (Indicator: "ver ") in Source: 00000000-00003460.00000002.228446.031E0000.00000004.mdmp49:T94b,Found reference to API "ISCryptGetVersion" (Indicator: "GetVersion"; File: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found reference to API "ISCryptGetVersion" (Indicator: "GetVersion"; Source: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00003460.00000000.224609.00401000.00000020.mdmp, 00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00003460.00000000.224609.00401000.00000020.mdmp, 00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp") Found reference to API "function GetVersionNumbers(const Filename: String; var VersionMS, VersionLS: Cardinal): Boolean;" (Indicator: "GetVersion"; Source: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found reference to API "function GetVersionNumbersString(const Filename: String; var Version: String): Boolean;" (Indicator: "GetVersion"; Source: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003460.00000002.228446.7396D000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003460.00000002.228446.7396D000.00000002.mdmp") Found reference to API "DllGetVersion" (Indicator: "GetVersion"; Source: "00000000-00003460.00000003.232202.00510000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00003460.00000003.232202.00510000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00003460.00000003.232202.00510000.00000002.mdmp")4a:T83f,Found API call GetVersion@KERNEL32.DLL directly followed by "cmp edx, 05h" and "jne 00408DF3h" at 00000000-00003460-27305-78-00408DD4 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 00000601h" and "jc 004CB447h" at 00000000-00003460-27305-914-004CB3D8 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jnc 004B80A7h" at 00000000-00003460-27305-1112-004B8070 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp al, 04h" and "jc 0044DAF0h" at 00000000-00003460-27305-3458-0044D8D0 Found API call GetKeyboardLayout@USER32.DLL directly followed by "cmp ebx, dword ptr [00501A9Ch]" and "je 004523EAh" at 00000000-00003460-27305-3504-004523BC Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 0047F343h" at 00000000-00003460-27305-4073-0047F2E8 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jc 0047FB3Fh" at 00000000-00003460-27305-4078-0047FAC0 Found API call GetDiskFreeSpaceW@KERNEL32.DLL directly followed by "cmp byte ptr [ebp-02h], 00h" and "je 004B0181h" at 00000000-00003460-27305-4438-004B0070 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jnc 004BECD3h" at 00000000-00003460-27305-4573-004BEC60 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 004BEE43h" at 00000000-00003460-27305-4575-004BEDC8 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp al, 04h" and "setnb byte ptr [005090E0h]" at 00000000-00003460-27305-5130-004FE754 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 004BED97h" at 00000000-00003460-27305-6699-004BED1C Found API call GetVersion@KERNEL32.DLL directly followed by "cmp dx, 0005h" and "jne 004BEBA3h" at 00000000-00003460-27305-6700-004BEB1C Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 004A9BBDh" at 00000000-00003460-27305-6887-004A9B00 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jne 004A85CCh" at 00000000-00003460-27305-9878-004A85204b:T8d5,"node.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "node.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "node.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{37255216-02EF-44F9-8AED-5DC539DF48FB}"; Key: "SEARCHLIST"; Value: "") "node.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{37255216-02EF-44F9-8AED-5DC539DF48FB}"; Key: "DOMAIN"; Value: "") "node.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{37255216-02EF-44F9-8AED-5DC539DF48FB}"; Key: "DHCPDOMAIN"; Value: "") "node.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "node.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "node.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "node.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{47E2A11A-1F71-4949-AADD-6B479BDC0801}"; Key: "SEARCHLIST"; Value: "") "node.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{47E2A11A-1F71-4949-AADD-6B479BDC0801}"; Key: "DOMAIN"; Value: "") "node.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{47E2A11A-1F71-4949-AADD-6B479BDC0801}"; Key: "DHCPDOMAIN"; Value: "") "node.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "SEARCHLIST"; Value: "") "node.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "DHCPDOMAIN"; Value: "")4c:T445,Found reference to API "LookupPrivilegeNameA" (Indicator: "LookupPrivilegeNameA"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.7396D000.00000002.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp")4d:T576,"node.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "node.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "node.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "node.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "node.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "node.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "node.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "node.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "node.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "node.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "node.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "node.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "node.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "node.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")4e:T1751,"Advanced_IP_Scanner_2.5.4594.1.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\NodeJS\Advanced_IP_Scanner_2.5.4594.1.ENU (UID: 00000000-00006340) "Advanced_IP_Scanner_2.5.4594.1.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\NodeJS\Advanced_IP_Scanner_2.5.4594.1.EN (UID: 00000000-00006340) "Advanced_IP_Scanner_2.5.4594.1.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006340) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "LoadLibrary" with a parameter %TEMP%\is-Q7D1E.tmp\Advanced_IP_Scanner_2.5.4594.1.ENU (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "LoadLibrary" with a parameter %TEMP%\is-Q7D1E.tmp\Advanced_IP_Scanner_2.5.4594.1.EN (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "LoadLibrary" with a parameter DWMAPI.DLL (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "LoadLibrary" with a parameter Rstrtmgr.dll (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "LoadLibrary" with a parameter msi.dll (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "LoadLibrary" with a parameter %TEMP%\is-IFJ1R.tmp\aips_is_install_dll.dll (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shlwapi.dll (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "LoadLibrary" with a parameter MSFTEDIT.DLL (UID: 00000000-00003460) "node.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\NodeJS\koffi.node (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter api-ms-win-crt-convert-l1-1-0.dll (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter api-ms-win-crt-heap-l1-1-0.dll (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter api-ms-win-crt-math-l1-1-0.dll (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter api-ms-win-crt-private-l1-1-0.dll (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter api-ms-win-crt-stdio-l1-1-0.dll (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter api-ms-win-crt-string-l1-1-0.dll (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter api-ms-win-crt-time-l1-1-0.dll (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter api-ms-win-crt-utility-l1-1-0.dll (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00004172) "node.exe" called "LoadLibrary" with a parameter Advapi32 (UID: 00000000-00004172)4f:Te255,"Advanced_IP_Scanner_2.5.4594.1.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006340) "Advanced_IP_Scanner_2.5.4594.1.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006340) "Advanced_IP_Scanner_2.5.4594.1.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006340) "Advanced_IP_Scanner_2.5.4594.1.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006340) "Advanced_IP_Scanner_2.5.4594.1.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006340) "Advanced_IP_Scanner_2.5.4594.1.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006340) "Advanced_IP_Scanner_2.5.4594.1.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006340) "Advanced_IP_Scanner_2.5.4594.1.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006340) "Advanced_IP_Scanner_2.5.4594.1.exe" called "GetProcAddress" with a parameter SetDllDirectoryW (UID: 00000000-00006340) "Advanced_IP_Scanner_2.5.4594.1.exe" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00006340) "Advanced_IP_Scanner_2.5.4594.1.exe" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00006340) "Advanced_IP_Scanner_2.5.4594.1.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00006340) "Advanced_IP_Scanner_2.5.4594.1.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00006340) "Advanced_IP_Scanner_2.5.4594.1.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00006340) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter SetDllDirectoryW (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter WINNLSEnableIME (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter ImmGetConversionStatus (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter ImmSetConversionStatus (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter ImmSetOpenStatus (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter ImmSetCompositionWindow (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter ImmSetCompositionFontW (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter SHPathPrepareForWriteW (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter SHCreateItemFromParsingName (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter VerSetConditionMask (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter VerifyVersionInfoW (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryA (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter RegDeleteKeyExA (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter DisableProcessWindowsGhosting (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonDestroy (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonCreate (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter DwmExtendFrameIntoClientArea (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter RmRegisterResources (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter RmShutdown (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter RmRestart (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter RmEndSession (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter MsiEnumRelatedProductsW (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter MsiGetProductInfoW (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter MsiSetInternalUI (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter MsiEnableLogW (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter MsiInstallProductW (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter MsiOpenDatabaseW (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter MsiDatabaseOpenViewW (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter MsiViewExecute (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter MsiViewFetch (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter MsiRecordReadStream (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter MsiCloseHandle (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter SHGetSpecialFolderPathW (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetLongPathNameW (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter lstrcmpiW (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter MoveFileW (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter MsiSetExternalUIW (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter EnableMenuItem (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter RemoveMenu (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter GetMenuItemCount (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter InstallMsi_Start (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter InstallMsi_Continue (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter InstallMsi_GetFinishedInfo (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter InstallMsi_GetInstallMessageUserInfo (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter InstallMsi_SetInstallMessageUserResult (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter InstallMsi_GetProgressInfo (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter InstallMsi_GetInstallMessageError (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter SelectFolderDlg (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter CheckProcesses (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter MessageBoxLang (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter CabExtractInplace (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter SHAutoComplete (UID: 00000000-00003460) "Advanced_IP_Scanner_2.5.4594.1.tmp" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00003460) "node.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter RtlNtStatusToDosError (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter NtDeviceIoControlFile (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter NtQueryInformationFile (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter NtSetInformationFile (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter NtQueryVolumeInformationFile (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter NtQueryDirectoryFile (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter SetWinEventHook (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetHostNameW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetFileInformationByName (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetThreadDescription (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter VirtualAlloc2 (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter MapViewOfFile3 (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter UnmapViewOfFile2 (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter RtlAddGrowableFunctionTable (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter RtlDeleteGrowableFunctionTable (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter node_register_module_v147 (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_register_module_v1 (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter node_api_module_get_api_version_v1 (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_create_string_utf8 (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_run_script (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_coerce_to_bool (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_get_value_bool (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_create_object (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_create_function (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_call_function (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_get_cb_info (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_get_node_version (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_get_version (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter node_api_create_property_key_utf8 (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter node_api_create_object_with_properties (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_set_instance_data (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_create_double (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_add_finalizer (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_set_named_property (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_create_int32 (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_get_value_string_utf8 (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_create_reference (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_typeof (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_define_class (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_create_symbol (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_get_reference_value (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_get_instance_data (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_create_external (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_open_escapable_handle_scope (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_new_instance (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_get_new_target (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_wrap (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_get_value_external (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_is_exception_pending (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_escape_handle (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_close_escapable_handle_scope (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_type_tag_object (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_get_boolean (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_object_freeze (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_create_bigint_uint64 (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_add_env_cleanup_hook (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_unwrap (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_create_array_with_length (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_get_value_int64 (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_get_value_bigint_uint64 (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_create_uint32 (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_create_external_arraybuffer (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_get_arraybuffer_info (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_set_element (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_check_object_type_tag (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter napi_get_buffer_info (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter BCryptGenerateKeyPair (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter BCryptFinalizeKeyPair (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter BCryptExportKey (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter InternetOpenA (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter InternetConnectA (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter HttpOpenRequestA (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter HttpSendRequestA (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter InternetCloseHandle (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter BCryptImportKeyPair (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter BCryptSecretAgreement (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter BCryptCloseAlgorithmProvider (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter BCryptDeriveKey (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter BCryptDestroySecret (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter BCryptHash (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter BCryptSetProperty (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter BCryptGenerateSymmetricKey (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter BCryptEncrypt (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter BCryptDecrypt (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidA (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter CreateProcessWithTokenW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter ImpersonateLoggedOnUser (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter LogonUserA (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter LookupAccountSidA (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter LookupPrivilegeNameA (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueA (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter RevertToSelf (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter CreateDIBSection (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter CreateDirectoryA (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter CreateMutexA (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter CreatePipe (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter CreateRemoteThread (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter DeleteProcThreadAttributeList (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter DisableThreadLibraryCalls (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter ExitThread (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsA (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter FileTimeToSystemTime (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter FormatMessageA (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetComputerNameExW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetExitCodeThread (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetFileTime (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetFullPathNameA (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetWindowsDirectoryA (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter MoveFileW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter OpenThread (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter PeekNamedPipe (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter RemoveDirectoryW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter RemoveVectoredExceptionHandler (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter RtlAddFunctionTable (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter RtlDeleteFunctionTable (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter SetHandleInformation (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter SystemTimeToFileTime (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter TerminateThread (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter Thread32First (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter Thread32Next (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter UpdateProcThreadAttribute (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter WaitForSingleObjectEx (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter WaitNamedPipeW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter lstrcmpiW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter strtol (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter calloc (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter realloc (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter cos (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter memchr (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter memmove (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter strchr (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter strrchr (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter __stdio_common_vsprintf (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter __stdio_common_vswprintf (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter _strdup (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter _stricmp (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter _strnicmp (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter _wcsicmp (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter isalnum (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter isspace (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter memset (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter strcat (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter strcmp (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter strcpy (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter strlen (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter strncmp (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter tolower (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter wcscmp (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter wcslen (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter _time64 (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter qsort (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter rand (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter SafeArrayAccessData (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter SafeArrayCreateVector (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter SafeArrayDestroy (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter SafeArrayPutElement (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter SafeArrayUnaccessData (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter SysAllocString (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter VariantClear (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter VariantInit (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter WinHttpAddRequestHeaders (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter WinHttpQueryDataAvailable (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter WSACleanup (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter connect (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter getsockname (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter htonl (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter htons (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter inet_ntoa (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter socket (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter RtlCreateTimerQueue (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter RtlDeleteTimerQueue (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter NtCreateEvent (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter RtlCreateTimer (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter RtlRegisterWait (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter NtSignalAndWaitForSingleObject (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter NtSetEvent (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter NtDuplicateObject (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter NtCreateThreadEx (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter NtGetContextThread (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter NtQueueApcThread (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter NtAlertResumeThread (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter NtTestAlert (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter NtWaitForSingleObject (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter NtSetInformationVirtualMemory (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter NtContinue (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter RtlCaptureContext (UID: 00000000-00004172) "node.exe" called "GetProcAddress" with a parameter SystemFunction032 (UID: 00000000-00004172)50:T66e,WaitForSingleObject@KERNEL32.DLL at 00000000-00003460-27305-190-004B3230 WaitForSingleObject@KERNEL32.DLL at 00000000-00003460-27305-978-0047A0E8 SetTimer at 00000000-00003460-27305-980-0047CE44 Sleep@KERNEL32.DLL at 00000000-00003460-27305-1010-00480920 MsgWaitForMultipleObjects at 00000000-00003460-27305-1116-004B34E0 Sleep@KERNEL32.DLL at 00000000-00003460-27305-2705-0040B868 WaitForSingleObject@KERNEL32.DLL at 00000000-00003460-27305-2706-0041387C Sleep@KERNEL32.DLL at 00000000-00003460-27305-2768-00402700 WaitForSingleObject@KERNEL32.DLL at 00000000-00003460-27305-3132-00429E68 WaitForSingleObject@KERNEL32.DLL at 00000000-00003460-27305-3141-0042A46C MsgWaitForMultipleObjectsEx at 00000000-00003460-27305-3304-0043771C WaitForSingleObject@KERNEL32.DLL at 00000000-00003460-27305-3319-00437D24 SetTimer at 00000000-00003460-27305-3427-0044A580 MsgWaitForMultipleObjects at 00000000-00003460-27305-3860-0042A6B0 Sleep@KERNEL32.DLL at 00000000-00003460-27305-3865-0046A208 Sleep@KERNEL32.DLL at 00000000-00003460-27305-3911-0047108C SetTimer at 00000000-00003460-27305-3988-0047CA48 WaitForSingleObject@KERNEL32.DLL at 00000000-00003460-27305-4032-00479FD4 MsgWaitForMultipleObjects at 00000000-00003460-27305-4425-004AEFD4 Sleep@KERNEL32.DLL at 00000000-00003460-27305-4430-004AF748 MsgWaitForMultipleObjects at 00000000-00003460-27305-4467-004B2548 Sleep@KERNEL32.DLL at 00000000-00003460-27305-4692-004C7FA8 MsgWaitForMultipleObjects at 00000000-00003460-27305-4713-004D7098 MsgWaitForMultipleObjects at 00000000-00003460-27305-4774-00480754 MsgWaitForMultipleObjects at 00000000-00003460-27305-4801-004D7A1451:T4f0,Found reference to API "MoveFileEx" (Indicator: "MoveFile"; File: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found reference to API "MoveFileEx failed (%d)." (Indicator: "MoveFile"; File: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found reference to API "MoveFile" (Indicator: "MoveFile"; File: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found reference to API "MoveFile" (Indicator: "MoveFile"; Source: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found reference to API "MoveFileEx" (Indicator: "MoveFile"; Source: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found reference to API "MoveFileEx failed (%d)." (Indicator: "MoveFile"; Source: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found reference to API "MoveFileW" (Indicator: "MoveFile"; Source: "00000000-00003460.00000000.224609.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.035A0000.00000004.mdmp, 00000000-00003460.00000002.228446.02750000.00000004.mdmp, 00000000-00003460.00000002.228446.035A0000.00000004.mdmp, 00000000-00003460.00000003.232202.02750000.00000004.mdmp, 00000000-00003460.00000003.232202.035A0000.00000004.mdmp")52:T6b1,Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00003460.00000002.228446.7396D000.00000002.mdmp")53:T420,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.7396D000.00000002.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.00510000.00000002.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.7396D000.00000002.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp")54:T1e38,"Software\CodeGear\Locales" in Source: 25412-70-00405DE8 "Software\Borland\Locales" in Source: 25412-70-00405DE8 "Software\Borland\Delphi\Locales" in Source: 25412-70-00405DE8 "SOFTWARE\Borland\Delphi\RTL" in Source: 25412-120-00403714 "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: 27305-367-00479488 "SOFTWARE\Microsoft\.NETFramework\Policy\v4.0" in Source: 27305-900-004B3F60 "SOFTWARE\Microsoft\.NETFramework\Policy\v2.0" in Source: 27305-900-004B3F60 "SOFTWARE\Microsoft\.NETFramework\Policy\v1.1" in Source: 27305-900-004B3F60 "SOFTWARE\Microsoft\.NETFramework" in Source: 27305-901-004B3E0C "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 27305-1002-004D856C "Software\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 27305-1075-004D1540 "Software\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: 27305-1106-004AE458 "SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: 27305-3289-00436E84 "\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\" in Source: 27305-3497-004521B4 "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 27305-4431-004AF7AC "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 27305-4727-004CC664 "Software\Microsoft\Windows\CurrentVersion" in Source: 27305-4816-004DCAC8 "System\CurrentControlSet\Control\Windows" in Source: 27305-4878-004E5438 "System\CurrentControlSet\Control\ProductOptions" in Source: 27305-4879-004E5514 "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: 27305-6698-004BEB43 "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 27305-6811-004D2B7E "@Software\Microsoft\Windows\CurrentVersion\Fonts" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp "Run key persistence installed: HKCU\...\Run\%ls -> %ls" in Source: 00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp "UserInit persistence installed: HKCU\Environment\%ls -> %ls" in Source: 00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp "Software\Borland\Locales" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Fonts" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v4.0" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v2.0" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v1.1" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "System\CurrentControlSet\Control\Windows" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003460.00000000.224609.00720000.00000004.mdmp "Software\famatech\advanced_ip_scanner" in Source: 00000000-00003460.00000000.224609.02750000.00000004.mdmp 00000000-00003460.00000001.226527.02750000.00000004.mdmp 00000000-00003460.00000002.228446.02750000.00000004.mdmp 00000000-00003460.00000003.232202.02750000.00000004.mdmp "Software\Famatech\" in Source: 00000000-00003460.00000000.224609.02750000.00000004.mdmp 00000000-00003460.00000001.226527.00720000.00000004.mdmp 00000000-00003460.00000001.226527.02750000.00000004.mdmp 00000000-00003460.00000001.226527.02F30000.00000004.mdmp 00000000-00003460.00000002.228446.00720000.00000004.mdmp 00000000-00003460.00000002.228446.02750000.00000004.mdmp 00000000-00003460.00000002.228446.02F30000.00000004.mdmp 00000000-00003460.00000003.232202.00720000.00000004.mdmp 00000000-00003460.00000003.232202.02750000.00000004.mdmp 00000000-00003460.00000003.232202.02F30000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\{BB39586C-D77A-4BC4-BBD8-F13B1E0EC26C}_is1" in Source: 00000000-00003460.00000000.224609.03320000.00000004.mdmp 00000000-00003460.00000001.226527.03320000.00000004.mdmp 00000000-00003460.00000003.232202.03320000.00000004.mdmp "Software\Famatech\advanced_ip_scanner" in Source: 00000000-00003460.00000001.226527.00720000.00000004.mdmp 00000000-00003460.00000001.226527.02750000.00000004.mdmp 00000000-00003460.00000002.228446.02750000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00003460.00000001.226527.00720000.00000004.mdmp 00000000-00003460.00000002.228446.00720000.00000004.mdmp 00000000-00003460.00000003.232202.00720000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00003460.00000001.226527.00720000.00000004.mdmp 00000000-00003460.00000002.228446.00720000.00000004.mdmp 00000000-00003460.00000003.232202.00720000.00000004.mdmp "Software\Microsoft\Input" in Source: 00000000-00003460.00000002.228446.73911000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" in Source: 00000000-00003460.00000002.228446.73911000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData" in Source: 00000000-00003460.00000002.228446.73911000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00003460.00000002.228446.73911000.00000020.mdmp "\par \hich\af39\dbch\af31505\loch\f39 Free Software\hich\af39\dbch\af31505\loch\f39 Foundation and other authors who decide to use it. You" in Source: 00000000-00003460.00000002.228446.7FE20000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00003460.00000003.232202.00510000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00003460.00000003.232202.00510000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003460.00000003.232202.00510000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\ProfileReconciliation" in Source: 00000000-00003460.00000003.232202.00510000.00000002.mdmp55:Taa6,Process msiexec.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3844:304:WilStaging_02" Process msiexec.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3844:304:WilStaging_02" Process msiexec.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3844:120:WilError_03" Process msiexec.exe created mutex with name "Local\SM0:3844:304:WilStaging_02" Process msiexec.exe created mutex with name "SM0:3844:304:WilStaging_02" Process msiexec.exe created mutex with name "SM0:3844:120:WilError_03" Process msiexec.exe created mutex with name "\BaseNamedObjects\_MSIExecute" Process msiexec.exe created mutex with name "\BaseNamedObjects\SM0:2540:304:WilStaging_02" Process msiexec.exe created mutex with name "\BaseNamedObjects\Local\SM0:2540:304:WilStaging_02" Process msiexec.exe created mutex with name "\BaseNamedObjects\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process msiexec.exe created mutex with name "\BaseNamedObjects\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process msiexec.exe created mutex with name "\BaseNamedObjects\SM0:2540:120:WilError_03" Process Advanced_IP_Scanner_2.5.4594.1.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6340:168:WilStaging_02" Process Advanced_IP_Scanner_2.5.4594.1.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6340:168:WilStaging_02" Process Advanced_IP_Scanner_2.5.4594.1.exe created mutex with name "Local\SM0:6340:168:WilStaging_02" Process Advanced_IP_Scanner_2.5.4594.1.exe created mutex with name "SM0:6340:168:WilStaging_02" Process Advanced_IP_Scanner_2.5.4594.1.tmp created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3460:168:WilStaging_02" Process Advanced_IP_Scanner_2.5.4594.1.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3460:168:WilStaging_02" Process Advanced_IP_Scanner_2.5.4594.1.tmp created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3460:64:WilError_03" Process Advanced_IP_Scanner_2.5.4594.1.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3460:64:WilError_03" Process Advanced_IP_Scanner_2.5.4594.1.tmp created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process Advanced_IP_Scanner_2.5.4594.1.tmp created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process Advanced_IP_Scanner_2.5.4594.1.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Advanced IP Scanner" Process Advanced_IP_Scanner_2.5.4594.1.tmp created mutex with name "Advanced IP Scanner" Process Advanced_IP_Scanner_2.5.4594.1.tmp created mutex with name "Local\SM0:3460:64:WilError_03"56:T2aa6,"Software\Borland\Locales" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Fonts" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v4.0" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v2.0" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v1.1" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "System\CurrentControlSet\Control\Windows" in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003460.00000000.224609.00720000.00000004.mdmp "Software\Famatech\" in Source: 00000000-00003460.00000000.224609.02750000.00000004.mdmp "Software\famatech\advanced_ip_scanner" in Source: 00000000-00003460.00000000.224609.02750000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\{BB39586C-D77A-4BC4-BBD8-F13B1E0EC26C}_is1" in Source: 00000000-00003460.00000000.224609.03320000.00000004.mdmp "Software\Famatech\advanced_ip_scanner" in Source: 00000000-00003460.00000001.226527.00720000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00003460.00000001.226527.00720000.00000004.mdmp "Software\Famatech\" in Source: 00000000-00003460.00000001.226527.00720000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00003460.00000001.226527.00720000.00000004.mdmp "Software\Famatech\" in Source: 00000000-00003460.00000001.226527.02750000.00000004.mdmp "Software\famatech\advanced_ip_scanner" in Source: 00000000-00003460.00000001.226527.02750000.00000004.mdmp "Software\Famatech\advanced_ip_scanner" in Source: 00000000-00003460.00000001.226527.02750000.00000004.mdmp "Software\Famatech\" in Source: 00000000-00003460.00000001.226527.02F30000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\{BB39586C-D77A-4BC4-BBD8-F13B1E0EC26C}_is1" in Source: 00000000-00003460.00000001.226527.03320000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00003460.00000002.228446.00720000.00000004.mdmp "Software\Famatech\" in Source: 00000000-00003460.00000002.228446.00720000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00003460.00000002.228446.00720000.00000004.mdmp "Software\Famatech\" in Source: 00000000-00003460.00000002.228446.02750000.00000004.mdmp "Software\famatech\advanced_ip_scanner" in Source: 00000000-00003460.00000002.228446.02750000.00000004.mdmp "Software\Famatech\advanced_ip_scanner" in Source: 00000000-00003460.00000002.228446.02750000.00000004.mdmp "Software\Famatech\" in Source: 00000000-00003460.00000002.228446.02F30000.00000004.mdmp "Software\Microsoft\Input" in Source: 00000000-00003460.00000002.228446.73911000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" in Source: 00000000-00003460.00000002.228446.73911000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData" in Source: 00000000-00003460.00000002.228446.73911000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00003460.00000002.228446.73911000.00000020.mdmp "\par \hich\af39\dbch\af31505\loch\f39 Free Software\hich\af39\dbch\af31505\loch\f39 Foundation and other authors who decide to use it. You" in Source: 00000000-00003460.00000002.228446.7FE20000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00003460.00000003.232202.00510000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00003460.00000003.232202.00510000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003460.00000003.232202.00510000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\ProfileReconciliation" in Source: 00000000-00003460.00000003.232202.00510000.00000002.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00003460.00000003.232202.00720000.00000004.mdmp "Software\Famatech\" in Source: 00000000-00003460.00000003.232202.00720000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00003460.00000003.232202.00720000.00000004.mdmp "Software\Famatech\" in Source: 00000000-00003460.00000003.232202.02750000.00000004.mdmp "Software\famatech\advanced_ip_scanner" in Source: 00000000-00003460.00000003.232202.02750000.00000004.mdmp "Software\Famatech\" in Source: 00000000-00003460.00000003.232202.02F30000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\{BB39586C-D77A-4BC4-BBD8-F13B1E0EC26C}_is1" in Source: 00000000-00003460.00000003.232202.03320000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4" in Source: 00000000-00004172.00000000.224701.3E08D000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00004172.00000000.224701.3E08D000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0" in Source: 00000000-00004172.00000000.224701.3E08D000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4" in Source: 00000000-00004172.00000001.226621.3E08D000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00004172.00000001.226621.3E08D000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0" in Source: 00000000-00004172.00000001.226621.3E08D000.00000004.mdmp "Run key persistence installed: HKCU\...\Run\%ls -> %ls" in Source: 00000000-00004172.00000001.226621.3E0C3000.00000004.mdmp "UserInit persistence installed: HKCU\Environment\%ls -> %ls" in Source: 00000000-00004172.00000001.226621.3E0C3000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00004172.00000001.226621.3E0C3000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004172.00000001.226621.3E0C3000.00000004.mdmp "Run key persistence installed: HKCU\...\Run\%ls -> %ls" in Source: 00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp "UserInit persistence installed: HKCU\Environment\%ls -> %ls" in Source: 00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp "SYSTEM\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4" in Source: 00000000-00004172.00000002.228541.3E08D000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00004172.00000002.228541.3E08D000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0" in Source: 00000000-00004172.00000002.228541.3E08D000.00000004.mdmp "Run key persistence installed: HKCU\...\Run\%ls -> %ls" in Source: 00000000-00004172.00000002.228541.3E0C3000.00000004.mdmp "UserInit persistence installed: HKCU\Environment\%ls -> %ls" in Source: 00000000-00004172.00000002.228541.3E0C3000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00004172.00000002.228541.3E0C3000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004172.00000002.228541.3E0C3000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4" in Source: 00000000-00004172.00000003.232205.3E08D000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00004172.00000003.232205.3E08D000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0" in Source: 00000000-00004172.00000003.232205.3E08D000.00000004.mdmp "Run key persistence installed: HKCU\...\Run\%ls -> %ls" in Source: 00000000-00004172.00000003.232205.3E0C3000.00000004.mdmp "UserInit persistence installed: HKCU\Environment\%ls -> %ls" in Source: 00000000-00004172.00000003.232205.3E0C3000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00004172.00000003.232205.3E0C3000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004172.00000003.232205.3E0C3000.00000004.mdmp "Software\Famatech\" in Source: 00000000-00006340.00000000.224462.026F0000.00000004.mdmp "\par \hich\af39\dbch\af31505\loch\f39 Free Software\hich\af39\dbch\af31505\loch\f39 Foundation and other authors who decide to use it. You" in Source: 00000000-00006340.00000001.226380.7FE20000.00000004.mdmp "Software\Borland\Locales" in Source: 00000000-00006340.00000003.232176.00401000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00006340.00000003.232176.00401000.00000020.mdmp57:T1c2a,"Advanced_IP_Scanner_2.5.4594.1.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74a80000 "Advanced_IP_Scanner_2.5.4594.1.exe" loaded module "SHELL32.DLL" at base 76710000 "Advanced_IP_Scanner_2.5.4594.1.exe" loaded module "COMCTL32.DLL" at base 752a0000 "Advanced_IP_Scanner_2.5.4594.1.exe" loaded module "KERNEL32.DLL" at base 762b0000 "Advanced_IP_Scanner_2.5.4594.1.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74d20000 "Advanced_IP_Scanner_2.5.4594.1.exe" loaded module "NTDLL.DLL" at base 77820000 "Advanced_IP_Scanner_2.5.4594.1.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74c20000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74a80000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "IMM32.DLL" at base 76190000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74d20000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "KERNEL32.DLL" at base 762b0000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "UXTHEME.DLL" at base 74d20000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "SHELL32.DLL" at base 76710000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "RPCRT4.DLL" at base 77310000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "COMCTL32" at base 752a0000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "COMCTL32.DLL" at base 752a0000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "DWMAPI.DLL" at base 748b0000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 764b0000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76220000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 75890000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 75890000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 75c50000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75530000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 748b0000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "SHFOLDER.DLL" at base 73d70000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "RSTRTMGR.DLL" at base 73d30000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75680000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "MSI.DLL" at base 739f0000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "USER32.DLL" at base 75890000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75e70000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75e70000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75e70000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "KERNEL32" at base 762b0000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "%TEMP%\IS-IFJ1R.TMP\AIPS_IS_INSTALL_DLL.DLL" at base 739c0000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "%WINDIR%\SYSTEM32\SHLWAPI.DLL" at base 75a40000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76710000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "%PROGRAMFILES%\(X86)\COMMON FILES\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 73910000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "MSFTEDIT.DLL" at base 73650000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "%WINDIR%\SYSTEM32\WINDOWS.GLOBALIZATION.DLL" at base 73500000 "Advanced_IP_Scanner_2.5.4594.1.tmp" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.DLL" at base 73370000 "node.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb61ed0000 "node.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb896e0000 "node.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb896e0000 "node.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ffb896e0000 "node.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb896e0000 "node.exe" loaded module "KERNEL32" at base 7ffb8ac70000 "node.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffb896e0000 "node.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffb896e0000 "node.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffb896e0000 "node.exe" loaded module "POWRPROF.DLL" at base 7ffb893a0000 "node.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ffb89a90000 "node.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffb86b00000 "node.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffb88990000 "node.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffb88490000 "node.exe" loaded module "KERNEL32.DLL" at base 7ffb8ac70000 "node.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffb88520000 "node.exe" loaded module "NTDLL.DLL" at base 7ffb8c0b0000 "node.exe" loaded module "%ALLUSERSPROFILE%\NODEJS\KOFFI.NODE" at base 7ffb606c0000 "node.exe" loaded module "RPCRT4.DLL" at base 7ffb8a250000 "node.exe" loaded module "USER32.DLL" at base 7ffb8aa20000 "node.exe" loaded module "BCRYPT.DLL" at base 7ffb88db0000 "node.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffb89a90000 "node.exe" loaded module "WININET.DLL" at base 7ffb72a20000 "node.exe" loaded module "SSPICLI.DLL" at base 7ffb88770000 "node.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 7ffb6bc10000 "node.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffb6bc10000 "node.exe" loaded module "WINHTTP.DLL" at base 7ffb821d0000 "node.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffb80910000 "node.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffb81860000 "node.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffb88390000 "node.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffb774c0000 "node.exe" loaded module "ADVAPI32.DLL" at base 7ffb8a1a0000 "node.exe" loaded module "GDI32.DLL" at base 7ffb8ac40000 "node.exe" loaded module "API-MS-WIN-CRT-CONVERT-L1-1-0.DLL" at base 7ffb89d90000 "node.exe" loaded module "API-MS-WIN-CRT-HEAP-L1-1-0.DLL" at base 7ffb89d90000 "node.exe" loaded module "API-MS-WIN-CRT-MATH-L1-1-0.DLL" at base 7ffb89d90000 "node.exe" loaded module "API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL" at base 7ffb89d90000 "node.exe" loaded module "API-MS-WIN-CRT-STDIO-L1-1-0.DLL" at base 7ffb89d90000 "node.exe" loaded module "API-MS-WIN-CRT-STRING-L1-1-0.DLL" at base 7ffb89d90000 "node.exe" loaded module "API-MS-WIN-CRT-TIME-L1-1-0.DLL" at base 7ffb89d90000 "node.exe" loaded module "API-MS-WIN-CRT-UTILITY-L1-1-0.DLL" at base 7ffb89d90000 "node.exe" loaded module "OLE32.DLL" at base 7ffb8a370000 "node.exe" loaded module "OLEAUT32.DLL" at base 7ffb8bdf0000 "node.exe" loaded module "SECUR32.DLL" at base 7ffb7e650000 "node.exe" loaded module "WS2_32.DLL" at base 7ffb8bad0000 "node.exe" loaded module "ADVAPI32" at base 7ffb8a1a000058:T60b,Process "msiexec.exe" (UID: 00000000-00002540) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PSModulePath, APPDATA, USERNAME, Path, PATHEXT, TEMP, USERPROFILE, TMP" Process "msiexec.exe" (UID: 00000000-00002540) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, PROMPT, OneDrive, EFC_5376, HOMEPATH, HOMEDRIVE" Process "Advanced_IP_Scanner_2.5.4594.1.exe" (UID: 00000000-00006340) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-8LD9T6N", LOGONSERVER="\\DESKTOP-8LD9T6N", OneDrive="%USERPROFILE%\OneDrive", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:"" Process "Advanced_IP_Scanner_2.5.4594.1.exe" (UID: 00000000-00006340) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP" Process "Advanced_IP_Scanner_2.5.4594.1.tmp" (UID: 00000000-00003460) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-8LD9T6N", PROCESSOR_ARCHITEW6432="AMD64"" Process "Advanced_IP_Scanner_2.5.4594.1.tmp" (UID: 00000000-00003460) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "node.exe" (UID: 00000000-00004172) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "node.exe" (UID: 00000000-00004172) was launched with missing environment variables: "USERDNSDOMAIN, PROCESSOR_ARCHITEW6432"59:T562,"Advanced_IP_Scanner_2.5.4594.1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Advanced_IP_Scanner_2.5.4594.1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Advanced_IP_Scanner_2.5.4594.1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Advanced_IP_Scanner_2.5.4594.1.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Advanced_IP_Scanner_2.5.4594.1.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Advanced_IP_Scanner_2.5.4594.1.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Advanced_IP_Scanner_2.5.4594.1.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "RU-RU") "Advanced_IP_Scanner_2.5.4594.1.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "RU-RU") "Advanced_IP_Scanner_2.5.4594.1.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "Advanced_IP_Scanner_2.5.4594.1.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "node.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "node.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "node.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NAME")5a:T59d,The input sample is signed with a certificate issued by "CN=YE1, O=Let's Encrypt, C=US" (SHA1: 33:9A:0E:4B:71:39:2F:74:88:BD:59:AA:62:F5:CC:CC:4D:51:3B:B2; see report for more information) The input sample is signed with a certificate issued by "CN=Root YE, O=ISRG, C=US" (SHA1: D0:93:70:A9:86:49:82:A5:04:7D:A4:63:73:54:02:56:D0:8A:3C:81; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X2, O=Internet Security Research Group, C=US" (SHA1: F3:76:20:FC:4B:1C:DD:D2:A3:D7:4B:1D:5E:8D:B4:2E:24:4C:A0:06; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 3C:34:E3:56:C7:FC:17:F5:AC:F0:48:24:BC:58:7C:6C:62:39:51:A2; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: AB:92:A2:53:B1:25:21:79:F4:40:97:16:99:F3:DF:0D:D1:12:99:2A; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information)5b:T688,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000000.224609.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.02750000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.02750000.00000004.mdmp, 00000000-00003460.00000002.228446.7396D000.00000002.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.02750000.00000004.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.7396D000.00000002.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003460.00000002.228446.7396D000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003460.00000003.232202.00510000.00000002.mdmp")5c:Taa8,"msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\Ole" (Filter: 268435457; Subtree: 0) "msiexec.exe" monitors "HKCU_Classes\Local Settings\Software\Microsoft" (Filter: 268435457; Subtree: 1) "msiexec.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\crypt32" (Filter: 268435460; Subtree: 0) "msiexec.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\Root" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\FlightRoot" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKCU\Software\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "msiexec.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1)5d:T58a,"Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "")5e:T412,"msiexec.exe" queries basic process information of the "C:\Windows\System32\msiexec.exe" (UID: 3844) "msiexec.exe" queries basic process information of the "C:\Windows\System32\msiexec.exe" (UID: 2540) "msiexec.exe" queries basic process information of the "C:\ProgramData\NodeJS\Advanced_IP_Scanner_2.5.4594.1.exe" (UID: 2540) "msiexec.exe" queries basic process information of the "C:\ProgramData\NodeJS\node.exe" (UID: 2540) "Advanced_IP_Scanner_2.5.4594.1.exe" queries basic process information of the "C:\ProgramData\NodeJS\Advanced_IP_Scanner_2.5.4594.1.exe" (UID: 6340) "Advanced_IP_Scanner_2.5.4594.1.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\is-Q7D1E.tmp\Advanced_IP_Scanner_2.5.4594.1.tmp" (UID: 6340) "Advanced_IP_Scanner_2.5.4594.1.tmp" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\is-Q7D1E.tmp\Advanced_IP_Scanner_2.5.4594.1.tmp" (UID: 3460) "node.exe" queries basic process information of the "C:\ProgramData\NodeJS\node.exe" (UID: 4172)5f:Tc70,"Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "ADVANCED_IP_SCANNER_2.5.4594.1.EXE"; Value: "") "Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "8CCCA27D-F1D8-4DDA-B5DD-339AEE937731"; Value: "") "Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "18608E62-A628-49D9-8C02-55972E097D24"; Value: "") "Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMAIN.SDB"; Value: "") "Advanced_IP_Scanner_2.5.4594.1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "DISABLEDOUBLEQUERYSDBS"; Value: "")60:T467,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to query volume size61:T5d8,"msiexec.exe" trying to touch file "C:\WINDOWS\SYSTEM32\apphelp.dll" "msiexec.exe" trying to touch file "C:\WINDOWS\SYSTEM32\AcLayers.DLL" "msiexec.exe" trying to touch file "C:\WINDOWS\system32\IMM32.DLL" "msiexec.exe" trying to touch file "C:\WINDOWS\system32\oleaut32.dll" "msiexec.exe" trying to touch file "C:\windows\temp\VxSSL64.dll" "msiexec.exe" trying to touch file "C:\WINDOWS\System32\FLTLIB.DLL" "msiexec.exe" trying to touch file "C:\WINDOWS\System32\MSVCP140.dll" "msiexec.exe" trying to touch file "C:\WINDOWS\System32\VCRUNTIME140.dll" "msiexec.exe" trying to touch file "C:\WINDOWS\System32\VCRUNTIME140_1.dll" "msiexec.exe" trying to touch file "C:\WINDOWS\System32\msiexec.exe" "msiexec.exe" trying to touch file "\Global??\FltMgrMsg" "msiexec.exe" trying to touch file "C:\windows\temp\VxOle64.dll" "msiexec.exe" trying to touch file "C:\WINDOWS\System32\msiexec.exe.Local\" "msiexec.exe" trying to touch file "C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_270f70857386168e\COMCTL32.DLL" "msiexec.exe" trying to touch file "C:\WINDOWS\System32\msi.dll" "msiexec.exe" trying to touch file "C:\WINDOWS\System32\bcrypt.dll" "msiexec.exe" trying to touch file "\Device\KsecDD" "msiexec.exe" trying to touch file "C:\WINDOWS\System32\srpapi.dll" "msiexec.exe" trying to touch file "SrpDevice" "msiexec.exe" trying to touch file "C:\WINDOWS\system32\TSAPPCMP.DLL" "msiexec.exe" trying to touch file "\Device\CNG"62:T994,"msiexec.exe" trying to access non-existent file "C:\WINDOWS\system32\TSAPPCMP.DLL" "msiexec.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_1_CLR0400.dll" "msiexec.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "msiexec.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "Advanced_IP_Scanner_2.5.4594.1.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "Advanced_IP_Scanner_2.5.4594.1.exe" trying to access non-existent file "C:\ProgramData\NodeJS\FLTLIB.DLL" "Advanced_IP_Scanner_2.5.4594.1.exe" trying to access non-existent file "C:\ProgramData\NodeJS\MSVCP140.dll" "Advanced_IP_Scanner_2.5.4594.1.exe" trying to access non-existent file "C:\ProgramData\NodeJS\VCRUNTIME140.dll" "Advanced_IP_Scanner_2.5.4594.1.exe" trying to access non-existent file "C:\ProgramData\NodeJS\CRYPTSP.DLL" "Advanced_IP_Scanner_2.5.4594.1.exe" trying to access non-existent file "C:\ProgramData\NodeJS\Advanced_IP_Scanner_2.5.4594.1.ENU.DLL" "Advanced_IP_Scanner_2.5.4594.1.exe" trying to access non-existent file "C:\ProgramData\NodeJS\Advanced_IP_Scanner_2.5.4594.1.EN.DLL" "Advanced_IP_Scanner_2.5.4594.1.exe" trying to access non-existent file "C:\ProgramData\NodeJS\netmsg.dll" "Advanced_IP_Scanner_2.5.4594.1.tmp" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "Advanced_IP_Scanner_2.5.4594.1.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-Q7D1E.tmp\msimg32.dll" "Advanced_IP_Scanner_2.5.4594.1.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-Q7D1E.tmp\version.dll" "Advanced_IP_Scanner_2.5.4594.1.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-Q7D1E.tmp\mpr.dll" "Advanced_IP_Scanner_2.5.4594.1.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-Q7D1E.tmp\FLTLIB.DLL" "Advanced_IP_Scanner_2.5.4594.1.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-Q7D1E.tmp\MSVCP140.dll" "Advanced_IP_Scanner_2.5.4594.1.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-Q7D1E.tmp\VCRUNTIME140.dll" "Advanced_IP_Scanner_2.5.4594.1.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-Q7D1E.tmp\CRYPTSP.DLL"63:T7d3,Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00004172-00000C2C-1973270933") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00004172-00000C2C-1973394720") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00004172-00000C2C-1973585065") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00004172-00000C2C-1973625425") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004172-00000C2C-1975669261")64:Tb51,Found string "\par \hich\af0\dbch\af31505\loch\f0 please contact openssl-cor\hich\af0\dbch\af31505\loch\f0 e@openssl.org." (Indicator: "openssl-"; Source: "00000000-00003460.00000000.224609.02750000.00000004.mdmp, 00000000-00003460.00000000.224609.03320000.00000004.mdmp, 00000000-00003460.00000000.224609.03460000.00000004.mdmp, 00000000-00003460.00000000.224609.035A0000.00000004.mdmp, 00000000-00003460.00000001.226527.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.030A0000.00000004.mdmp, 00000000-00003460.00000001.226527.03320000.00000004.mdmp, 00000000-00003460.00000001.226527.03460000.00000004.mdmp, 00000000-00003460.00000001.226527.035A0000.00000004.mdmp, 00000000-00003460.00000002.228446.02750000.00000004.mdmp, 00000000-00003460.00000002.228446.031E0000.00000004.mdmp, 00000000-00003460.00000002.228446.035A0000.00000004.mdmp, 00000000-00003460.00000003.232202.02750000.00000004.mdmp, 00000000-00003460.00000003.232202.03320000.00000004.mdmp, 00000000-00003460.00000003.232202.03460000.00000004.mdmp, 00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found string "\par \hich\af0\dbch\af31505\loch\f0 * openssl-core@openssl.org." (Indicator: "openssl-"; Source: "00000000-00003460.00000000.224609.02750000.00000004.mdmp, 00000000-00003460.00000000.224609.03320000.00000004.mdmp, 00000000-00003460.00000000.224609.03460000.00000004.mdmp, 00000000-00003460.00000000.224609.035A0000.00000004.mdmp, 00000000-00003460.00000001.226527.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.030A0000.00000004.mdmp, 00000000-00003460.00000001.226527.03320000.00000004.mdmp, 00000000-00003460.00000001.226527.03460000.00000004.mdmp, 00000000-00003460.00000001.226527.035A0000.00000004.mdmp, 00000000-00003460.00000002.228446.02750000.00000004.mdmp, 00000000-00003460.00000002.228446.031E0000.00000004.mdmp, 00000000-00003460.00000002.228446.035A0000.00000004.mdmp, 00000000-00003460.00000002.228446.7FE20000.00000004.mdmp, 00000000-00003460.00000003.232202.02750000.00000004.mdmp, 00000000-00003460.00000003.232202.03320000.00000004.mdmp, 00000000-00003460.00000003.232202.03460000.00000004.mdmp, 00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found string "please contact openssl-core@openssl.org." (Indicator: "openssl-"; Source: "00000000-00003460.00000001.226527.06EF0000.00000004.mdmp, 00000000-00003460.00000002.228446.06EF0000.00000004.mdmp, 00000000-00003460.00000003.232202.06EF0000.00000004.mdmp") Found string "* openssl-core@openssl.org." (Indicator: "openssl-"; Source: "00000000-00003460.00000001.226527.06EF0000.00000004.mdmp, 00000000-00003460.00000002.228446.06EF0000.00000004.mdmp, 00000000-00003460.00000003.232202.06EF0000.00000004.mdmp") Found string "\par \hich\af0\dbch\af31505\loch\f0 please contact openssl-core@openssl.org." (Indicator: "openssl-"; Source: "00000000-00003460.00000002.228446.7FE20000.00000004.mdmp")65:T6cb,Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp")66:T2913,Found reference to API "User chose not to shutdown applications using our files." (Indicator: " shutdown "; File: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp") Found reference to API "GetHostNameW" (Indicator: "gethostname"; Source: "00000000-00004172-00000C2C-1971678910") Found reference to API "User chose not to shutdown applications using our files." (Indicator: " shutdown "; Source: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found reference to API "Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation." (Indicator: " accept "; Source: "00000000-00003460.00000000.224609.02750000.00000004.mdmp, 00000000-00003460.00000000.224609.035A0000.00000004.mdmp, 00000000-00003460.00000001.226527.00E80000.00000002.mdmp, 00000000-00003460.00000001.226527.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.035A0000.00000004.mdmp, 00000000-00003460.00000002.228446.00E80000.00000002.mdmp, 00000000-00003460.00000002.228446.02750000.00000004.mdmp, 00000000-00003460.00000002.228446.035A0000.00000004.mdmp, 00000000-00003460.00000003.232202.02750000.00000004.mdmp, 00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found reference to API "I &do not accept the agreement" (Indicator: " accept "; Source: "00000000-00003460.00000000.224609.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.00E80000.00000002.mdmp, 00000000-00003460.00000001.226527.02750000.00000004.mdmp, 00000000-00003460.00000002.228446.00E80000.00000002.mdmp, 00000000-00003460.00000002.228446.02750000.00000004.mdmp, 00000000-00003460.00000003.232202.02750000.00000004.mdmp") file/memory contains long string with (Indicator: " accept "; Source: "00000000-00003460.00000000.224609.02750000.00000004.mdmp, 00000000-00003460.00000000.224609.03320000.00000004.mdmp, 00000000-00003460.00000000.224609.03460000.00000004.mdmp, 00000000-00003460.00000000.224609.035A0000.00000004.mdmp, 00000000-00003460.00000001.226527.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.030A0000.00000004.mdmp, 00000000-00003460.00000001.226527.03320000.00000004.mdmp, 00000000-00003460.00000001.226527.03460000.00000004.mdmp, 00000000-00003460.00000001.226527.035A0000.00000004.mdmp, 00000000-00003460.00000002.228446.02750000.00000004.mdmp, 00000000-00003460.00000002.228446.031E0000.00000004.mdmp, 00000000-00003460.00000002.228446.035A0000.00000004.mdmp, 00000000-00003460.00000003.232202.02750000.00000004.mdmp, 00000000-00003460.00000003.232202.03320000.00000004.mdmp, 00000000-00003460.00000003.232202.03460000.00000004.mdmp, 00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found reference to API "\hich\af39\dbch\af31505\loch\f39 D\hich\af39\dbch\af31505\loch\f39 BELOW. BY INSTALLING THIS SOFTWARE YOU ACCEPT ALL THE TERMS AND CONDITIONS OF THIS AGREEMENT." (Indicator: " accept "; Source: "00000000-00003460.00000000.224609.02750000.00000004.mdmp, 00000000-00003460.00000000.224609.03320000.00000004.mdmp, 00000000-00003460.00000000.224609.03460000.00000004.mdmp, 00000000-00003460.00000000.224609.035A0000.00000004.mdmp, 00000000-00003460.00000001.226527.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.030A0000.00000004.mdmp, 00000000-00003460.00000001.226527.03320000.00000004.mdmp, 00000000-00003460.00000001.226527.03460000.00000004.mdmp, 00000000-00003460.00000001.226527.035A0000.00000004.mdmp, 00000000-00003460.00000002.228446.02750000.00000004.mdmp, 00000000-00003460.00000002.228446.031E0000.00000004.mdmp, 00000000-00003460.00000002.228446.035A0000.00000004.mdmp, 00000000-00003460.00000003.232202.02750000.00000004.mdmp, 00000000-00003460.00000003.232202.03320000.00000004.mdmp, 00000000-00003460.00000003.232202.03460000.00000004.mdmp, 00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found reference to API "OT BE INSTALLED ON YOUR COMPUTER. This Product will not install on your computer unless or until you accept the terms of this Agreement. You may also receive a copy of this Agreement by contacting Famatech at:}{\rtlch\fcs1 \af39 \ltrch\fcs0" (Indicator: " accept "; Source: "00000000-00003460.00000000.224609.02750000.00000004.mdmp, 00000000-00003460.00000000.224609.03320000.00000004.mdmp, 00000000-00003460.00000000.224609.03460000.00000004.mdmp, 00000000-00003460.00000000.224609.035A0000.00000004.mdmp, 00000000-00003460.00000001.226527.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.030A0000.00000004.mdmp, 00000000-00003460.00000001.226527.03320000.00000004.mdmp, 00000000-00003460.00000001.226527.03460000.00000004.mdmp, 00000000-00003460.00000001.226527.035A0000.00000004.mdmp, 00000000-00003460.00000002.228446.02750000.00000004.mdmp, 00000000-00003460.00000002.228446.031E0000.00000004.mdmp, 00000000-00003460.00000002.228446.035A0000.00000004.mdmp, 00000000-00003460.00000003.232202.02750000.00000004.mdmp, 00000000-00003460.00000003.232202.03320000.00000004.mdmp, 00000000-00003460.00000003.232202.03460000.00000004.mdmp, 00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found reference to API "\par \hich\af39\dbch\af31505\loch\f39 9. You are not required to accept this License, since you have not" (Indicator: " accept "; Source: "00000000-00003460.00000000.224609.02750000.00000004.mdmp, 00000000-00003460.00000000.224609.03320000.00000004.mdmp, 00000000-00003460.00000000.224609.03460000.00000004.mdmp, 00000000-00003460.00000000.224609.035A0000.00000004.mdmp, 00000000-00003460.00000001.226527.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.030A0000.00000004.mdmp, 00000000-00003460.00000001.226527.03320000.00000004.mdmp, 00000000-00003460.00000001.226527.03460000.00000004.mdmp, 00000000-00003460.00000001.226527.035A0000.00000004.mdmp, 00000000-00003460.00000002.228446.02750000.00000004.mdmp, 00000000-00003460.00000002.228446.031E0000.00000004.mdmp, 00000000-00003460.00000002.228446.035A0000.00000004.mdmp, 00000000-00003460.00000003.232202.02750000.00000004.mdmp, 00000000-00003460.00000003.232202.03320000.00000004.mdmp, 00000000-00003460.00000003.232202.03460000.00000004.mdmp, 00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found reference to API "\par \hich\af39\dbch\af31505\loch\f39 prohibited by law if you do not accept this License. Therefore, by" (Indicator: " accept "; Source: "00000000-00003460.00000000.224609.02750000.00000004.mdmp, 00000000-00003460.00000000.224609.03320000.00000004.mdmp, 00000000-00003460.00000000.224609.03460000.00000004.mdmp, 00000000-00003460.00000000.224609.035A0000.00000004.mdmp, 00000000-00003460.00000001.226527.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.030A0000.00000004.mdmp, 00000000-00003460.00000001.226527.03320000.00000004.mdmp, 00000000-00003460.00000001.226527.03460000.00000004.mdmp, 00000000-00003460.00000001.226527.035A0000.00000004.mdmp, 00000000-00003460.00000002.228446.02750000.00000004.mdmp, 00000000-00003460.00000002.228446.031E0000.00000004.mdmp, 00000000-00003460.00000002.228446.035A0000.00000004.mdmp, 00000000-00003460.00000002.228446.7FE20000.00000004.mdmp, 00000000-00003460.00000003.232202.02750000.00000004.mdmp, 00000000-00003460.00000003.232202.03320000.00000004.mdmp, 00000000-00003460.00000003.232202.03460000.00000004.mdmp, 00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found reference to API "BY INSTALLING THIS SOFTWARE YOU ACCEPT ALL THE TERMS AND CONDITIONS OF THIS AGREEMENT." (Indicator: " accept "; Source: "00000000-00003460.00000001.226527.00720000.00000004.mdmp") Found reference to API "lease read the following License Agreement. You must accept the terms of this agreement before continuing with the installation." (Indicator: " accept "; Source: "00000000-00003460.00000001.226527.035A0000.00000004.mdmp, 00000000-00003460.00000002.228446.035A0000.00000004.mdmp, 00000000-00003460.00000003.232202.035A0000.00000004.mdmp") file/memory contains long string with (Indicator: " accept "; Source: "00000000-00003460.00000001.226527.06EF0000.00000004.mdmp, 00000000-00003460.00000002.228446.06EF0000.00000004.mdmp, 00000000-00003460.00000003.232202.06EF0000.00000004.mdmp") Found reference to API "9. You are not required to accept this License, since you have not" (Indicator: " accept "; Source: "00000000-00003460.00000001.226527.06EF0000.00000004.mdmp, 00000000-00003460.00000002.228446.06EF0000.00000004.mdmp, 00000000-00003460.00000003.232202.06EF0000.00000004.mdmp") Found reference to API "prohibited by law if you do not accept this License. Therefore, by" (Indicator: " accept "; Source: "00000000-00003460.00000001.226527.06EF0000.00000004.mdmp, 00000000-00003460.00000002.228446.06EF0000.00000004.mdmp, 00000000-00003460.00000003.232202.06EF0000.00000004.mdmp") Found reference to API "o not accept the agreement" (Indicator: " accept "; Source: "00000000-00003460.00000002.228446.00720000.00000004.mdmp, 00000000-00003460.00000003.232202.00720000.00000004.mdmp") Found reference to API "&do not accept the agreement" (Indicator: " accept "; Source: "00000000-00003460.00000002.228446.00720000.00000004.mdmp, 00000000-00003460.00000003.232202.00720000.00000004.mdmp") Found reference to API "do not accept the agreement" (Indicator: " accept "; Source: "00000000-00003460.00000002.228446.00720000.00000004.mdmp, 00000000-00003460.00000003.232202.00720000.00000004.mdmp") Found reference to API "&Nu accept licenc" (Indicator: " accept "; Source: "00000000-00003460.00000002.228446.031E0000.00000004.mdmp") Found reference to API "Velg en mappe fra listen nedenfor, klikk deretter OK." (Indicator: " listen "; Source: "00000000-00003460.00000002.228446.031E0000.00000004.mdmp") Found reference to API "AGREEMENT, IN WHICH CASE YOU WILL NOT BE ABLE TO USE, INSTALL OR OPERATE THE PRODUCT, AS DEFINED BELOW. BY INSTALLING THIS SOFTWARE YOU ACCEPT ALL THE TERMS AND CONDITIONS OF THIS AGREEMENT." (Indicator: " accept "; Source: "00000000-00003460.00000002.228446.06EF0000.00000004.mdmp") Found reference to API "Specifies that the PenInputPanel object does not accept input.n" (Indicator: " accept "; Source: "00000000-00003460.00000002.228446.7396D000.00000002.mdmp")67:T162a8,Found URL "http://www.innosetup.com/remobjects" - Source: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found URL "http://www.remobjects.com/psexception" - Source: "00000000-00003460.00000000.224609.00401000.00000020.mdmp") Found URL "http://support.radmin.com" - Source: "00000000-00003460.00000000.224609.02750000.00000004.mdmp") Found URL "http://support.radmin.cominstallazione" - Source: "00000000-00003460.00000000.224609.02750000.00000004.mdmp") Found URL "http://support.radmin.comla" - Source: "00000000-00003460.00000000.224609.02750000.00000004.mdmp") Found URL "http://support.radmin.combude" - Source: "00000000-00003460.00000000.224609.02750000.00000004.mdmp") Found URL "http://support.radmin.com.instalacja" - Source: "00000000-00003460.00000000.224609.02750000.00000004.mdmp") Found URL "http://support.radmin.com.n" - Source: "00000000-00003460.00000000.224609.02750000.00000004.mdmp") Found URL "http://support.radmin.com" - Source: "00000000-00003460.00000000.224609.03320000.00000004.mdmp") Found URL "http://support.radmin.com%1" - Source: "00000000-00003460.00000000.224609.03320000.00000004.mdmp") Found URL "http://support.radmin.com.installering" - Source: "00000000-00003460.00000000.224609.03320000.00000004.mdmp") Found URL "http://support.radmin.com.instalirat" - Source: "00000000-00003460.00000000.224609.03320000.00000004.mdmp") Found URL "http://support.radmin.com.nepavyko" - Source: "00000000-00003460.00000000.224609.03320000.00000004.mdmp") Found URL "http://support.radmin.com.nainaaluje" - Source: "00000000-00003460.00000000.224609.03320000.00000004.mdmp") Found URL "http://support.radmin.com.cia" - Source: "00000000-00003460.00000000.224609.03320000.00000004.mdmp") Found URL "http://support.radmin.com.installation" - Source: "00000000-00003460.00000000.224609.03320000.00000004.mdmp") Found URL "http://support.radmin.com" - Source: "00000000-00003460.00000000.224609.03460000.00000004.mdmp") Found URL "http://www.palkornel.hu/innosetup%1" - Source: "00000000-00003460.00000000.224609.03460000.00000004.mdmp") Found URL "http://support.radmin.com" - Source: "00000000-00003460.00000000.224609.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.the" - Source: "00000000-00003460.00000000.224609.035A0000.00000004.mdmp") Found URL "http://support.radmin.comdie" - Source: "00000000-00003460.00000000.224609.035A0000.00000004.mdmp") Found URL "http://support.radmin.comsetup" - Source: "00000000-00003460.00000000.224609.035A0000.00000004.mdmp") Found URL "http://support.radmin.comen" - Source: "00000000-00003460.00000000.224609.035A0000.00000004.mdmp") Found URL "http://support.radmin.comkleme" - Source: "00000000-00003460.00000000.224609.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.aplikacja" - Source: "00000000-00003460.00000000.224609.035A0000.00000004.mdmp") Found URL "http://support.radmin.com," - Source: "00000000-00003460.00000000.224609.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.a" - Source: "00000000-00003460.00000000.224609.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.nauja" - Source: "00000000-00003460.00000000.224609.035A0000.00000004.mdmp") Found URL "http://support.radmin.cominstalaciju" - Source: "00000000-00003460.00000000.224609.035A0000.00000004.mdmp") Found URL "http://support.radmin.comhttp://support.radmin.com%1" - Source: "00000000-00003460.00000000.224609.035A0000.00000004.mdmp") Found URL "http://support.radmin.comse" - Source: "00000000-00003460.00000000.224609.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.asennus" - Source: "00000000-00003460.00000000.224609.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.nyere" - Source: "00000000-00003460.00000000.224609.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.zostanie" - Source: "00000000-00003460.00000000.224609.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.installimine" - Source: "00000000-00003460.00000000.224609.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.instalacija" - Source: "00000000-00003460.00000000.224609.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.nameana" - Source: "00000000-00003460.00000000.224609.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.namestitev" - Source: "00000000-00003460.00000000.224609.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.programa" - Source: "00000000-00003460.00000000.224609.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.installation" - Source: "00000000-00003460.00000000.224609.035A0000.00000004.mdmp") Found URL "http://sw.symcb.com/sw.crl0" - Source: "00000000-00003460.00000001.226527.0018F000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0l0j0http://sw.symcd.com0'http://sw1.symcb.com/sw.crt0@gzxus'unverisign," - Source: "00000000-00003460.00000001.226527.0018F000.00000004.mdmp") Found URL "http://s.symcb.com/pca3-g5.crl0" - Source: "00000000-00003460.00000001.226527.0018F000.00000004.mdmp") Found URL "http://s.symcd.com0_x0v0t0l0" - Source: "00000000-00003460.00000001.226527.0018F000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0)symantecpki-1-62903130u8*zdiata!ar" - Source: "00000000-00003460.00000001.226527.0018F000.00000004.mdmp") Found URL "http://www.advanced-ip-scanner.com0tch.ijp>yu_u[$40]v0/js!o20220429102312z0symantec" - Source: "00000000-00003460.00000001.226527.0018F000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0." - Source: "00000000-00003460.00000001.226527.0018F000.00000004.mdmp") Found URL "http://s.symcd.com06/0-0+%http://s.symcb.com/universal-root.crl0timestamp-2048-30ch9@!xlbnsymantec" - Source: "00000000-00003460.00000001.226527.0018F000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0@90705/http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0k0i0*http://ts-ocsp.ws.symantec.com0;/http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(timestamp-2048-60rpc/u)" - Source: "00000000-00003460.00000001.226527.0018F000.00000004.mdmp") Found URL "http://support.radmin.com" - Source: "00000000-00003460.00000001.226527.02750000.00000004.mdmp") Found URL "http://support.radmin.cominstallazione" - Source: "00000000-00003460.00000001.226527.02750000.00000004.mdmp") Found URL "http://support.radmin.comla" - Source: "00000000-00003460.00000001.226527.02750000.00000004.mdmp") Found URL "http://support.radmin.combude" - Source: "00000000-00003460.00000001.226527.02750000.00000004.mdmp") Found URL "http://support.radmin.com.instalacja" - Source: "00000000-00003460.00000001.226527.02750000.00000004.mdmp") Found URL "http://support.radmin.com.n" - Source: "00000000-00003460.00000001.226527.02750000.00000004.mdmp") Found URL "http://support.radmin.com" - Source: "00000000-00003460.00000001.226527.030A0000.00000004.mdmp") Found URL "http://www.dk-soft.org/" - Source: "00000000-00003460.00000001.226527.030A0000.00000004.mdmp") Found URL "http://support.radmin.com" - Source: "00000000-00003460.00000001.226527.03320000.00000004.mdmp") Found URL "http://support.radmin.com%1" - Source: "00000000-00003460.00000001.226527.03320000.00000004.mdmp") Found URL "http://support.radmin.com.installering" - Source: "00000000-00003460.00000001.226527.03320000.00000004.mdmp") Found URL "http://support.radmin.com.instalirat" - Source: "00000000-00003460.00000001.226527.03320000.00000004.mdmp") Found URL "http://support.radmin.com.nepavyko" - Source: "00000000-00003460.00000001.226527.03320000.00000004.mdmp") Found URL "http://support.radmin.com.nainaaluje" - Source: "00000000-00003460.00000001.226527.03320000.00000004.mdmp") Found URL "http://support.radmin.com.cia" - Source: "00000000-00003460.00000001.226527.03320000.00000004.mdmp") Found URL "http://support.radmin.com.installation" - Source: "00000000-00003460.00000001.226527.03320000.00000004.mdmp") Found URL "http://support.radmin.com" - Source: "00000000-00003460.00000001.226527.03460000.00000004.mdmp") Found URL "http://www.palkornel.hu/innosetup%1" - Source: "00000000-00003460.00000001.226527.03460000.00000004.mdmp") Found URL "http://support.radmin.com" - Source: "00000000-00003460.00000001.226527.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.the" - Source: "00000000-00003460.00000001.226527.035A0000.00000004.mdmp") Found URL "http://support.radmin.comdie" - Source: "00000000-00003460.00000001.226527.035A0000.00000004.mdmp") Found URL "http://support.radmin.comsetup" - Source: "00000000-00003460.00000001.226527.035A0000.00000004.mdmp") Found URL "http://support.radmin.comen" - Source: "00000000-00003460.00000001.226527.035A0000.00000004.mdmp") Found URL "http://support.radmin.comkleme" - Source: "00000000-00003460.00000001.226527.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.aplikacja" - Source: "00000000-00003460.00000001.226527.035A0000.00000004.mdmp") Found URL "http://support.radmin.com," - Source: "00000000-00003460.00000001.226527.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.a" - Source: "00000000-00003460.00000001.226527.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.nauja" - Source: "00000000-00003460.00000001.226527.035A0000.00000004.mdmp") Found URL "http://support.radmin.cominstalaciju" - Source: "00000000-00003460.00000001.226527.035A0000.00000004.mdmp") Found URL "http://support.radmin.comhttp://support.radmin.com%1" - Source: "00000000-00003460.00000001.226527.035A0000.00000004.mdmp") Found URL "http://support.radmin.comse" - Source: "00000000-00003460.00000001.226527.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.asennus" - Source: "00000000-00003460.00000001.226527.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.nyere" - Source: "00000000-00003460.00000001.226527.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.zostanie" - Source: "00000000-00003460.00000001.226527.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.installimine" - Source: "00000000-00003460.00000001.226527.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.instalacija" - Source: "00000000-00003460.00000001.226527.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.nameana" - Source: "00000000-00003460.00000001.226527.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.namestitev" - Source: "00000000-00003460.00000001.226527.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.programa" - Source: "00000000-00003460.00000001.226527.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.installation" - Source: "00000000-00003460.00000001.226527.035A0000.00000004.mdmp") Found URL "http://www.radmin.com/support/feedback/php.1" - Source: "00000000-00003460.00000001.226527.06EF0000.00000004.mdmp") Found URL "http://www.radmin.com/about/legal/pp.php)." - Source: "00000000-00003460.00000001.226527.06EF0000.00000004.mdmp") Found URL "http://www.radmin.com/support/feedback/php." - Source: "00000000-00003460.00000001.226527.06EF0000.00000004.mdmp") Found URL "http://www.qt.io/licensing/" - Source: "00000000-00003460.00000001.226527.06EF0000.00000004.mdmp") Found URL "http://www.openssl.org/)" - Source: "00000000-00003460.00000001.226527.06EF0000.00000004.mdmp") Found URL "http://www.openssl.org/" - Source: "00000000-00003460.00000001.226527.06EF0000.00000004.mdmp") Found URL "http://www.openssl.org123456789:123456789:123456789:123456789:123456789:" - Source: "00000000-00003460.00000001.226527.06EF0000.00000004.mdmp") Found URL "http://sw.symcb.com/sw.crl0" - Source: "00000000-00003460.00000002.228446.0018F000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0l0j0http://sw.symcd.com0'http://sw1.symcb.com/sw.crt0@gzxus'unverisign," - Source: "00000000-00003460.00000002.228446.0018F000.00000004.mdmp") Found URL "http://s.symcb.com/pca3-g5.crl0" - Source: "00000000-00003460.00000002.228446.0018F000.00000004.mdmp") Found URL "http://s.symcd.com0_x0v0t0l0" - Source: "00000000-00003460.00000002.228446.0018F000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0)symantecpki-1-62903130u8*zdiata!ar" - Source: "00000000-00003460.00000002.228446.0018F000.00000004.mdmp") Found URL "http://www.advanced-ip-scanner.com0tch.ijp>yu_u[$40]v0/js!o20220429102312z0symantec" - Source: "00000000-00003460.00000002.228446.0018F000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0." - Source: "00000000-00003460.00000002.228446.0018F000.00000004.mdmp") Found URL "http://s.symcd.com06/0-0+%http://s.symcb.com/universal-root.crl0timestamp-2048-30ch9@!xlbnsymantec" - Source: "00000000-00003460.00000002.228446.0018F000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0@90705/http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0k0i0*http://ts-ocsp.ws.symantec.com0;/http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(timestamp-2048-60rpc/u)" - Source: "00000000-00003460.00000002.228446.0018F000.00000004.mdmp") Found URL "http://support.radmin.com" - Source: "00000000-00003460.00000002.228446.02750000.00000004.mdmp") Found URL "http://support.radmin.cominstallazione" - Source: "00000000-00003460.00000002.228446.02750000.00000004.mdmp") Found URL "http://support.radmin.comla" - Source: "00000000-00003460.00000002.228446.02750000.00000004.mdmp") Found URL "http://support.radmin.combude" - Source: "00000000-00003460.00000002.228446.02750000.00000004.mdmp") Found URL "http://support.radmin.com.instalacja" - Source: "00000000-00003460.00000002.228446.02750000.00000004.mdmp") Found URL "http://support.radmin.com.n" - Source: "00000000-00003460.00000002.228446.02750000.00000004.mdmp") Found URL "http://counter-strike.com.ua/" - Source: "00000000-00003460.00000002.228446.031E0000.00000004.mdmp") Found URL "http://support.radmin.com" - Source: "00000000-00003460.00000002.228446.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.the" - Source: "00000000-00003460.00000002.228446.035A0000.00000004.mdmp") Found URL "http://support.radmin.comdie" - Source: "00000000-00003460.00000002.228446.035A0000.00000004.mdmp") Found URL "http://support.radmin.comsetup" - Source: "00000000-00003460.00000002.228446.035A0000.00000004.mdmp") Found URL "http://support.radmin.comen" - Source: "00000000-00003460.00000002.228446.035A0000.00000004.mdmp") Found URL "http://support.radmin.comkleme" - Source: "00000000-00003460.00000002.228446.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.aplikacja" - Source: "00000000-00003460.00000002.228446.035A0000.00000004.mdmp") Found URL "http://support.radmin.com," - Source: "00000000-00003460.00000002.228446.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.a" - Source: "00000000-00003460.00000002.228446.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.nauja" - Source: "00000000-00003460.00000002.228446.035A0000.00000004.mdmp") Found URL "http://support.radmin.cominstalaciju" - Source: "00000000-00003460.00000002.228446.035A0000.00000004.mdmp") Found URL "http://support.radmin.comhttp://support.radmin.com%1" - Source: "00000000-00003460.00000002.228446.035A0000.00000004.mdmp") Found URL "http://support.radmin.comse" - Source: "00000000-00003460.00000002.228446.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.asennus" - Source: "00000000-00003460.00000002.228446.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.nyere" - Source: "00000000-00003460.00000002.228446.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.zostanie" - Source: "00000000-00003460.00000002.228446.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.installimine" - Source: "00000000-00003460.00000002.228446.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.instalacija" - Source: "00000000-00003460.00000002.228446.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.nameana" - Source: "00000000-00003460.00000002.228446.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.namestitev" - Source: "00000000-00003460.00000002.228446.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.programa" - Source: "00000000-00003460.00000002.228446.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.installation" - Source: "00000000-00003460.00000002.228446.035A0000.00000004.mdmp") Found URL "http://www.radmin.com/support/feedback/php.1" - Source: "00000000-00003460.00000002.228446.06EF0000.00000004.mdmp") Found URL "http://www.radmin.com/about/legal/pp.php)." - Source: "00000000-00003460.00000002.228446.06EF0000.00000004.mdmp") Found URL "http://www.radmin.com/support/feedback/php." - Source: "00000000-00003460.00000002.228446.06EF0000.00000004.mdmp") Found URL "http://www.qt.io/licensing/" - Source: "00000000-00003460.00000002.228446.06EF0000.00000004.mdmp") Found URL "http://www.openssl.org/)" - Source: "00000000-00003460.00000002.228446.06EF0000.00000004.mdmp") Found URL "http://www.openssl.org/" - Source: "00000000-00003460.00000002.228446.06EF0000.00000004.mdmp") Found URL "http://www.openssl.org123456789:123456789:123456789:123456789:123456789:" - Source: "00000000-00003460.00000002.228446.06EF0000.00000004.mdmp") Found URL "http://sw.symcb.com/sw.crl0" - Source: "00000000-00003460.00000003.232202.0018F000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0l0j0http://sw.symcd.com0'http://sw1.symcb.com/sw.crt0@gzxus'unverisign," - Source: "00000000-00003460.00000003.232202.0018F000.00000004.mdmp") Found URL "http://s.symcb.com/pca3-g5.crl0" - Source: "00000000-00003460.00000003.232202.0018F000.00000004.mdmp") Found URL "http://s.symcd.com0_x0v0t0l0" - Source: "00000000-00003460.00000003.232202.0018F000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0)symantecpki-1-62903130u8*zdiata!ar" - Source: "00000000-00003460.00000003.232202.0018F000.00000004.mdmp") Found URL "http://www.advanced-ip-scanner.com0tch.ijp>yu_u[$40]v0/js!o20220429102312z0symantec" - Source: "00000000-00003460.00000003.232202.0018F000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0." - Source: "00000000-00003460.00000003.232202.0018F000.00000004.mdmp") Found URL "http://s.symcd.com06/0-0+%http://s.symcb.com/universal-root.crl0timestamp-2048-30ch9@!xlbnsymantec" - Source: "00000000-00003460.00000003.232202.0018F000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0@90705/http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0k0i0*http://ts-ocsp.ws.symantec.com0;/http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(timestamp-2048-60rpc/u)" - Source: "00000000-00003460.00000003.232202.0018F000.00000004.mdmp") Found URL "http://support.radmin.com" - Source: "00000000-00003460.00000003.232202.02750000.00000004.mdmp") Found URL "http://support.radmin.cominstallazione" - Source: "00000000-00003460.00000003.232202.02750000.00000004.mdmp") Found URL "http://support.radmin.comla" - Source: "00000000-00003460.00000003.232202.02750000.00000004.mdmp") Found URL "http://support.radmin.combude" - Source: "00000000-00003460.00000003.232202.02750000.00000004.mdmp") Found URL "http://support.radmin.com.instalacja" - Source: "00000000-00003460.00000003.232202.02750000.00000004.mdmp") Found URL "http://support.radmin.com.n" - Source: "00000000-00003460.00000003.232202.02750000.00000004.mdmp") Found URL "http://support.radmin.com" - Source: "00000000-00003460.00000003.232202.03320000.00000004.mdmp") Found URL "http://support.radmin.com%1" - Source: "00000000-00003460.00000003.232202.03320000.00000004.mdmp") Found URL "http://support.radmin.com.installering" - Source: "00000000-00003460.00000003.232202.03320000.00000004.mdmp") Found URL "http://support.radmin.com.instalirat" - Source: "00000000-00003460.00000003.232202.03320000.00000004.mdmp") Found URL "http://support.radmin.com.nepavyko" - Source: "00000000-00003460.00000003.232202.03320000.00000004.mdmp") Found URL "http://support.radmin.com.nainaaluje" - Source: "00000000-00003460.00000003.232202.03320000.00000004.mdmp") Found URL "http://support.radmin.com.cia" - Source: "00000000-00003460.00000003.232202.03320000.00000004.mdmp") Found URL "http://support.radmin.com.installation" - Source: "00000000-00003460.00000003.232202.03320000.00000004.mdmp") Found URL "http://support.radmin.com" - Source: "00000000-00003460.00000003.232202.03460000.00000004.mdmp") Found URL "http://www.palkornel.hu/innosetup%1" - Source: "00000000-00003460.00000003.232202.03460000.00000004.mdmp") Found URL "http://support.radmin.com" - Source: "00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.the" - Source: "00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found URL "http://support.radmin.comdie" - Source: "00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found URL "http://support.radmin.comsetup" - Source: "00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found URL "http://support.radmin.comen" - Source: "00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found URL "http://support.radmin.comkleme" - Source: "00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.aplikacja" - Source: "00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found URL "http://support.radmin.com," - Source: "00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.a" - Source: "00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.nauja" - Source: "00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found URL "http://support.radmin.cominstalaciju" - Source: "00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found URL "http://support.radmin.comhttp://support.radmin.com%1" - Source: "00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found URL "http://support.radmin.comse" - Source: "00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.asennus" - Source: "00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.nyere" - Source: "00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.zostanie" - Source: "00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.installimine" - Source: "00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.instalacija" - Source: "00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.nameana" - Source: "00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.namestitev" - Source: "00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.programa" - Source: "00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found URL "http://support.radmin.com.installation" - Source: "00000000-00003460.00000003.232202.035A0000.00000004.mdmp") Found URL "http://www.radmin.com/support/feedback/php.1" - Source: "00000000-00003460.00000003.232202.06EF0000.00000004.mdmp") Found URL "http://www.radmin.com/about/legal/pp.php)." - Source: "00000000-00003460.00000003.232202.06EF0000.00000004.mdmp") Found URL "http://www.radmin.com/support/feedback/php." - Source: "00000000-00003460.00000003.232202.06EF0000.00000004.mdmp") Found URL "http://www.qt.io/licensing/" - Source: "00000000-00003460.00000003.232202.06EF0000.00000004.mdmp") Found URL "http://www.openssl.org/)" - Source: "00000000-00003460.00000003.232202.06EF0000.00000004.mdmp") Found URL "http://www.openssl.org/" - Source: "00000000-00003460.00000003.232202.06EF0000.00000004.mdmp") Found URL "http://www.openssl.org123456789:123456789:123456789:123456789:123456789:" - Source: "00000000-00003460.00000003.232202.06EF0000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v26.7.0/node-v26.7.0.tar.gzsslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtinternal/bootstrap/switches/does_own_process_stateprocessor_identifier=intel64" - Source: "00000000-00004172.00000000.224701.02DD0000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v26.7.0/win-x64/node.libsamplingthreadset" - Source: "00000000-00004172.00000000.224701.02DD0000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v26.7.0/node-v26.7.0-headers.tar.gzk&c>8vr>cgc/:st>2ds>hlp>zwr>svr>het>@vr>@vr>zwr>b&l>\vr>budapest1netlock" - Source: "00000000-00004172.00000000.224701.02DD0000.00000004.mdmp") Found URL "https://1.1.1.1$" - Source: "00000000-00004172.00000000.224701.0EE80000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\rleg9&q::a" - Source: "00000000-00004172.00000000.224701.3D3E0000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crl" - Source: "00000000-00004172.00000000.224701.3D3E0000.00000004.mdmp") Found URL "https://machinegirl.carvelpolman.workers.dev/" - Source: "00000000-00004172.00000000.224701.3D3E0000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\s+" - Source: "00000000-00004172.00000000.224701.3D51E000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.es0p1$0" - Source: "00000000-00004172.00000000.224701.3DA30000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl" - Source: "00000000-00004172.00000000.224701.3DA30000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl-9mqwd-trust" - Source: "00000000-00004172.00000000.224701.3DA30000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crlg0jvd-trust" - Source: "00000000-00004172.00000000.224701.3DA30000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlldap://directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%20ev%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist0f@http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl6f?;amazon1amazon" - Source: "00000000-00004172.00000000.224701.3DA7D000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl>r" - Source: "00000000-00004172.00000000.224701.3DA7D000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crlhswisssign" - Source: "00000000-00004172.00000000.224701.3DA7D000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20br%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlistnew" - Source: "00000000-00004172.00000000.224701.3DA7D000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20ev%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlistarizona1scottsdale1%0" - Source: "00000000-00004172.00000000.224701.3DA7D000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/ssl.com" - Source: "00000000-00004172.00000000.224701.3DA7D000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/,zc" - Source: "00000000-00004172.00000000.224701.3DA7D000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00004172.00000000.224701.3DA7D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00004172.00000000.224701.3DA7D000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00004172.00000000.224701.3DA7D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00004172.00000000.224701.3DA7D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004172.00000000.224701.3DA7D000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004172.00000000.224701.3DA7D000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crlwu\0digicert" - Source: "00000000-00004172.00000000.224701.3DA7D000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-487007270818109937193375387014449110337186509494.crl0(z9ijtf4syf63lsskdbm^2'*" - Source: "00000000-00004172.00000000.224701.3DC3F000.00000004.mdmp") Found URL "https://wwww.certigna.fr/autorites/0@a=0@a=atos" - Source: "00000000-00004172.00000000.224701.3DC3F000.00000004.mdmp") Found URL "http://www.accv.esautoridad" - Source: "00000000-00004172.00000000.224701.3DD25000.00000004.mdmp") Found URL "http://www.accv.eshkdfmicrosoft" - Source: "00000000-00004172.00000000.224701.3DD25000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.es0$http://www.accv.es/legislacion_c.htm0un0l0jdhttp://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crl0accv@accv.eshgx0emsign" - Source: "00000000-00004172.00000000.224701.3DD25000.00000004.mdmp") Found URL "http://www.accv.es/legislacion_c.htmxx_.quovadis" - Source: "00000000-00004172.00000000.224701.3DD25000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20br%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlist^=x2410212173939zssl" - Source: "00000000-00004172.00000000.224701.3DD25000.00000004.mdmp") Found URL "https://wwww.certigna.fr/autorites/0mf0d0/)http://crl.certigna.fr/certignarootca.crl01+http://crl.dhimyotis.com/certignarootca.crlo_x2microsoft" - Source: "00000000-00004172.00000000.224701.3DD25000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20ev%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlistc=x5" - Source: "00000000-00004172.00000000.224701.3DD69000.00000004.mdmp") Found URL "https://machinegirl.carvelpolman.workers.dev/\sob3" - Source: "00000000-00004172.00000000.224701.3DE52000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-487007270818109937193375387014449110337186509494.crl0(z9ijtf4syf6szx'h=x'@" - Source: "00000000-00004172.00000000.224701.3E08D000.00000004.mdmp") Found URL "http://=7l7x'007270818109937193375387014449110337186509494.crl0(z9ijtf4syf61lssi(x'quuuquuuquuuquuu3lsspymwruuu" - Source: "00000000-00004172.00000000.224701.3E08D000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-487007270818109937193375387014449110337186509494.crl0(z9ijtf4syf6gzx(" - Source: "00000000-00004172.00000000.224701.3E08D000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004172.00000000.224701.3E08D000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0d" - Source: "00000000-00004172.00000000.224701.3E08D000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004172.00000000.224701.3E08D000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00004172.00000000.224701.3E08D000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00004172.00000000.224701.3E0C3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00004172.00000000.224701.3E0C3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00004172.00000000.224701.3E0C3000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-487007270818109937193375387014449110337186509494.crl0(z9ijtf4syf6!" - Source: "00000000-00004172.00000000.224701.3E0C3000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v26.7.0/node-v26.7.0.tar.gzhttps://nodejs.org/download/release/v26.7.0/node-v26.7.0-headers.tar.gzhttps://nodejs.org/download/release/v26.7.0/win-x64/node.lib1.34.81.2.048.078.33.7.10.17.09.4.31.2.20.1.40.0.11.70.03.5.74.6.67.7.03.53.42026c8.9.017.01.52.10.0.2314.6.202.34-node.281.3.2.1-motley-42c2f191.5.726.7.08.18.04.0.01.1.11\usr\localx86_64-pc-windows-msvchttps://nodejs.org/download/release/executablelib/_http_agent.jslib/_http_client.jslib/_http_common.jslib/_http_incoming.jslib/_http_outgoing.jslib/_http_server.jslib/_tls_common.jslib/_tls_wrap.jslib/assert.jslib/assert/strict.jslib/async_hooks.jslib/buffer.jslib/child_process.jslib/cluster.jslib/console.jslib/constants.jslib/crypto.jslib/dgram.jslib/diagnostics_channel.jslib/dns.jslib/dns/promises.jslib/domain.jslib/events.jslib/ffi.jslib/fs/promises.jslib/http.jslib/http2.jslib/https.jslib/inspector.jslib/inspector/promises.jslib/internal/abort_controller.jslib/internal/assert.jslib/internal/assert/assertion_error.jslib/internal/assert/myers_diff.jslib/internal/assert/utils.jslib/internal/async_context_frame.jslib/internal/async_hooks.jslib/internal/async_local_storage/async_context_frame.jslib/internal/async_local_storage/async_hooks.jslib/internal/async_local_storage/run_scope.jslib/internal/blob.jslib/internal/blocklist.jslib/internal/bootstrap/node.jslib/internal/bootstrap/realm.jslib/internal/bootstrap/shadow_realm.jslib/internal/bootstrap/switches/does_not_own_process_state.jslib/internal/bootstrap/switches/does_own_process_state.jslib/internal/bootstrap/switches/is_main_thread.jslib/internal/bootstrap/switches/is_not_main_thread.jslib/internal/bootstrap/web/exposed-wildcard.jslib/internal/bootstrap/web/exposed-window-or-worker.jslib/internal/buffer.jslib/internal/child_process.jslib/internal/child_process/serialization.jslib/internal/cli_table.jslib/internal/cluster/child.jslib/internal/cluster/primary.jslib/internal/cluster/round_robin_handle.jslib/internal/cluster/shared_handle.jslib/internal/cluster/utils.jslib/internal/cluster/worker.jslib/internal/console/constructor.jslib/internal/console/global.jslib/internal/constants.jslib/internal/crypto/aes.jslib/internal/crypto/argon2.jslib/internal/crypto/certificate.jslib/internal/crypto/cfrg.jslib/internal/crypto/chacha20_poly1305.jslib/internal/crypto/cipher.jslib/internal/crypto/diffiehellman.jslib/internal/crypto/ec.jslib/internal/crypto/hash.jslib/internal/crypto/hashnames.jslib/internal/crypto/hkdf.jslib/internal/crypto/kem.jslib/internal/crypto/keygen.jslib/internal/crypto/keys.jslib/internal/crypto/mac.jslib/internal/crypto/ml_dsa.jslib/internal/crypto/ml_kem.jslib/internal/crypto/pbkdf2.jslib/internal/crypto/random.jslib/internal/crypto/rsa.jslib/internal/crypto/scrypt.jslib/internal/crypto/sig.jslib/internal/crypto/util.jslib/internal/crypto/webcrypto.jslib/internal/crypto/webcrypto_util.jslib/internal/crypto/webidl.jslib/internal/crypto/x509.jslib/internal/data_url.jslib/internal/debugger/inspect.jslib/internal/debugger/inspect_client.jslib/internal/debugger/inspect_helpers.jslib/internal/debugger/inspect_probe.jslib/internal/debugger/inspect_repl.jslib/internal/dgram.jslib/internal/dns/callback_resolver.jslib/internal/dns/promises.jslib/internal/dns/utils.jslib/internal/encoding.jslib/internal/encoding/single-byte.jslib/internal/encoding/util.jslib/internal/error_serdes.jslib/internal/errors.jslib/internal/errors/error_source.jslib/internal/event_target.jslib/internal/events/abort_listener.jslib/internal/events/symbols.jslib/internal/ffi-shared-buffer.jslib/internal/ffi/fast-api.jslib/internal/file.jslib/internal/fixed_queue.jslib/internal/freelist.jslib/internal/freeze_intrinsics.jslib/internal/fs/cp/cp-sync.jslib/internal/fs/cp/cp.jslib/internal/fs/dir.jslib/internal/fs/glob.jslib/internal/fs/promises.jslib/internal/fs/read/context.jslib/internal/fs/recursive_watch.jslib/internal/fs/rimraf.jslib/internal/fs/streams.jslib/internal/fs/sync_write_stream.jslib/internal/fs/utils.jslib/internal/fs/watchers.jslib/internal/heap_utils.jslib/internal/histogram.jslib/internal/http.jslib/internal/http2/compat.jslib/internal/http2/core.jslib/internal/http2/util.jslib/internal/inspector/network.jslib/internal/inspector/network_http.jslib/internal/inspector/network_http2.jslib/internal/inspector/network_resources.jslib/internal/inspector/network_undici.jslib/internal/inspector/webstorage.jslib/internal/inspector_async_hook.jslib/internal/inspector_network_tracking.jslib/internal/js_stream_socket.jslib/internal/legacy/processbinding.jslib/internal/linkedlist.jslib/internal/locks.jslib/internal/main/check_syntax.jslib/internal/main/embedding.jslib/internal/main/eval_stdin.jslib/internal/main/eval_string.jslib/internal/main/inspect.jslib/internal/main/mksnapshot.jslib/internal/main/print_help.jslib/internal/main/prof_process.jslib/internal/main/repl.jslib/internal/main/run_main_module.jslib/internal/main/test_runner.jslib/internal/main/watch_mode.jslib/internal/main/worker_thread.jslib/internal/mime.jslib/internal/modules/cjs/loader.jslib/internal/modules/customization_hooks.jslib/internal/modules/esm/assert.jslib/internal/modules/esm/create_dynamic_module.jslib/internal/modules/esm/get_format.jslib/internal/modules/esm/hooks.jslib/internal/modules/esm/load.jslib/internal/modules/esm/loader.jslib/internal/modules/esm/module_job.jslib/internal/modules/esm/module_map.jslib/internal/modules/esm/resolve.jslib/internal/modules/esm/shared_constants.jslib/internal/modules/esm/translators.jslib/internal/modules/esm/utils.jslib/internal/modules/esm/worker.jslib/internal/modules/helpers.jslib/internal/modules/package_json_reader.jslib/internal/modules/package_map.jslib/internal/modules/run_main.jslib/internal/modules/typescript.jslib/internal/navigator.jslib/internal/net.jslib/internal/options.jslib/internal/per_context/domexception.jslib/internal/per_context/messageport.jslib/internal/per_context/primordials.jslib/internal/perf/event_loop_delay.jslib/internal/perf/event_loop_utilization.jslib/internal/perf/nodetiming.jslib/internal/perf/observe.jslib/internal/perf/performance.jslib/internal/perf/performance_entry.jslib/internal/perf/resource_timing.jslib/internal/perf/timerify.jslib/internal/perf/usertiming.jslib/internal/perf/utils.jslib/internal/priority_queue.jslib/internal/process/execution.jslib/internal/process/finalization.jslib/internal/process/per_thread.jslib/internal/process/permission.jslib/internal/process/pre_execution.jslib/internal/process/promises.jslib/internal/process/report.jslib/internal/process/signal.jslib/internal/process/task_queues.jslib/internal/process/warning.jslib/internal/process/worker_thread_only.jslib/internal/promise_hooks.jslib/internal/querystring.jslib/internal/quic/diagnostics.jslib/internal/quic/quic.jslib/internal/quic/state.jslib/internal/quic/stats.jslib/internal/quic/symbols.jslib/internal/readline/callbacks.jslib/internal/readline/emitkeypressevents.jslib/internal/readline/interface.jslib/internal/readline/promises.jslib/internal/readline/utils.jslib/internal/repl.jslib/internal/repl/await.jslib/internal/repl/completion.jslib/internal/repl/history.jslib/internal/repl/utils.jslib/internal/socket_list.jslib/internal/socketaddress.jslib/internal/source_map/prepare_stack_trace.jslib/internal/source_map/source_map.jslib/internal/source_map/source_map_cache.jslib/internal/source_map/source_map_cache_map.jslib/internal/stream_base_commons.jslib/internal/streams/add-abort-signal.jslib/internal/streams/compose.jslib/internal/streams/destroy.jslib/internal/streams/duplex.jslib/internal/streams/duplexify.jslib/internal/streams/duplexpair.jslib/internal/streams/end-of-stream.jslib/internal/streams/fast-utf8-stream.jslib/internal/streams/from.jslib/internal/streams/iter/broadcast.jslib/internal/streams/iter/classic.jslib/internal/streams/iter/consumers.jslib/internal/streams/iter/duplex.jslib/internal/streams/iter/from.jslib/internal/streams/iter/pull.jslib/internal/streams/iter/push.jslib/internal/streams/iter/ringbuffer.jslib/internal/streams/iter/share.jslib/internal/streams/iter/transform.jslib/internal/streams/iter/types.jslib/internal/streams/iter/utils.jslib/internal/streams/lazy_transform.jslib/internal/streams/legacy.jslib/internal/streams/operators.jslib/internal/streams/passthrough.jslib/internal/streams/pipeline.jslib/internal/streams/readable.jslib/internal/streams/state.jslib/internal/streams/transform.jslib/internal/streams/utils.jslib/internal/streams/writable.jslib/internal/test/binding.jslib/internal/test/transfer.jslib/internal/test_runner/assert.jslib/internal/test_runner/coverage.jslib/internal/test_runner/harness.jslib/internal/test_runner/mock/loader.jslib/internal/test_runner/mock/mock.jslib/internal/test_runner/mock/mock_timers.jslib/internal/test_runner/reporter/dot.jslib/internal/test_runner/reporter/junit.jslib/internal/test_runner/reporter/lcov.jslib/internal/test_runner/reporter/rerun.jslib/internal/test_runner/reporter/spec.jslib/internal/test_runner/reporter/tap.jslib/internal/test_runner/reporter/utils.jslib/internal/test_runner/reporter/v8-serializer.jslib/internal/test_runner/runner.jslib/internal/test_runner/snapshot.jslib/internal/test_runner/tag_filter.jslib/internal/test_runner/test.jslib/internal/test_runner/tests_stream.jslib/internal/test_runner/utils.jslib/internal/timers.jslib/internal/tls/common.jslib/internal/tls/secure-context.jslib/internal/tls/wrap.jslib/internal/trace_events.jslib/internal/trace_events_async_hooks.jslib/internal/tty.jslib/internal/url.jslib/internal/util.jslib/internal/util/colors.jslib/internal/util/comparisons.jslib/internal/util/debuglog.jslib/internal/util/diff.jslib/internal/util/inspect.jslib/internal/util/inspector.jslib/internal/util/parse_args/parse_args.jslib/internal/util/parse_args/utils.jslib/internal/util/trace_sigint.jslib/internal/util/types.jslib/internal/v8/cpu_profiler.jslib/internal/v8/heap_profile.jslib/internal/v8/startup_snapshot.jslib/internal/v8_prof_polyfill.jslib/internal/validators.jslib/internal/vfs/dir.jslib/internal/vfs/errors.jslib/internal/vfs/fd.jslib/internal/vfs/file_handle.jslib/internal/vfs/file_system.jslib/internal/vfs/provider.jslib/internal/vfs/providers/memory.jslib/internal/vfs/providers/real.jslib/internal/vfs/router.jslib/internal/vfs/setup.jslib/internal/vfs/stats.jslib/internal/vfs/streams.jslib/internal/vfs/watcher.jslib/internal/vm.jslib/internal/vm/module.jslib/internal/wasm_web_api.jslib/internal/watch_mode/files_watcher.jslib/internal/watchdog.jslib/internal/webidl.jslib/internal/webstorage.jslib/internal/webstreams/adapters.jslib/internal/webstreams/compression.jslib/internal/webstreams/encoding.jslib/internal/webstreams/queuingstrategies.jslib/internal/webstreams/readablestream.jslib/internal/webstreams/transfer.jslib/internal/webstreams/transformstream.jslib/internal/webstreams/util.jslib/internal/webstreams/writablestream.jslib/internal/worker.jslib/internal/worker/clone_dom_exception.jslib/internal/worker/io.jslib/internal/worker/js_transferable.jslib/internal/worker/messaging.jslib/module.jslib/net.jslib/path.jslib/path/posix.jslib/path/win32.jslib/perf_hooks.jslib/process.jslib/punycode.jslib/querystring.jslib/quic.jslib/readline.jslib/readline/promises.jslib/repl.jslib/sea.jslib/sqlite.jslib/stream.jslib/stream/consumers.jslib/stream/iter.jslib/stream/promises.jslib/stream/web.jslib/string_decoder.jslib/sys.jslib/test.jslib/test/reporters.jslib/timers.jslib/timers/promises.jslib/tls.jslib/trace_events.jslib/tty.jslib/url.jslib/util.jslib/util/types.jslib/vfs.jslib/wasi.jslib/worker_threads.jslib/zlib.jslib/zlib/iter.jstest/cctest/inspector/test_network_requests_buffer.cctest/cctest/inspector/test_node_protocol.cctest/cctest/node_test_fixture.cctest/cctest/test_aliased_buffer.cctest/cctest/test_base64.cctest/cctest/test_base_object_ptr.cctest/cctest/test_cppgc.cctest/cctest/test_crypto_clienthello.cctest/cctest/test_dataqueue.cctest/cctest/test_diagnostics_channel.cctest/cctest/test_environment.cctest/cctest/test_inspector_socket.cctest/cctest/test_inspector_socket_server.cctest/cctest/test_json_utils.cctest/cctest/test_linked_binding.cctest/cctest/test_lru_cache.cctest/cctest/test_node_api.cctest/cctest/test_node_crypto.cctest/cctest/test_node_crypto_env.cctest/cctest/test_node_ipc_serdes.cctest/cctest/test_node_postmortem_metadata.cctest/cctest/test_node_task_runner.cctest/cctest/test_path.cctest/cctest/test_per_process.cctest/cctest/test_platform.cctest/cctest/test_quic_arena.cctest/cctest/test_quic_cid.cctest/cctest/test_quic_error.cctest/cctest/test_quic_preferredaddress.cctest/cctest/test_quic_tokenbucket.cctest/cctest/test_quic_tokens.cctest/cctest/test_report.cctest/cctest/test_sockaddr.cctest/cctest/test_string_bytes.cctest/cctest/test_traced_value.cctest/cctest/test_util.cctest/cctest/node_test_fixture.htools/icu/icu-generic.gypdeps/icu-small..\..\deps\icu-tmp\icudt78l.datdeps/undici/undici.jsdeps/amaro/dist/index.jsnode_openssl_conf_name=nodejs_conficu_no_user_data_override" - Source: "00000000-00004172.00000000.224701.77080000.00000004.mdmp") Found URL "https://nodejs.org/api/cli.html" - Source: "00000000-00004172.00000000.224701.9D8C0000.00000004.mdmp") Found URL "https://itrying" - Source: "00000000-00004172.00000000.224701.9E940000.00000004.mdmp") Found URL "https://machinegirl.carvelpolman.workers.dev/qzh" - Source: "00000000-00004172.00000000.224701.9E940000.00000004.mdmp") Found URL "https://machinegirl.carvelpolman.workers.dev/" - Source: "00000000-00004172.00000000.224701.9E940000.00000004.mdmp") Found URL "https://1.1.1.11.1.1.1headersacceptapplication/dns-jsonhostcloudflare-dns.comrejectunauthorizedanswer[dns]" - Source: "00000000-00004172.00000000.224701.E1880000.00000004.mdmp") Found URL "https://github.com/nodejs/node/issues" - Source: "00000000-00004172.00000000.224701.EC980000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v26.7.0/node-v26.7.0.tar.gzsslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtinternal/bootstrap/switches/does_own_process_stateprocessor_identifier=intel64" - Source: "00000000-00004172.00000001.226621.02DD0000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v26.7.0/win-x64/node.libsamplingthreadset" - Source: "00000000-00004172.00000001.226621.02DD0000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v26.7.0/node-v26.7.0-headers.tar.gzk&c>8vr>cgc/:st>2ds>hlp>zwr>svr>het>@vr>@vr>zwr>b&l>\vr>budapest1netlock" - Source: "00000000-00004172.00000001.226621.02DD0000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=uoj4pnl4iudnub4zitpnvc1oqol7pfee%2bsaaqu7x4yvaroqfovtncg4fpzmqtcqq1z6yiex%2fohonesnpbefsbm6qy5px3izbnck4wsezftgpkkegbb3ywekzeyg%2bgzrndpxvg9e2nbutz%2babar95ro5msv2%2b%2ba%3d%3d" - Source: "00000000-00004172.00000001.226621.052E0000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=jiguprsp%2f1v3sm8tdyeavtphvgtzbobss1cy5cxtn0e0kabr2fa%2fivulm6pzbugbadagbzdzk9a4bp2jxlascmexbybd2g3vudq22yzhc9amseb%2bnpit%2bxe5sp760%2byvzhm4n4qmmfldlqq7efiptcciiq%3d%3d" - Source: "00000000-00004172.00000001.226621.052E0000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\rleg!qx" - Source: "00000000-00004172.00000001.226621.3D3E0000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crl" - Source: "00000000-00004172.00000001.226621.3D3E0000.00000004.mdmp") Found URL "https://machinegirl.carvelpolman.workers.dev/" - Source: "00000000-00004172.00000001.226621.3D3E0000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\s+" - Source: "00000000-00004172.00000001.226621.3D51E000.00000004.mdmp") Found URL "https://bluepeak.normanitavo.workers.dev/youtubei/v1/like/likehttps://cedar-stone.normanitavo.workers.dev/watch?v=blixru4gcowhernet@back@disallowedcert_os_1,cc000c6:\programdapcserverregisterpcserverregisteretupdigetclassdevswpcserverregisterwatch?v=blixru4gcowtsconnectsessionapcserverregisterpcserverregistersesapcserverregisternumdateformatsanumdateformatsexapcserverregisternetgetprovidernameaetlastinputinfonumdateformatsexexpcserverregisternumdateformatsexwpcserverregisterpcserverregisterec-ch-ua-mobile:" - Source: "00000000-00004172.00000001.226621.3DA7D000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlldap://directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%20ev%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist0f@http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl6f?;amazon1amazon" - Source: "00000000-00004172.00000001.226621.3DA7D000.00000004.mdmp") Found URL "https://mystrdc.com/watch?v=" - Source: "00000000-00004172.00000001.226621.3DA7D000.00000004.mdmp") Found URL "https://bluepeak.normanitavo.workers.dev/youtubei/v1/like/likehapubwsdesktop-8ld9t6n192.168.0.2" - Source: "00000000-00004172.00000001.226621.3DA7D000.00000004.mdmp") Found URL "https://mystrdc.com" - Source: "00000000-00004172.00000001.226621.3DA7D000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl>r" - Source: "00000000-00004172.00000001.226621.3DA7D000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crlhswisssign" - Source: "00000000-00004172.00000001.226621.3DA7D000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20br%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlistnew" - Source: "00000000-00004172.00000001.226621.3DA7D000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20ev%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlistarizona1scottsdale1%0" - Source: "00000000-00004172.00000001.226621.3DA7D000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/ssl.com" - Source: "00000000-00004172.00000001.226621.3DA7D000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/,zc" - Source: "00000000-00004172.00000001.226621.3DA7D000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00004172.00000001.226621.3DA7D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00004172.00000001.226621.3DA7D000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00004172.00000001.226621.3DA7D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00004172.00000001.226621.3DA7D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004172.00000001.226621.3DA7D000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004172.00000001.226621.3DA7D000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crlwu\0digicert" - Source: "00000000-00004172.00000001.226621.3DA7D000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=jiguprsp%2f1v3sm8tdyeavtphvgtzbobss1cy5cxtn0e0kabr2fa%2fivulm6pzbugbadagbzdzk9a4bp2jxlascmexbybd2g3vudq22yzhc9amseb%2bnpit%2bxe5sp760%2byvzhm4n4qmmfldlqq7efiptcciiq%3d%3d" - Source: "00000000-00004172.00000001.226621.3DC3F000.00000004.mdmp") Found URL "http://ye1.c.lencr.org/mitmproxy-487007270818109937193375387014449110337186509494.crl03lsskdbmo" - Source: "00000000-00004172.00000001.226621.3DC3F000.00000004.mdmp") Found URL "http://ye1.c.lencr.org/mitmproxy-487007270818109937193375387014449110337186509494.crl03lsskdbm^8vr>cgc/:st>2ds>hlp>zwr>svr>het>@vr>@vr>zwr>b&l>\vr>budapest1netlock" - Source: "00000000-00004172.00000002.228541.02DD0000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=uoj4pnl4iudnub4zitpnvc1oqol7pfee%2bsaaqu7x4yvaroqfovtncg4fpzmqtcqq1z6yiex%2fohonesnpbefsbm6qy5px3izbnck4wsezftgpkkegbb3ywekzeyg%2bgzrndpxvg9e2nbutz%2babar95ro5msv2%2b%2ba%3d%3d" - Source: "00000000-00004172.00000002.228541.052E0000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=jiguprsp%2f1v3sm8tdyeavtphvgtzbobss1cy5cxtn0e0kabr2fa%2fivulm6pzbugbadagbzdzk9a4bp2jxlascmexbybd2g3vudq22yzhc9amseb%2bnpit%2bxe5sp760%2byvzhm4n4qmmfldlqq7efiptcciiq%3d%3d" - Source: "00000000-00004172.00000002.228541.052E0000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\rleg!qx" - Source: "00000000-00004172.00000002.228541.3D3E0000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crl" - Source: "00000000-00004172.00000002.228541.3D3E0000.00000004.mdmp") Found URL "https://machinegirl.carvelpolman.workers.dev/" - Source: "00000000-00004172.00000002.228541.3D3E0000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\s+" - Source: "00000000-00004172.00000002.228541.3D51E000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.es0p1$0" - Source: "00000000-00004172.00000002.228541.3DA30000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl" - Source: "00000000-00004172.00000002.228541.3DA30000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl-9mqwd-trust" - Source: "00000000-00004172.00000002.228541.3DA30000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crlg0jvd-trust" - Source: "00000000-00004172.00000002.228541.3DA30000.00000004.mdmp") Found URL "https://bluepeak.normanitavo.workers.dev/youtubei/v1/like/likehttps://cedar-stone.normanitavo.workers.dev/watch?v=blixru4gcowhernet@back@disallowedcert_os_1,cc000c6:\programdapcserverregisterpcserverregisteretupdigetclassdevswpcserverregisterwatch?v=blixru4gcowtsconnectsessionapcserverregisterpcserverregistersesapcserverregisternumdateformatsanumdateformatsexapcserverregisternetgetprovidernameaetlastinputinfonumdateformatsexexpcserverregisternumdateformatsexwpcserverregisterpcserverregisterec-ch-ua-mobile:" - Source: "00000000-00004172.00000002.228541.3DA7D000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlldap://directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%20ev%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist0f@http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl6f?;amazon1amazon" - Source: "00000000-00004172.00000002.228541.3DA7D000.00000004.mdmp") Found URL "https://mystrdc.com/watch?v=" - Source: "00000000-00004172.00000002.228541.3DA7D000.00000004.mdmp") Found URL "https://bluepeak.normanitavo.workers.dev/youtubei/v1/like/likehapubwsdesktop-8ld9t6n192.168.0.2" - Source: "00000000-00004172.00000002.228541.3DA7D000.00000004.mdmp") Found URL "https://mystrdc.com" - Source: "00000000-00004172.00000002.228541.3DA7D000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl>r" - Source: "00000000-00004172.00000002.228541.3DA7D000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crlhswisssign" - Source: "00000000-00004172.00000002.228541.3DA7D000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20br%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlistnew" - Source: "00000000-00004172.00000002.228541.3DA7D000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20ev%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlistarizona1scottsdale1%0" - Source: "00000000-00004172.00000002.228541.3DA7D000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/ssl.com" - Source: "00000000-00004172.00000002.228541.3DA7D000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/,zc" - Source: "00000000-00004172.00000002.228541.3DA7D000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00004172.00000002.228541.3DA7D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00004172.00000002.228541.3DA7D000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00004172.00000002.228541.3DA7D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00004172.00000002.228541.3DA7D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004172.00000002.228541.3DA7D000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004172.00000002.228541.3DA7D000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crlwu\0digicert" - Source: "00000000-00004172.00000002.228541.3DA7D000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=jiguprsp%2f1v3sm8tdyeavtphvgtzbobss1cy5cxtn0e0kabr2fa%2fivulm6pzbugbadagbzdzk9a4bp2jxlascmexbybd2g3vudq22yzhc9amseb%2bnpit%2bxe5sp760%2byvzhm4n4qmmfldlqq7efiptcciiq%3d%3d" - Source: "00000000-00004172.00000002.228541.3DC3F000.00000004.mdmp") Found URL "http://ye1.c.lencr.org/mitmproxy-487007270818109937193375387014449110337186509494.crl03lsskdbmo" - Source: "00000000-00004172.00000002.228541.3DC3F000.00000004.mdmp") Found URL "http://ye1.c.lencr.org/mitmproxy-487007270818109937193375387014449110337186509494.crl03lsskdbm^8vr>cgc/:st>2ds>hlp>zwr>svr>het>@vr>@vr>zwr>b&l>\vr>budapest1netlock" - Source: "00000000-00004172.00000003.232205.02DD0000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=uoj4pnl4iudnub4zitpnvc1oqol7pfee%2bsaaqu7x4yvaroqfovtncg4fpzmqtcqq1z6yiex%2fohonesnpbefsbm6qy5px3izbnck4wsezftgpkkegbb3ywekzeyg%2bgzrndpxvg9e2nbutz%2babar95ro5msv2%2b%2ba%3d%3d" - Source: "00000000-00004172.00000003.232205.052E0000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=jiguprsp%2f1v3sm8tdyeavtphvgtzbobss1cy5cxtn0e0kabr2fa%2fivulm6pzbugbadagbzdzk9a4bp2jxlascmexbybd2g3vudq22yzhc9amseb%2bnpit%2bxe5sp760%2byvzhm4n4qmmfldlqq7efiptcciiq%3d%3d" - Source: "00000000-00004172.00000003.232205.052E0000.00000004.mdmp") Found URL "https://1.1.1.1$" - Source: "00000000-00004172.00000003.232205.0EE80000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\rleg!qx" - Source: "00000000-00004172.00000003.232205.3D3E0000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crl" - Source: "00000000-00004172.00000003.232205.3D3E0000.00000004.mdmp") Found URL "https://machinegirl.carvelpolman.workers.dev/" - Source: "00000000-00004172.00000003.232205.3D3E0000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\s+" - Source: "00000000-00004172.00000003.232205.3D51E000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.es0p1$0" - Source: "00000000-00004172.00000003.232205.3DA30000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl" - Source: "00000000-00004172.00000003.232205.3DA30000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl-9mqwd-trust" - Source: "00000000-00004172.00000003.232205.3DA30000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crlg0jvd-trust" - Source: "00000000-00004172.00000003.232205.3DA30000.00000004.mdmp") Found URL "https://bluepeak.normanitavo.workers.dev/youtubei/v1/like/likehttps://cedar-stone.normanitavo.workers.dev/watch?v=blixru4gcowhernet@back@disallowedcert_os_1,cc000c6:\programdapcserverregisterpcserverregisteretupdigetclassdevswpcserverregisterwatch?v=blixru4gcowtsconnectsessionapcserverregisterpcserverregistersesapcserverregisternumdateformatsanumdateformatsexapcserverregisternetgetprovidernameaetlastinputinfonumdateformatsexexpcserverregisternumdateformatsexwpcserverregisterpcserverregisterec-ch-ua-mobile:" - Source: "00000000-00004172.00000003.232205.3DA7D000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlldap://directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%20ev%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist0f@http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl6f?;amazon1amazon" - Source: "00000000-00004172.00000003.232205.3DA7D000.00000004.mdmp") Found URL "https://mystrdc.com/watch?v=" - Source: "00000000-00004172.00000003.232205.3DA7D000.00000004.mdmp") Found URL "https://bluepeak.normanitavo.workers.dev/youtubei/v1/like/likehapubwsdesktop-8ld9t6n192.168.0.2" - Source: "00000000-00004172.00000003.232205.3DA7D000.00000004.mdmp") Found URL "https://mystrdc.com" - Source: "00000000-00004172.00000003.232205.3DA7D000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_2_2023.crl>r" - Source: "00000000-00004172.00000003.232205.3DA7D000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_2_2023.crlhswisssign" - Source: "00000000-00004172.00000003.232205.3DA7D000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20br%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlistnew" - Source: "00000000-00004172.00000003.232205.3DA7D000.00000004.mdmp") Found URL "http://crl.d-trust.net/crl/d-trust_ev_root_ca_1_2020.crl0ysldap://directory.d-trust.net/cn=d-trust%20ev%20root%20ca%201%202020,o=d-trust%20gmbh,c=de?certificaterevocationlistarizona1scottsdale1%0" - Source: "00000000-00004172.00000003.232205.3DA7D000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/ssl.com" - Source: "00000000-00004172.00000003.232205.3DA7D000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/,zc" - Source: "00000000-00004172.00000003.232205.3DA7D000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00004172.00000003.232205.3DA7D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00004172.00000003.232205.3DA7D000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00004172.00000003.232205.3DA7D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00004172.00000003.232205.3DA7D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004172.00000003.232205.3DA7D000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004172.00000003.232205.3DA7D000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crlwu\0digicert" - Source: "00000000-00004172.00000003.232205.3DA7D000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=jiguprsp%2f1v3sm8tdyeavtphvgtzbobss1cy5cxtn0e0kabr2fa%2fivulm6pzbugbadagbzdzk9a4bp2jxlascmexbybd2g3vudq22yzhc9amseb%2bnpit%2bxe5sp760%2byvzhm4n4qmmfldlqq7efiptcciiq%3d%3d" - Source: "00000000-00004172.00000003.232205.3DC3F000.00000004.mdmp") Found URL "http://ye1.c.lencr.org/mitmproxy-487007270818109937193375387014449110337186509494.crl03lsskdbmo" - Source: "00000000-00004172.00000003.232205.3DC3F000.00000004.mdmp") Found URL "http://ye1.c.lencr.org/mitmproxy-487007270818109937193375387014449110337186509494.crl03lsskdbm^ "BÈNsäï tæÂÞ'>¾Y?Ëm0TLnL£X¥¸ú3©$Â~ÅÐ£Ì+;-¡Oªò8ÔÖ" HTTP/1.1 200 OK Date: Tue 27 Oct 2026 22:27:11 GMT Content-Type: application/octet-stream Content-Length: 97 Connection: keep-alive CF-Ray: a5152065dbd52523-SJC CF-Cache-Status: DYNAMIC Server: cloudflare Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=POVE%2FyOR0axA%2B7XN3gQ05QHVSu3ppmVlAB9l3EJNjRs06EFty%2BWxvwzkIWriBhsH0mVcsCUuAiFgOpUzQgMS1Ds873iywY16N7bz%2BSOJrNaNyfTeE%2B%2BKI8NHPTHTr1ETAp4wCH06VsI84TaLY091TAVelF%2Bov9A%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} alt-svc: h3=":443"; ma=86400 with response body ==>0455C28FC28CC28457C289C2B9C2B4C29A54C3A2C389C29DC386C29A7379322272C381C3B54250C39605C28C0FC3B04565302447C3A35BC3B8C38242C2A8C3B9....... "POST / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.37 (KHTML, like Gecko) Chrome/111.3.7.22 Safari/537.37 Host: machinegirl.carvelpolman.workers.dev Content-Length: 78 Cache-Control: no-cache" with payload::==> "34a9c44bc28653537b6c3d446420c8f5xîzz×ÍUoxtàlt|a*ü¯ee¿\tuãÀUøtK¹æªÿ" HTTP/1.1 200 OK Date: Tue 27 Oct 2026 22:27:14 GMT Content-Type: application/octet-stream Content-Length: 236958 Connection: keep-alive CF-Ray: a51520743f6a2523-SJC CF-Cache-Status: DYNAMIC Server: cloudflare Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=S5KRzTiXyaz0gBBWEJ%2B%2FraY4T2KZ%2BbDaH7oirtvzSaXdvQlmgfxBDOu8lMngxaaAzLaO1L0fLoXVvlOSZelFBrYjpMsvu3kqyGtzTPCZFnJCAxm%2BC9Hlh30XmX8rX%2FvyCe224Es3T9LnwWiEE49hsvWBxfe2QXM%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} alt-svc: h3=":443"; ma=86400 with response body ==>C2BEC38F557DC385C396050B21C3BCC2AD1939C291C2B21CC292C382C394395E622AC38E5D05C29DC29AC2AD49C294C3ABC3B0C28FC38B2A1F7A09C28EC28BC3....... "POST /youtubei/v1/like/like HTTP/1.1 Connection: Keep-Alive Content-Type: application/json Accept-Language: en-US,en;q=0.9 Referer: https://mystrdc.com/watch?v=DKGnCg7jK3s Origin: https://mystrdc.com Content-Length: 2497 Host: bluepeak.normanitavo.workers.dev" with payload::==> "{"context":{"client":{"hl":"en","gl":"US","clientName":"WEB","clientVersion":"2.20250710.01.00","appInstallData":"AcgGAAD6XuNoAQIDAGwGAABOzqnlAQAAALASozrhUhVp_ZOoQrSN-EKJ0iB_MUUR5YYNYJwPkyAl8MQPaxqPx8oiCjU-GSgcDurVlhlcJPE1vfLX09u5kmMnuh3DZ-RkBQeijL0vsWnwCyLVY-Fn8xbcwHFMtx2AyffuH2lg-DCsBOTaNfr14IfPzijQUrF5hn9zjcVEo096PWGHCXZHDksdIiNtLV0ZmbQDcpTHbx_1XEkTeY8XBHIkhrsiZcGbGDMVZ4Nx5tB-7SW_r4btHRVC0QQpmxunv9nCQb8rcKofU3h4XLgot88J9OOFkcfC05bzNJHEZZYCWpOZSsb3qaJRKoWky2hdiKfTuwECwiRDOlZGTnej8tJqwSKRS1dTfS2C2p3tNMeFAvs3CCXSImwwwVdw8RL0XQWWq97Zob3nGnuDYF4eU8IyIowzFhQKs41hPLcppP4GN09q5iVdTqIVsTRPKSoGKoG4s-_Iehl2M7HB8eHWBiQDScTEZRhJ0r9t6BGQqzKlN_AlNGotcjlvmBB8aqF5J4UhGRBZ0QBfEPSsKF0zXIcqKMRWhkEBoOlGRjU_-rRkXbYlWaozTEGsiHJ-DuITF5EOk8NgO6IQS0QiQIsmpYyEOmCEzPNFQGM37z95jy_v4k0tDJLKjY_uwCiIizm5HVwBr07AoExcGHO8FUY0n5bvpBZ3ypLPizcXkFumTGOpyRBbhnwFSjDbH_MwdG9cBmta9N2lQ3BBkHp_dC1Nlzk6-sERM9srGqJYlQv1mUefwMSw1Ojxp05ueaGxhTHsmUQV3ukSf1d3w8QBgFIf6za8vefMTV7ix9icVWfQBQyU_tHF4k3kgw2BHIWtAY4enE56tzpwXI77TXnVQTpz6jYWKhVUxJS6LA8fweYrimSVrjX_62IgiFkxi_w94rtRouaiMPFAgMUXR_KiMIJntLB_uWTvfG6Iu_aNxC9aEN-8bX2eddHiq6s-oHfOGduvVEiD1wZZTMq8eUve3lU3R5zbgO7e_5H56k0mjZ6Xiv1f2qbgHdg6Iq5wUOystry8ZbkwtbmBA78pNChvmCZtL4XlmCf4i0ndKHwNwoBEnvhfSdl-mUeOUsLuTJelPxinlZkW1DrjyDM6uqDPPnth_RJlNlNnLZdm_2CEPKmhkEHHm80EnZfUxNGhI17DaDe5nN5I-szHA7u4HAhR_CdxNiTNw4BSCjfcwHpNCZtPU40MP7dlRvVbG30gnrByFYtfEAcCN6ozhorS8TZDTLwwPBrZeREaEUNYok6K9SSl1T4W6fOhrHE8tqhf7_nxp6QBditKzUfSCQxg9UpnPj0tYzDNNS-Sq3nBvDdEOv0UnUX75-9POS95_QaiIWq5DHVNIQzqidtGpKWDY6xWSc1NOjVvT0xklNx44C-0dEMAZs8vws2KP5aryn7TyTGa8vT7-E7btDIim7pL-yASPN_psz-vQ-xZve-4adhZKZYHaN2qMDW6OX03f5Y6nFe0z5aQCgG5tpbEQlx5QP8gifMXcvqMY5AMHvknV_JUkcqQDoJ2g80x-tat4pRWZ1eNXIi7ORXI1vIDtUIr6vanX11P8-UTT5Ode3ixoymR6WAzveP7ZMq5ioLcIRkeI8wXrfX5IJP35vUxOUzyVe-nT52ytmQIOQY7ovW_xGXgqLSNpsINS1OgaoVIvgRHfFkKm-x5xIYT3XexlleZJi40P5OX6lj8zchLhS7e2bg_TlYY0UJK7BhB9RAb4y-C17vMxdmpmkXbsLOyZa4C3ep-kjs7_nCcO24ziFMNL7bvuqlEVGsVrq6JCIwkUqsFhe6N06NWhCQliACrhIpvXswQwWzXNvzfMNQHwElptDEtdwn6XA4sWuS-9O_FcGn6CRmWIcYnd_M_cbFViZcN2a5fsZJypjj0eYhXDWzdxqnmYK8uxVRcP0VE1W52A51aZEZFvvFfTgpywq7E3YlWOcH2Tla_5UIxlpU7hzbh4oqqYU05vsS48J8lv20PwOFyrZO5D_nHn3bZhbvwNbJXmsiN3pm2eg9AujR1X79MU3sI6uNLgeFNNVMMucpL3iE3t-ZOf4dtubWeVyeaav_8G59RhFSDDBaIILBkeVW48SeLm3R-PPXeVMAA3dZ6CZAD06PA1Kj79oBOJs1_WWyjvrLZgvH5iFIn710BLle6w5lnMZ_T_m612AeqSp2hbkHkfY98NfR9UMxZlCOfyoxEDHczrcazbKgMnLe_DrHR3heqNfZKf85g4Mlb9s1KurzarnZ6tKYcxz9CYDHSJKrZtl8wOHgbKUZaUIfuYEEioNDfKOG5mYxi8MReQQ"},"target":{"videoId":"PJeiNUCYuul"},"params":"33bVX3QH8lm"}" HTTP/1.1 200 OK Date: Tue 27 Oct 2026 22:27:26 GMT Content-Type: application/json Content-Length: 22 Connection: keep-alive CF-Ray: a51520bddad7f497-SJC CF-Cache-Status: DYNAMIC Server: cloudflare Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=JIgUPrsP%2F1V3sm8TDyeavtpHvgTZBObSS1CY5cXTn0E0KABr2Fa%2FIvuLm6pzBUgBadaGBZdZk9A4bp2JXLascmexbybd2g3vUdQ22yZHc9amseb%2BNpIt%2BXE5SP760%2BYVzhM4N4QMMFLDLqq7EFIpTccIiQ%3D%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} alt-svc: h3=":443"; ma=86400 with response body ==>7B22726573706F6E7365436F6E74657874223A7B7D7D.......82:T51e,"Advanced_IP_Scanner_2.5.4594.1.exe" wrote 11264 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-Q7D1E.tmp\Advanced_IP_Scanner_2.5.4594.1.tmp": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "Advanced_IP_Scanner_2.5.4594.1.tmp" wrote 6144 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-IFJ1R.tmp\_isetup\_setup64.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Advanced_IP_Scanner_2.5.4594.1.tmp" wrote 23312 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-IFJ1R.tmp\_isetup\_shfoldr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...83:T417,SystemParametersInfoW@USER32.DLL at 00000000-00003460-27305-238-004F8BE0 SystemParametersInfoW@USER32.DLL at 00000000-00003460-27305-1626-0047A1D0 SystemParametersInfoW@USER32.DLL at 00000000-00003460-27305-3189-0042D868 SystemParametersInfoW@USER32.DLL at 00000000-00003460-27305-3190-0042D958 SystemParametersInfoW@USER32.DLL at 00000000-00003460-27305-3191-0042DA48 SystemParametersInfoW@USER32.DLL at 00000000-00003460-27305-3484-0045025C SystemParametersInfoW@USER32.DLL at 00000000-00003460-27305-3726-004650AC SystemParametersInfoW@USER32.DLL at 00000000-00003460-27305-3833-00479860 SystemParametersInfoW@USER32.DLL at 00000000-00003460-27305-3838-00468BA8 SystemParametersInfoW@USER32.DLL at 00000000-00003460-27305-3839-00468B00 SystemParametersInfoW@USER32.DLL at 00000000-00003460-27305-3944-0047A174 SystemParametersInfoW@USER32.DLL at 00000000-00003460-27305-3945-0047A144 SystemParametersInfoW@USER32.DLL at 00000000-00003460-27305-4026-00479E8C SystemParametersInfoW@USER32.DLL at 00000000-00003460-27305-4573-004BEC6084:T9a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAHAElEQVR4Xu2W6VOTVxjF/draxVqVuitqVRQR6tpt7EyrdcN9A7fW2mmnThfHTletVu2q1lZRKmq1AbUqokAEAknIThKyr2QhGwECqGD/gNPnvm9IEOgHpzOdfuidOXPfZIb8zjnPzQ0DBvy//iurUl6Pf1O9+QNyt+9EUm8hZxuvTVt3JLRhy5vYSNqw+Y24tmN9blw527COadNW2rdi7aYtWLORaTO/b9iM1Uzrc7F6XW7/Bl4KNOMFfxNe8DZhfkME810RzHOEMdcWwhxLELNNAcw2BPCcrhFZdX5kqn3IUHqRofBiRi1J4sH0mgZMFzUgrdKFqUInppa7MKXUick3HXj2hh2Trtuwcl1OXwMs7Yu+KJ73xMHOMObZwwQmuDmEWQysDyBL24hMDcFVPswkcIbMi3SpB+liAlczsBtTbzM4qSwOLnFw4InXbJjwBxlYu6kfA1TxfDfBnRHMtRPUGqLElNrIwI3x1ARX+zFTScnllLgHeFqVG2kVfOopDHzLwcEnFdsT4NTLVqQWWfo3wGbM6mbgOeYg5hB8FoFnaf3I0vi4ujO7wVR3eq+60yh1T3B33ROvEpzA4wk8XmDGuIsmrFizsa8Bdri4OVPi2SxxnRdZqgbMlLuRUetChpR2iYsSu5HOgd2Y1qNuDs4Sx8GTrtkx4QolvkTgQtLvZoy9YMKY8yZkr97Qv4FZepa2AVlyJzJqLJhRYUC6sB7Ty3SkekwrMyKt3Iw0oZ0SswNGdZfGE5fYE3VPZHVzYDMHZqnHnDdi9FnSGQOy1/RjYH3uNmQpKGm1EWsrNThjdEDp9sIbCnGqtLqQpzYht0yDyVe1mFJsxJQSKyZzYJaYzZkSX7Zwcx4vsBDYjDG/EfwcDx6VTzptwPJV6/saYN/Xl4UaFFucCLe1IdLe/oCa4orE2iAx2zG3UI5Jl/SU1oSJVDVXNwMXMrCJr5uBKfWoXw0YmV+PEXl6DD+hx7JV6/oa2PnuLnibW9By5w7CBGImmELxPRLfeXNtsDaFsKBQhtSLOqQKjEjtNefRBQYuNQOPPEXgk6SfdXjmuBZLV6590EBJSQm8gSDu3r+P9nv3EO3oQCgWSyjYGkM4/sx2/51mOP4MwRIOIatAgnHntBh3wYixPetmqU9Ragb+hcAETzmmxbAjdVi6opcBq8NB1cYQo/R3urrQxkxQC8GWFgRIbA8xtbbA19EEx/0Q/O1RMtaCK2oLRufJMaZAz6f+lZ/1yLx6rm4u9U9apBzVYugPGgz5XoMlK9YkDZjqTAgHW9AYiRKkFa3MRGcnYnfvcqYCzc28Wprha2+CvSvI7ew1ez8YjeK1AjFGnlRj9Gk9N+fu1CkEHna0jkvNwEO+1eDpb9RYkr06acBpc+KeoxOdpJiHDlpTDK3tHeigFsp0Xhy4acPeEhtOSx08vC2CxuYoGqNJ/VJjxIhjcow4oeXrPp6seygDf8eDBx9S46kDSizuacDmdMJH8w/6o2hzt+OevRNd7i4Uyf3Ydb0RC8/68Up+A7YI7ListMIficAXF/ccjkBssGP492I8c0ydAA/7MQ5nqQ8T+GslBx+0T4HFy1clDVjJgNPng9Pvh9vnh88XRNgTxQH6AVl4zo/tRV7kXHRizs9W7L6k5e+FYBCeQCAhh9uNlMPVSPlRlZhzN3jwQRUP/kqBJ79U4Ikv5Hh9WU8DdADtHg/sXi8cTB4mD768bsICSp5zwYGc313IPGrE+4VaGOx2mEhm+jsrgZks9HrI/koM/VZBYDUPPkTgr0n7lXhyLw9//DM5HvtEhkVLVyQNWGw22FwuWEkWaoPJTBKIDdgmcHDJM4/R7UgXypFSHdT19ZDV1UGq0UBGkqhUEFTJyUAVhhxSJMCD9hN0Xzz15wxci4Efk/ZIsWjZyh4NkAETydhr1xDo8HUFPqDU7wvUuCjSIxwOc2kVWi2kBGaSKFU4eK0Wg/dVY/ABRbLuvXzdj38q41IP3FOLR3dL8ciHEixckp00IJVKYSagwWJJSKXToUIsTqhGLodar4eroQEhMmGyWiFXqyGm92W0v/fBRzTXldzhYmIzZmJJWd1MC5cwZXN6bfHyBy+ieoMBeqMROpKCahWKRCivqkqooroaNbW1UFH1Tpp5kA6iiYxKFQpIZDIcOnKi793+MItdxUb6wFr6wNLbtzndEgoTz2UVFZwJEbWhoNoddF6YCfY3eQUCHM+/8M8MsKVUKiGmlCWlpf1KWFmJ29RGJbUjI6M2+hYUXitDQWExzhYVQ6wxo4Z+rkVKA6oUBojkxoc3xZqQ0VyFlLiYnnuqtLwcZdSKqKYGgqJL9O91DjfLv9OCVxc9vIHuJSUTEmpDRLVXUHKm4hs3kHc6HzvefqcPrD/9IwP/r39z/QVHsso0abjS0wAAAABJRU5ErkJggg==85:T9a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAHAElEQVR4Xu2W6VOTVxjF/draxVqVuitqVRQR6tpt7EyrdcN9A7fW2mmnThfHTletVu2q1lZRKmq1AbUqokAEAknIThKyr2QhGwECqGD/gNPnvm9IEOgHpzOdfuidOXPfZIb8zjnPzQ0DBvy//iurUl6Pf1O9+QNyt+9EUm8hZxuvTVt3JLRhy5vYSNqw+Y24tmN9blw527COadNW2rdi7aYtWLORaTO/b9iM1Uzrc7F6XW7/Bl4KNOMFfxNe8DZhfkME810RzHOEMdcWwhxLELNNAcw2BPCcrhFZdX5kqn3IUHqRofBiRi1J4sH0mgZMFzUgrdKFqUInppa7MKXUick3HXj2hh2Trtuwcl1OXwMs7Yu+KJ73xMHOMObZwwQmuDmEWQysDyBL24hMDcFVPswkcIbMi3SpB+liAlczsBtTbzM4qSwOLnFw4InXbJjwBxlYu6kfA1TxfDfBnRHMtRPUGqLElNrIwI3x1ARX+zFTScnllLgHeFqVG2kVfOopDHzLwcEnFdsT4NTLVqQWWfo3wGbM6mbgOeYg5hB8FoFnaf3I0vi4ujO7wVR3eq+60yh1T3B33ROvEpzA4wk8XmDGuIsmrFizsa8Bdri4OVPi2SxxnRdZqgbMlLuRUetChpR2iYsSu5HOgd2Y1qNuDs4Sx8GTrtkx4QolvkTgQtLvZoy9YMKY8yZkr97Qv4FZepa2AVlyJzJqLJhRYUC6sB7Ty3SkekwrMyKt3Iw0oZ0SswNGdZfGE5fYE3VPZHVzYDMHZqnHnDdi9FnSGQOy1/RjYH3uNmQpKGm1EWsrNThjdEDp9sIbCnGqtLqQpzYht0yDyVe1mFJsxJQSKyZzYJaYzZkSX7Zwcx4vsBDYjDG/EfwcDx6VTzptwPJV6/saYN/Xl4UaFFucCLe1IdLe/oCa4orE2iAx2zG3UI5Jl/SU1oSJVDVXNwMXMrCJr5uBKfWoXw0YmV+PEXl6DD+hx7JV6/oa2PnuLnibW9By5w7CBGImmELxPRLfeXNtsDaFsKBQhtSLOqQKjEjtNefRBQYuNQOPPEXgk6SfdXjmuBZLV6590EBJSQm8gSDu3r+P9nv3EO3oQCgWSyjYGkM4/sx2/51mOP4MwRIOIatAgnHntBh3wYixPetmqU9Ragb+hcAETzmmxbAjdVi6opcBq8NB1cYQo/R3urrQxkxQC8GWFgRIbA8xtbbA19EEx/0Q/O1RMtaCK2oLRufJMaZAz6f+lZ/1yLx6rm4u9U9apBzVYugPGgz5XoMlK9YkDZjqTAgHW9AYiRKkFa3MRGcnYnfvcqYCzc28Wprha2+CvSvI7ew1ez8YjeK1AjFGnlRj9Gk9N+fu1CkEHna0jkvNwEO+1eDpb9RYkr06acBpc+KeoxOdpJiHDlpTDK3tHeigFsp0Xhy4acPeEhtOSx08vC2CxuYoGqNJ/VJjxIhjcow4oeXrPp6seygDf8eDBx9S46kDSizuacDmdMJH8w/6o2hzt+OevRNd7i4Uyf3Ydb0RC8/68Up+A7YI7ListMIficAXF/ccjkBssGP492I8c0ydAA/7MQ5nqQ8T+GslBx+0T4HFy1clDVjJgNPng9Pvh9vnh88XRNgTxQH6AVl4zo/tRV7kXHRizs9W7L6k5e+FYBCeQCAhh9uNlMPVSPlRlZhzN3jwQRUP/kqBJ79U4Ikv5Hh9WU8DdADtHg/sXi8cTB4mD768bsICSp5zwYGc313IPGrE+4VaGOx2mEhm+jsrgZks9HrI/koM/VZBYDUPPkTgr0n7lXhyLw9//DM5HvtEhkVLVyQNWGw22FwuWEkWaoPJTBKIDdgmcHDJM4/R7UgXypFSHdT19ZDV1UGq0UBGkqhUEFTJyUAVhhxSJMCD9hN0Xzz15wxci4Efk/ZIsWjZyh4NkAETydhr1xDo8HUFPqDU7wvUuCjSIxwOc2kVWi2kBGaSKFU4eK0Wg/dVY/ABRbLuvXzdj38q41IP3FOLR3dL8ciHEixckp00IJVKYSagwWJJSKXToUIsTqhGLodar4eroQEhMmGyWiFXqyGm92W0v/fBRzTXldzhYmIzZmJJWd1MC5cwZXN6bfHyBy+ieoMBeqMROpKCahWKRCivqkqooroaNbW1UFH1Tpp5kA6iiYxKFQpIZDIcOnKi793+MItdxUb6wFr6wNLbtzndEgoTz2UVFZwJEbWhoNoddF6YCfY3eQUCHM+/8M8MsKVUKiGmlCWlpf1KWFmJ29RGJbUjI6M2+hYUXitDQWExzhYVQ6wxo4Z+rkVKA6oUBojkxoc3xZqQ0VyFlLiYnnuqtLwcZdSKqKYGgqJL9O91DjfLv9OCVxc9vIHuJSUTEmpDRLVXUHKm4hs3kHc6HzvefqcPrD/9IwP/r39z/QVHsso0abjS0wAAAABJRU5ErkJggg==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":35,"unified_at_epoch_ms":1794102705150,"unified_at":"2026-11-08T01:51:45.150Z","metadata":{"hashes":{"sha256":"698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d","sha1":"8d04816062e88d0446b9f2fee7f4e90453d6e3d3","md5":"425a1389f41b65ad040f5e818ecc3fba","sha512":"63817af8a32ab06199479cf0a296127e119af4f0bdb46356d455e7e18a5248a99fb506294676605dba8e95f5780aa7a87f6808687ccc1e6e4555844142d19ed9","ssdeep":"1572864:cmUCCbSahYDLwDI5NZXQH/ddjZm/4uROPyTnNAK6KsddzC+WRLd7r:axWa+BZa1JF7KTNNnsddzC+WRLdP","ssdeep_chunks":["1572864:cmUCCbS","1572864:mUCCbSa","1572864:UCCbSah","1572864:CCbSahY","1572864:CbSahYD","1572864:bSahYDL","1572864:SahYDLw","1572864:ahYDLwD","1572864:hYDLwDI","1572864:YDLwDI5","1572864:DLwDI5N","1572864:LwDI5NZ","1572864:wDI5NZX","1572864:DI5NZXQ","1572864:I5NZXQH","1572864:5NZXQH/","1572864:NZXQH/d","1572864:ZXQH/dd","1572864:XQH/ddj","1572864:QH/ddjZ","1572864:H/ddjZm","1572864:/ddjZm/","1572864:ddjZm/4","1572864:djZm/4u","1572864:jZm/4uR","1572864:Zm/4uRO","1572864:m/4uROP","1572864:/4uROPy","1572864:4uROPyT","1572864:uROPyTn","1572864:ROPyTnN","1572864:OPyTnNA","1572864:PyTnNAK","1572864:yTnNAK6","1572864:TnNAK6K","1572864:nNAK6Ks","1572864:NAK6Ksd","1572864:AK6Ksdd","1572864:K6Ksddz","1572864:6KsddzC","1572864:KsddzC+","1572864:sddzC+W","1572864:ddzC+WR","1572864:dzC+WRL","1572864:zC+WRLd","1572864:C+WRLd7","1572864:+WRLd7r","3145728:cmUCCbS","3145728:mUCCbSa","3145728:UCCbSah","3145728:CCbSahY","3145728:CbSahYD","3145728:bSahYDL","3145728:SahYDLw","3145728:ahYDLwD","3145728:hYDLwDI","3145728:YDLwDI5","3145728:DLwDI5N","3145728:LwDI5NZ","3145728:wDI5NZX","3145728:DI5NZXQ","3145728:I5NZXQH","3145728:5NZXQH/","3145728:NZXQH/d","3145728:ZXQH/dd","3145728:XQH/ddj","3145728:QH/ddjZ","3145728:H/ddjZm","3145728:/ddjZm/","3145728:ddjZm/4","3145728:djZm/4u","3145728:jZm/4uR","3145728:Zm/4uRO","3145728:m/4uROP","3145728:/4uROPy","3145728:4uROPyT","3145728:uROPyTn","3145728:ROPyTnN","3145728:OPyTnNA","3145728:PyTnNAK","3145728:yTnNAK6","3145728:TnNAK6K","3145728:nNAK6Ks","3145728:NAK6Ksd","3145728:AK6Ksdd","3145728:K6Ksddz","3145728:6KsddzC","3145728:KsddzC+","3145728:sddzC+W","3145728:ddzC+WR","3145728:dzC+WRL","3145728:zC+WRLd","3145728:C+WRLd7","3145728:+WRLd7r","1572864:axWa+BZ","1572864:xWa+BZa","1572864:Wa+BZa1","1572864:a+BZa1J","1572864:+BZa1JF","1572864:BZa1JF7","1572864:Za1JF7K","1572864:a1JF7KT","1572864:1JF7KTN","1572864:JF7KTNN","1572864:F7KTNNn","1572864:7KTNNns","1572864:KTNNnsd","1572864:TNNnsdd","1572864:NNnsddz","1572864:NnsddzC","1572864:nsddzC+","1572864:C+WRLdP"],"imphash":"Unknown"},"file_info":{"file_name":"AdvancedIPScanner.msi","file_type":["msi","data"],"file_type_id":"msi","file_size":60321792,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793139639000,"last_seen":1793139901000,"last_multi_scan":1793139901000}},"detections":{"summary":{"verdict":"suspicious","score":35,"tags":["evasive"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":104},"sandbox_signatures":{"informative_count":248,"suspicious_count":12,"malicious_count":1,"total":261},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to access Cisco VPN profile file"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"suspicious","value":"Contains native function calls"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains references to RC4 cryptographic API (string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"YARA signature match - MD5 algorithm"},{"type":"informative","value":"YARA signature match - ChaCha20 encryption algorithm"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"informative","value":"YARA signature match - RMM tools"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Stealth","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Stealth","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"informative","value":"YARA signature match - Zlib compression"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"YARA signature match – cryptographic algorithms"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Stealth","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Credential Access","technique":"Password Managers","attack_id":"T1555.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/005","identifiers":[{"type":"informative","value":"Able to access password managers"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Stealth","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Reference explorer.exe process"},{"type":"informative","value":"Contains reference to shellcode"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match - PE executable embedded in .rsrc section"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"YARA signature match – Zlib compression file detected"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Stealth","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Contains ability to modify file system redirection"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Contains ability to remove directories"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Contains ability to create named pipes for inter-process communication (IPC)"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Execution","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"},{"type":"informative","value":"Possible DLL sideloading"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Execution","technique":"Software Deployment Tools","attack_id":"T1072","attack_id_wiki":"https://attack.mitre.org/techniques/T1072","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"suspicious","value":"Contains ability to update the user profile"},{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"References user shell folders registry key string"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Persistence","technique":"Installer Packages","attack_id":"T1546.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/016","identifiers":[{"type":"informative","value":"Attempts to launch the Installer package binary"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"},{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Attempts to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Calls an API used to connect to internet"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains reference to OpenSSL library string"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Command and Control","technique":"Dead Drop Resolver","attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Contains PowerSploit functions (Powershell exploitation script)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Defense Impairment","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]}],"sandbox_signatures":[{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"t.ft.at.et\", Heuristic match: \"<5.eu\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"NtAlertResumeThread\" (Indicator: \"ResumeThread\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"$37","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"Advanced_IP_Scanner_2.5.4594.1.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '4310144'}\" (UID: 00000000-00006340)\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5315256'}\" (UID: 00000000-00003460)\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5315160'}\" (UID: 00000000-00003460)\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5315192'}\" (UID: 00000000-00003460)\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5315208'}\" (UID: 00000000-00003460)\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5315304'}\" (UID: 00000000-00003460)\n \"node.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '140699882639768'}\" (UID: 00000000-00004172)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"NtCreateThreadEx\" (Indicator: \"NtCreateThread\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueEx\" (Indicator: \"RegSetValue\"; File: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"RegSetValueEx\" (Indicator: \"RegSetValue\"; Source: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00003460.00000002.228446.7396D000.00000002.mdmp, 00000000-00003460.00000003.232202.00510000.00000002.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00003460.00000003.232202.00510000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003460.00000002.228446.7396D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"RC2-CBC\" (Indicator: \"RC2\"; Source: \"00000000-00004172.00000000.224701.02DD0000.00000004.mdmp, 00000000-00004172.00000001.226621.02DD0000.00000004.mdmp, 00000000-00004172.00000002.228541.02DD0000.00000004.mdmp, 00000000-00004172.00000003.232205.02DD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003460.00000003.232202.00510000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004172.00000000.224701.3DD69000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004172.00000001.226621.3DD69000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004172.00000002.228541.3DD69000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004172.00000003.232205.3DD69000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004172.00000003.232205.3E830000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"node.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 7DEC0000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"msiexec.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"msiexec.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"node.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS NT\\DNSCLIENT\")\n \"node.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"node.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"node.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\DNSCACHE\\PARAMETERS\")\n \"node.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEM\\DNSCLIENT\")\n \"node.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\DNS\")\n \"node.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\DNSCACHE\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$3a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"BCryptGenRandom\" (Indicator: \"BCryptGenRandom\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found api reference \"BCryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$3c","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003460.00000000.224609.00720000.00000004.mdmp, 00000000-00003460.00000001.226527.00720000.00000004.mdmp, 00000000-00003460.00000002.228446.00720000.00000004.mdmp, 00000000-00003460.00000003.232202.00720000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004172.00000000.224701.02DD0000.00000004.mdmp, 00000000-00004172.00000001.226621.02DD0000.00000004.mdmp, 00000000-00004172.00000002.228541.02DD0000.00000004.mdmp, 00000000-00004172.00000003.232205.02DD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains references to RC4 cryptographic API (string)","description":"Found reference to API \"SystemFunction032\" (Indicator: \"systemfunction032\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-897","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$3d","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains references to RC4 cryptographic API (string)\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Able to utilize the Windows bcrypt cryptographic API\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match – cryptographic algorithms","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$3e","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004172-00000C2C-1971467190\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004172-00000C2C-1971467190\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"$40","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00003460.00000002.228446.7396D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"file/memory contains long string with (Indicator: \"AllocateAndInitializeSid\"; File: \"_setup64.tmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00003460.00000003.232202.00510000.00000002.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00003460.00000003.232202.00510000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"00000000-00006340.00000003.232176.00401000.00000020.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"00000000-00006340.00000003.232176.00401000.00000020.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"node.exe\" called \"SystemFunction032\" with parameters (UID: 00000000-00004172)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"Advanced_IP_Scanner_2.5.4594.1.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006340)\n \"Advanced_IP_Scanner_2.5.4594.1.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00006340)\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00003460)\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00003460)\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003460)\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" called \"QueryPerformanceCounter\" (UID: 00000000-00003460)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"msiexec.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003844)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"node.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004172)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"Advanced_IP_Scanner_2.5.4594.1.tmp\" called \"IsWow64Process\" with parameter \"3460\" - (UID: 00000000-00003460)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"Advanced_IP_Scanner_2.5.4594.1.tmp\" called \"EnumWindows\" with parameter \"1702532\" - (UID: 00000000-00003460)\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" called \"EnumWindows\" with parameter \"1703020\" - (UID: 00000000-00003460)\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" called \"EnumWindows\" with parameter \"1702828\" - (UID: 00000000-00003460)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$44","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"Advanced_IP_Scanner_2.5.4594.1.tmp\" called \"GetActiveWindow\" (UID: 00000000-00003460)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Advanced_IP_Scanner_2.5.4594.1.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006340)\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003460)\n \"node.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004172)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$45","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"Advanced_IP_Scanner_2.5.4594.1.tmp\" called \"OpenMutexW\" with parameter \"Advanced IP Scanner\" - (UID: 00000000-00003460)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"Advanced_IP_Scanner_2.5.4594.1.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00006340)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00003460-27305-121-004DD49C\n GetTickCount@KERNEL32.DLL at 00000000-00003460-27305-1012-00480954\n GetTickCount@KERNEL32.DLL at 00000000-00003460-27305-1014-0048093C\n GetTickCount@KERNEL32.DLL at 00000000-00003460-27305-1119-004B2C70\n GetTickCount@KERNEL32.DLL at 00000000-00003460-27305-3374-00444B34\n GetTickCount@KERNEL32.DLL at 00000000-00003460-27305-3411-00448A3C\n GetTickCount@KERNEL32.DLL at 00000000-00003460-27305-3726-004650AC\n GetTickCount@KERNEL32.DLL at 00000000-00003460-27305-3865-0046A208\n GetTickCount@KERNEL32.DLL at 00000000-00003460-27305-3911-0047108C\n GetTickCount@KERNEL32.DLL at 00000000-00003460-27305-4713-004D7098\n GetTickCount@KERNEL32.DLL at 00000000-00003460-27305-4772-004E4BD8\n GetTickCount@KERNEL32.DLL at 00000000-00003460-27305-4861-004032D4\n GetTickCount@KERNEL32.DLL at 00000000-00003460-27305-5107-004FACFC\n GetTickCount@KERNEL32.DLL at 00000000-00003460-27305-6859-004DD448\n GetTickCount@KERNEL32.DLL at 00000000-00003460-27305-7009-004F9CEC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.DLL at 00000000-00003460-27305-57-00408164\n FindNextFileW@KERNEL32.DLL at 00000000-00003460-27305-169-004AE038\n FindFirstFileW@KERNEL32.DLL at 00000000-00003460-27305-181-004AC8C0\n FindNextFileW@KERNEL32.DLL at 00000000-00003460-27305-956-004E0A5C\n FindNextFileW@KERNEL32.DLL at 00000000-00003460-27305-1089-004D0464\n FindNextFileW@KERNEL32.DLL at 00000000-00003460-27305-4418-004AE31C\n FindFirstFileW@KERNEL32.DLL at 00000000-00003460-27305-4568-004BE630\n FindFirstFileW@KERNEL32.DLL at 00000000-00003460-27305-4594-004BFDB4\n FindFirstFileW@KERNEL32.DLL at 00000000-00003460-27305-4602-004C0270\n FindNextFileW@KERNEL32.DLL at 00000000-00003460-27305-4681-004DDEC0\n FindFirstFileW@KERNEL32.DLL at 00000000-00003460-27305-4751-004D3A98\n FindFirstFileW@KERNEL32.DLL at 00000000-00003460-27305-5112-004FC228\n FindFirstFileW@KERNEL32.DLL at 00000000-00003460-27305-7996-004012D2","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetLogicalDrives@KERNEL32.DLL at 00000000-00003460-27305-4592-004BFCD8\n GetDriveTypeW@KERNEL32.DLL at 00000000-00003460-27305-4600-004C0108\n GetDriveTypeW@KERNEL32.DLL at 00000000-00003460-27305-4697-004C91B8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM _Streams WHERE Name = '\" (Indicator: \"select * from \"; Source: \"00000000-00003460.00000000.224609.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.035A0000.00000004.mdmp, 00000000-00003460.00000002.228446.02750000.00000004.mdmp, 00000000-00003460.00000002.228446.035A0000.00000004.mdmp, 00000000-00003460.00000003.232202.02750000.00000004.mdmp, 00000000-00003460.00000003.232202.035A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003460-27305-166-004B1E60\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00003460-27305-1105-004CBA48\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003460-27305-1119-004B2C70\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003460-27305-4462-004B1E1C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003460-27305-166-004B1E60\n GetLocalTime@KERNEL32.DLL at 00000000-00003460-27305-710-0040F498\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003460-27305-1119-004B2C70\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003460-27305-4462-004B1E1C\n GetLocalTime@KERNEL32.DLL at 00000000-00003460-27305-4725-004CBEEC\n GetLocalTime@KERNEL32.DLL at 00000000-00003460-27305-4732-004CC4D8\n GetLocalTime@KERNEL32.DLL at 00000000-00003460-27305-5053-0040F448","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"$46","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.DLL at 00000000-00003460-27305-32-00410F10\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00003460-27305-39-00410EC4\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00003460-27305-56-00408360\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00003460-27305-4442-004B03A4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00000000-00003460-27305-2833-0040DB88\n GetDiskFreeSpaceW@KERNEL32.DLL at 00000000-00003460-27305-4438-004B0070","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Advanced_IP_Scanner_2.5.4594.1.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Advanced_IP_Scanner_2.5.4594.1.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"node.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.7396D000.00000002.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.DLL at 00000000-00003460-27305-83-00408DC0\n GetSystemInfo@KERNEL32.DLL at 00000000-00003460-27305-5138-004E528C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"$48","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.00510000.00000002.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00003460.00000003.232202.00510000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetKeyboardType@USER32.DLL at 00000000-00003460-27305-82-00403E38\n GetKeyboardLayoutList@USER32.DLL at 00000000-00003460-27305-367-00479488\n GetKeyboardLayoutNameW@USER32.DLL at 00000000-00003460-27305-3497-004521B4\n GetKeyboardLayout@USER32.DLL at 00000000-00003460-27305-3504-004523BC\n GetKeyboardLayout@USER32.DLL at 00000000-00003460-27305-3832-00478EA0\n GetUserDefaultLangID@KERNEL32.DLL at 00000000-00003460-27305-4443-004B03D0\n GetKeyboardType@USER32.DLL at 00000000-00003460-27305-5167-00403D07","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"OpenProcessToken@ADVAPI32.DLL at 00000000-00003460-27305-951-004AF6A4\n OpenProcessToken@ADVAPI32.DLL at 00000000-00003460-27305-4078-0047FAC0\n OpenProcessToken@ADVAPI32.DLL at 00000000-00003460-27305-4853-004D76B4\n OpenProcess@KERNEL32.DLL at 00000000-00003460-27305-5094-004F9FB8\n OpenProcess@KERNEL32.DLL at 00000000-00003460-27305-9584-0040976A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: 25412-70-00405DE8\n \"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: 00000000-00003460.00000000.224609.00401000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$4a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %TEMP%\\IS-IFJ1R.TMP\\AIPS_IS_INSTALL_DLL.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$4b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"Advanced_IP_Scanner_2.5.4594.1.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"msiexec.exe\" queried token user identity (UID: 00000000-00003844)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"msiexec.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00003844-00000C17-1960739021\n \"msiexec.exe\" queries volume information of \"C:\\share\" at 00000000-00003844-00000C17-1962605564\n \"msiexec.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00002540-00000C17-1962761005\n \"node.exe\" queries volume information of \"C:\\ProgramData\\NodeJS\\koffi.node\" at 00000000-00004172-00000C17-1971908650\n \"node.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00004172-00000C17-1987470379","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Advanced_IP_Scanner_2.5.4594.1.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"node.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"node.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"Advanced_IP_Scanner_2.5.4594.1.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{BB39586C-D77A-4BC4-BBD8-F13B1E0EC26C}_IS1\")\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{BB39586C-D77A-4BC4-BBD8-F13B1E0EC26C}_IS1\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"ET INFO Observed Cloudflare Developer Domain (workers .dev) in TLS SNI\" (SID: 2051768, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/24 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyEx\" in file \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\"\n Found registry modification API: \"RegCreateKeyEx\" in \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00003460.00000002.228446.7396D000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00003460.00000003.232202.00510000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00003460-00000C2C-1975107404\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00003460.00000000.224609.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.035A0000.00000004.mdmp, 00000000-00003460.00000002.228446.02750000.00000004.mdmp, 00000000-00003460.00000002.228446.035A0000.00000004.mdmp, 00000000-00003460.00000003.232202.02750000.00000004.mdmp, 00000000-00003460.00000003.232202.035A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"aips_is_install_dll.dll\")\n file/memory contains long string(File: \"_setup64.tmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"Advanced_IP_Scanner_2.5.4594.1.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\is-Q7D1E.tmp (UID: 00000000-00006340)\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" called \"CreateDirectoryW\" with parameter %TEMP%\\is-IFJ1R.tmp (UID: 00000000-00003460)\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" called \"CreateDirectoryW\" with parameter %TEMP%\\is-IFJ1R.tmp\\_isetup (UID: 00000000-00003460)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"Advanced_IP_Scanner_2.5.4594.1.exe\" called \"CreateProcessW\" with parameter \"\"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-Q7D1E.tmp\\Advanced_IP_Scanner_2.5.4594.1.tmp\" /SL5=\"$2037A\n20439558\n139776\n%ALLUSERSPROFILE%\\\" - (UID: 00000000-00006340)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$4e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$4f","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ocsp.sectigo.com\"\n \"machinegirl.carvelpolman.workers.dev\"\n \"bluepeak.normanitavo.workers.dev\"\n \"cedar-stone.normanitavo.workers.dev\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.21.40.64:443\"\n \"172.67.162.181:443\"\n \"104.21.81.170:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM _Streams WHERE Name = '\" (Source: 00000000-00003460.00000000.224609.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.035A0000.00000004.mdmp, 00000000-00003460.00000002.228446.02750000.00000004.mdmp, 00000000-00003460.00000002.228446.035A0000.00000004.mdmp, 00000000-00003460.00000003.232202.02750000.00000004.mdmp, 00000000-00003460.00000003.232202.035A0000.00000004.mdmp, Indicator: \"select * from _streams where name = '\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; File: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")\n Found reference to API \"CreateProcess failed (%d).\" (Indicator: \"CreateProcess\"; File: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")\n Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcess\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")\n Found reference to API \"CreateProcess failed (%d).\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003460.00000003.232202.00510000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003460.00000003.232202.00510000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"CreateNamedPipeW@KERNEL32.DLL at 00000000-00003460-27305-1119-004B2C70","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1559","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFile\" (Indicator: \"CreateFile\"; File: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"CreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003460.00000000.224609.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000001.226527.02750000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.02750000.00000004.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.02750000.00000004.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"$50","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000002.228446.7396D000.00000002.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00510000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00003460-27305-56-00408360\n LoadLibraryW@KERNEL32.DLL at 00000000-00003460-27305-471-00413B3C\n LoadLibraryW@KERNEL32.DLL at 00000000-00003460-27305-1403-004A953F\n LoadLibraryW@KERNEL32.DLL at 00000000-00003460-27305-1413-004A5C00\n LoadLibraryExW@KERNEL32.DLL at 00000000-00003460-27305-1496-004A1340\n LoadLibraryW@KERNEL32.DLL at 00000000-00003460-27305-1816-00439080\n LoadLibraryW@KERNEL32.DLL at 00000000-00003460-27305-3325-0043846C\n LoadLibraryW@KERNEL32.DLL at 00000000-00003460-27305-3821-00468C0C\n LoadLibraryW@KERNEL32.DLL at 00000000-00003460-27305-3939-00438FBC\n LoadLibraryW@KERNEL32.DLL at 00000000-00003460-27305-6887-004A9B00\n LoadLibraryW@KERNEL32.DLL at 00000000-00003460-27305-7051-004FEC8E\n LoadLibraryW@KERNEL32.DLL at 00000000-00003460-27305-7197-00409712","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteEx failed (%d).\" (Indicator: \"ShellExecute\"; File: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")\n Found reference to API \"ShellExecuteEx\" (Indicator: \"ShellExecute\"; File: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")\n Found reference to API \"ShellExecuteEx returned hProcess=0\" (Indicator: \"ShellExecute\"; File: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")\n Found reference to API \"ShellExecuteEx failed (%d).\" (Indicator: \"ShellExecute\"; Source: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")\n Found reference to API \"ShellExecuteEx\" (Indicator: \"ShellExecute\"; Source: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")\n Found reference to API \"ShellExecuteEx returned hProcess=0\" (Indicator: \"ShellExecute\"; Source: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"cmd.exe /c %s\" (Indicator: \"cmd.exe /c\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00003460.00000002.228446.7396D000.00000002.mdmp, 00000000-00003460.00000003.232202.00510000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00003460.00000002.228446.7396D000.00000002.mdmp, 00000000-00003460.00000003.232202.00510000.00000002.mdmp\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00003460.00000002.228446.7396D000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00003460.00000003.232202.00510000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LogonUserA\" (Indicator: \"LogonUser\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00510000.00000002.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00003460.00000003.232202.00510000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000000.224609.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.035A0000.00000004.mdmp, 00000000-00003460.00000002.228446.02750000.00000004.mdmp, 00000000-00003460.00000002.228446.035A0000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.02750000.00000004.mdmp, 00000000-00003460.00000003.232202.035A0000.00000004.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000002.228446.7396D000.00000002.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$54","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$55","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"aips_is_install_dll.dll\" as clean (type is \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections\"), Antivirus vendors marked dropped file \"Advanced_IP_Scanner_2.5.4594.1.tmp\" as clean (type is \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 8 sections\"), Antivirus vendors marked dropped file \"_setup64.tmp\" as clean (type is \"PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"aips_is_install_dll.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"e@openssl.org\"\n Pattern match: \"openssl-core@openssl.org\"\n Pattern match: \"eay@cryptsoft.com\"\n Pattern match: \"tjh@cryptsoft.com\"\n Pattern match: \"thomas@veco.dk\"\n Pattern match: \"innosetup@miharemec.com\"\n Pattern match: \"s-innosetup@eternallybored.org\"\n Pattern match: \"jbrugger@gmx.net\"\n Pattern match: \"peter.stadler@univie.ac.at\"\n Pattern match: \"pierre@levosgien.net\"\n Pattern match: \"mlaan@jrsoftware.org\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"User-Agent: %s\" (Indicator: \"user-agent: \"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"/youtubei/v1/like/like\" (Indicator: \"youtube\"; File: \"PCAP\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$56","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$57","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 88DB0000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 89A90000\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75680000\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73CE0000\n \"node.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 89A90000\n \"node.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 88DB0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 56460000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 8A250000\n \"Advanced_IP_Scanner_2.5.4594.1.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77310000\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77310000\n \"node.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 8A250000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000020429589fb7f0000@ntdll.dll\"\n \"220023000000000040429589fb7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"AdvancedIPScanner.msi\" was detected as \"Microsoft Installer(MSI)\" and name: \"Installer\"\n \"AdvancedIPScanner.msi\" was detected as \"Microsoft Compound\" and name: \"Data\"\n \"aips_is_install_dll.dll\" was detected as \"Microsoft Installer(MSI)\" and name: \"Installer\"\n \"aips_is_install_dll.dll\" was detected as \"Microsoft Compound\" and name: \"Data\"\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" was detected as \"Microsoft Installer(MSI)\" and name: \"Installer\"\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" was detected as \"Microsoft Compound\" and name: \"Data\"\n \"_setup64.tmp\" was detected as \"Microsoft Installer(MSI)\" and name: \"Installer\"\n \"_setup64.tmp\" was detected as \"Microsoft Compound\" and name: \"Data\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"Advanced_IP_Scanner_2.5.4594.1.tmp\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" touched \"Microsoft Multiple AutoComplete List Container\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{00BB2765-6A77-11D0-A535-00C04FD7D062}\")\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" touched \"Microsoft Shell Folder AutoComplete List\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{03C036F1-A186-11D0-824A-00AA005B4383}\\TREATAS\")\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" touched \"Microsoft AutoComplete\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{00BB2763-6A77-11D0-A535-00C04FD7D062}\\TREATAS\")\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" touched \"Microsoft TipAutoCompleteClient Control\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$58","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"bluepeak.normanitavo.workers.dev\"\n \"cedar-stone.normanitavo.workers.dev\"\n \"machinegirl.carvelpolman.workers.dev\"\n \"ocsp.sectigo.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"node.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$59","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\shlwapi.dll\" [Source: 00000000-00003460-00000C2B-1976026939]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00002540)\n Spawned process \"Advanced_IP_Scanner_2.5.4594.1.exe\" (UID: 00000000-00006340)\n Spawned process \"Advanced_IP_Scanner_2.5.4594.1.tmp\" with commandline \"/SL5=\"$2037A\n20439558\n139776\n%ALLUSERSPROFILE%\\\\NodeJS\\\\Advanced ...\" (UID: 00000000-00003460), Spawned process \"node.exe\" (UID: 00000000-00004172)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00002540)\n Spawned process \"Advanced_IP_Scanner_2.5.4594.1.exe\" (UID: 00000000-00006340)\n Spawned process \"Advanced_IP_Scanner_2.5.4594.1.tmp\" with commandline \"/SL5=\"$2037A\n20439558\n139776\n%ALLUSERSPROFILE%\\\\NodeJS\\\\Advanced ...\" (UID: 00000000-00003460), Spawned process \"node.exe\" (UID: 00000000-00004172)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$5a","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"aips_is_install_dll.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"Advanced_IP_Scanner_2.5.4594.1.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-Q7D1E.tmp\\Advanced_IP_Scanner_2.5.4594.1.tmp\"\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-IFJ1R.tmp\\_isetup\\_setup64.tmp\"\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-IFJ1R.tmp\\_isetup\\_shfoldr.dll\"\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-IFJ1R.tmp\\aips_is_install_dll.dll\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts to launch the Installer package binary","description":"Process \"Advanced_IP_Scanner_2.5.4594.1.tmp\" with commandline \"/SL5=\"$2037A\n20439558\n139776\n%ALLUSERSPROFILE%\\\\NodeJS\\\\Advanced_IP_Scanner_2.5.4594.1.exe\"\" (UID: 00000000-00003460)","origin":"Monitored Target","mitre_attack_id":"T1546.016","relevance":3,"id":"target-670","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.DLL at 00000000-00003460-27305-903-004AF658","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"Found reference to API \"NtQueueApcThread\" (Indicator: \"QueueApcThread\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.004","relevance":1,"id":"string-255","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"msiexec.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"node.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"aips_is_install_dll.dll\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\is-IFJ1R.tmp\\aips_is_install_dll.dll]- [targetUID: 00000000-00003460]\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" has type \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 8 sections\"- Location: [%TEMP%\\is-Q7D1E.tmp\\Advanced_IP_Scanner_2.5.4594.1.tmp]- [targetUID: 00000000-00006340]\n \"_setup64.tmp\" has type \"PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections\"- Location: [%TEMP%\\is-IFJ1R.tmp\\_isetup\\_setup64.tmp]- [targetUID: 00000000-00003460]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"Advanced_IP_Scanner_2.5.4594.1.tmp\" has type \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 8 sections\" - Location: [%TEMP%\\is-Q7D1E.tmp\\Advanced_IP_Scanner_2.5.4594.1.tmp]\n \"_setup64.tmp\" has type \"PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections\" - Location: [%TEMP%\\is-IFJ1R.tmp\\_isetup\\_setup64.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$5c","origin":"API Call","mitre_attack_id":"T1012","relevance":1,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$5d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"aips_is_install_dll.dll\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\is-IFJ1R.tmp\\aips_is_install_dll.dll]- [targetUID: 00000000-00003460]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"$5e","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$5f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"Advanced_IP_Scanner_2.5.4594.1.exe\" reads file \"c:\\programdata\\nodejs\\advanced_ip_scanner_2.5.4594.1.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00003460.00000003.232202.00510000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-410","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$60","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$61","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"node.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"node.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"node.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"node.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\"\n \"node.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"\n \"node.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$62","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"msiexec.exe\" trying to access non-existent file \"C:\\WINDOWS\\System32\\msiexec.exe.Local\\\"\n \"msiexec.exe\" trying to access non-existent file \"SrpDevice\"\n \"msiexec.exe\" trying to access non-existent file \"A:\"\n \"msiexec.exe\" trying to access non-existent file \"B:\"\n \"msiexec.exe\" trying to access non-existent file \"D:\"\n \"msiexec.exe\" trying to access non-existent file \"E:\"\n \"msiexec.exe\" trying to access non-existent file \"F:\"\n \"msiexec.exe\" trying to access non-existent file \"G:\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"Advanced_IP_Scanner_2.5.4594.1.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-q7d1e.tmp\\advanced_ip_scanner_2.5.4594.1.tmp\"\n \"Advanced_IP_Scanner_2.5.4594.1.exe\" writes file \"%temp%\\is-q7d1e.tmp\\advanced_ip_scanner_2.5.4594.1.tmp\"\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-ifj1r.tmp\\_isetup\\_setup64.tmp\"\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-ifj1r.tmp\\_isetup\\_shfoldr.dll\"\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-ifj1r.tmp\\aips_is_install_dll.dll\"\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" writes file \"%temp%\\is-ifj1r.tmp\\_isetup\\_setup64.tmp\"\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" writes file \"%temp%\\is-ifj1r.tmp\\_isetup\\_shfoldr.dll\"\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" writes file \"%temp%\\is-ifj1r.tmp\\aips_is_install_dll.dll\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping \"; File: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")\n Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping \"; Source: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")\n Found string \"ping av fil i m\" (Indicator: \"ping \"; Source: \"00000000-00003460.00000002.228446.031E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"node.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"POST\" object: 2f\" - (UID: 00000000-00004172)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"node.exe\" called \"InternetReadFile\" with parameter 4096 (UID: 00000000-00004172)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"node.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"2993dde03c0\"\n \"dwHeadersLength\": \"0\"\n \"lpOptional\": \"{\\\"context\\\":{\\\"client\\\":{\\\"hl\\\":\\\"en\\\",\\\"gl\\\":\\\"US\\\",\\\"clientName\\\":\\\"WEB\\\",\\\"clientVersion\\\":\\\"2.20250710.01.00\\\",\\\"appInstallData\\\":\\\"AcgGAAD6XuNoAQIDAGwGAABOzqnlAQAAALASozrhUhVp_ZOoQrSN-EKJ0iB_MUUR5YYNYJwPkyAl8MQPaxqPx8oiCjU-GSgcDurVlhlcJPE1vfLX09u5kmMnuh3DZ-RkBQeijL0vsWnwCyLVY-\", \"dwOptionalLength\": \"2497\", \"dwTotalLength\": \"2497\", \"dwContext\": \"0\"}, \"node.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"2993db8fb40\", \"dwHeadersLength\": \"0\", \"dwOptionalLength\": \"0\", \"dwTotalLength\": \"0\", \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"node.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"2993dde03c0\"\n \"lpReserved\": \"0\"}\n \"node.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"2993db8fb40\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"node.exe\" called \"InternetOpenA with parameter Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.37 (KHTML, like Gecko) Chrome/111.3.7.22 Safari/537.37\" (UID: 00000000-00004172)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D\"\n Found http requests in header \"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC2g6%2FINQymOI%2F7ORlOCUsJ\"\n Found http requests in header \"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEQCQrAhyIP3Fp8RrXMcN9z0G\"\n Found http requests in header \"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSAYR8YRRAaQhWyHV9gpA%2FKam%2FS4QQUOnSlDGfGQlDC%2FbX8x7spNIL0erkCEQDnTvJVsFBP%2Btum3%2Ff8i6MV\"\n Found http requests in header \"POST /\"\n Found http requests in header \"POST /youtubei/v1/like/like\"\n Found http requests in header \"GET /watch?v=blIXru4gcOw\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipe\" (Indicator: \"CreateNamedPipe\"; File: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"CreateNamedPipe\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Network Related","name":"Contains reference to OpenSSL library string","description":"$64","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-494","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$65","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$66","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"spanish translation maintained by jorge andres brugger (jbrugger@gmx.net)\" [Source: 00000000-00003460.00000001.226527.030A0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.35\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$67","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$68","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$69","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"bluepeak.normanitavo.workers.dev\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"machinegirl.carvelpolman.workers.dev\" (5 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS POST request to https://machinegirl.carvelpolman.workers.dev/\n Found HTTPS POST request to https://bluepeak.normanitavo.workers.dev/youtubei/v1/like/like\n Found HTTPS GET request to https://cedar-stone.normanitavo.workers.dev/watch?v=blIXru4gcOw","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"bluepeak.normanitavo.workers.dev\" (89 days old)\n Short term registered certificate: \"cedar-stone.normanitavo.workers.dev\" (89 days old)\n Short term registered certificate: \"machinegirl.carvelpolman.workers.dev\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.21.40.64\" on port \"443\"\n HTTPS traffic to \"172.67.162.181\" on port \"443\"\n HTTPS traffic to \"104.21.81.170\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopIcon\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00003460.00000000.224609.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.02750000.00000004.mdmp, 00000000-00003460.00000002.228446.02750000.00000004.mdmp, 00000000-00003460.00000003.232202.02750000.00000004.mdmp\")\n Found reference to API \"{cm:CreateDesktopIcon}\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00003460.00000000.224609.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.02F30000.00000004.mdmp, 00000000-00003460.00000002.228446.02750000.00000004.mdmp, 00000000-00003460.00000002.228446.02F30000.00000004.mdmp, 00000000-00003460.00000003.232202.02750000.00000004.mdmp, 00000000-00003460.00000003.232202.02F30000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection","description":"Wow64RevertWow64FsRedirection@KERNEL32.DLL at 00000000-00003460-27305-176-004AC5C0\n Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00003460-27305-177-004AC584","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070","relevance":1,"id":"stream-78","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"00000000-00006340.00000003.232176.00401000.00000020.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"00000000-00006340.00000003.232176.00401000.00000020.mdmp\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"148,3025,,RtlGetNtProductType,NTDLL.dll,\"00:58:27.968\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00004172.00000000.224701.02DD0000.00000004.mdmp, 00000000-00004172.00000001.226621.02DD0000.00000004.mdmp, 00000000-00004172.00000002.228541.02DD0000.00000004.mdmp, 00000000-00004172.00000003.232205.02DD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Advanced_IP_Scanner_2.5.4594.1.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"node.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"node.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"node.exe\" called \"GetComputerNameW\" (UID: 00000000-00004172)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"Advanced_IP_Scanner_2.5.4594.1.tmp\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"node.exe\" called \"GetUserNameW\" (UID: 00000000-00004172)\n \"node.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$70","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.00510000.00000002.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$71","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp, 00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.7396D000.00000002.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00510000.00000002.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$72","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"$73","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"function GetComputerNameString: String;\" (Indicator: \"GetComputerName\"; File: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"function GetComputerNameString: String;\" (Indicator: \"GetComputerName\"; Source: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$74","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"$75","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000002.228446.7396D000.00000002.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003460.00000002.228446.7396D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00003460.00000002.228446.73911000.00000020.mdmp\")\n Found reference to API \"NdrDllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00003460.00000002.228446.7396D000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$76","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$77","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping\"; File: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")\n Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping\"; Source: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")\n Found string \"ping av fil i m\" (Indicator: \"ping\"; Source: \"00000000-00003460.00000002.228446.031E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"msiexec.exe\" opened \"Z:\\MSI5635c.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"$78","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$79","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcessWithToken\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$7a","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$7b","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$7c","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000002.228446.7396D000.00000002.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp\")\n Found reference to API \",SystemParametersInfoW,user32.dll,\"00:58:32.828\",RX=0,PX=0\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00003460.00000001.226527.06EF0000.00000004.mdmp, 00000000-00003460.00000002.228446.06EF0000.00000004.mdmp, 00000000-00003460.00000003.232202.06EF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$7d","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$7e","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000000.224609.02750000.00000004.mdmp, 00000000-00003460.00000001.226527.0018F000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.02750000.00000004.mdmp, 00000000-00003460.00000002.228446.0018F000.00000004.mdmp, 00000000-00003460.00000002.228446.02750000.00000004.mdmp, 00000000-00003460.00000003.232202.0018F000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00510000.00000002.mdmp, 00000000-00003460.00000003.232202.02750000.00000004.mdmp, 00000000-00003460.00000003.232202.739D9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"node.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"msiexec.exe\" opened \"\\Device\\KsecDD\"\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" opened \"\\Device\\KsecDD\"\n \"node.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$7f","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$80","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Attempts to access unusual system drive letters","description":"\"msiexec.exe\" touched \"K:\"\n \"msiexec.exe\" touched \"L:\"\n \"msiexec.exe\" touched \"M:\"\n \"msiexec.exe\" touched \"N:\"\n \"msiexec.exe\" touched \"O:\"\n \"msiexec.exe\" touched \"P:\"\n \"msiexec.exe\" touched \"Q:\"","origin":"API Call","mitre_attack_id":"T1120","relevance":7,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains PowerSploit functions (Powershell exploitation script)","description":"Found string \"enable-privilege\" (Indicator: \"Enable-Privilege\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-149","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00003460.00000000.224609.00508000.00000004.mdmp, 00000000-00003460.00000001.226527.00508000.00000004.mdmp, 00000000-00003460.00000003.232202.00508000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")\n Found reference to API \"procedure CreateMutex(const Name: String);\" (Indicator: \"CreateMutex\"; Source: \"00000000-00003460.00000000.224609.00401000.00000020.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00003460.00000002.228446.7396D000.00000002.mdmp\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"00000000-00003460.00000002.228446.7396D000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00003460.00000002.228446.7396D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to shellcode","description":"Found reference to API \"cq_shellcode_main\" (Indicator: \"shellcode\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-468","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"aips_is_install_dll.dll\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\is-IFJ1R.tmp\\aips_is_install_dll.dll]- [targetUID: 00000000-00003460]\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" has type \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 8 sections\"- Location: [%TEMP%\\is-Q7D1E.tmp\\Advanced_IP_Scanner_2.5.4594.1.tmp]- [targetUID: 00000000-00006340]\n \"_setup64.tmp\" has type \"PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections\"- Location: [%TEMP%\\is-IFJ1R.tmp\\_isetup\\_setup64.tmp]- [targetUID: 00000000-00003460]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"Advanced_IP_Scanner_2.5.4594.1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; File: \"00000000-00004172.00000001.226621.3E6C2000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \":\\WINDOWS\\SYSTEM32\\dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00004172.00000000.224701.02DD0000.00000004.mdmp, 00000000-00004172.00000001.226621.02DD0000.00000004.mdmp, 00000000-00004172.00000002.228541.02DD0000.00000004.mdmp, 00000000-00004172.00000003.232205.02DD0000.00000004.mdmp\")\n Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00004172.00000000.224701.02DD0000.00000004.mdmp, 00000000-00004172.00000000.224701.E1880000.00000004.mdmp, 00000000-00004172.00000001.226621.02DD0000.00000004.mdmp, 00000000-00004172.00000002.228541.02DD0000.00000004.mdmp, 00000000-00004172.00000003.232205.02DD0000.00000004.mdmp, 00000000-00004172.00000003.232205.E1880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00000000-00003460-27305-306-00422E1C\n FindResourceW@KERNEL32.DLL at 00000000-00003460-27305-356-00426590\n FindResourceW@KERNEL32.DLL at 00000000-00003460-27305-1591-0040A930\n FreeResource@KERNEL32.DLL at 00000000-00003460-27305-7246-004265FC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$81","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"aips_is_install_dll.dll\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\is-IFJ1R.tmp\\aips_is_install_dll.dll]- [targetUID: 00000000-00003460]\n \"Advanced_IP_Scanner_2.5.4594.1.tmp\" has type \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 8 sections\"- Location: [%TEMP%\\is-Q7D1E.tmp\\Advanced_IP_Scanner_2.5.4594.1.tmp]- [targetUID: 00000000-00006340]\n \"_setup64.tmp\" has type \"PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections\"- Location: [%TEMP%\\is-IFJ1R.tmp\\_isetup\\_setup64.tmp]- [targetUID: 00000000-00003460]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$82","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.37 (KHTML, like Gecko) Chrome/111.3.7.22 Safari/537.37","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.21.40.64 on port 443 is sent without HTTP header\n TCP traffic to 172.67.162.181 on port 443 is sent without HTTP header\n TCP traffic to 104.21.81.170 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"node.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"$83","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"suspicious","category":"System Destruction","name":"Contains ability to remove directories","description":"RemoveDirectoryW@KERNEL32.DLL at 00000000-00003460-27305-175-004ACC74\n RemoveDirectoryW@KERNEL32.DLL at 00000000-00003460-27305-1069-004D0E2C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.004","relevance":3,"id":"stream-109","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"node.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00003460-27305-3426-00409BA4\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00003460-27305-3516-004530A4\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00003460-27305-3672-0046031C\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00003460-27305-4045-0047B6DC\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00003460-27305-4048-0047B7E0\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00003460-27305-4451-004B1950","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"Advanced_IP_Scanner_2.5.4594.1.exe\" wrote 000011C0 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-Q7D1E.tmp\\Advanced_IP_Scanner_2.5.4594.1.tmp\" (Handle: 612)\n \"Advanced_IP_Scanner_2.5.4594.1.exe\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-Q7D1E.tmp\\Advanced_IP_Scanner_2.5.4594.1.tmp\" (Handle: 612)\n \"Advanced_IP_Scanner_2.5.4594.1.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-Q7D1E.tmp\\Advanced_IP_Scanner_2.5.4594.1.tmp\" (Handle: 612)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]}],"intel_graph":{"map":{"Domain:bluepeak.normanitavo.workers.dev":{"type":"Domain","value":"bluepeak.normanitavo.workers.dev"},"Domain:cedar-stone.normanitavo.workers.dev":{"type":"Domain","value":"cedar-stone.normanitavo.workers.dev"},"Domain:machinegirl.carvelpolman.workers.dev":{"type":"Domain","value":"machinegirl.carvelpolman.workers.dev"},"Domain:ocsp.sectigo.com":{"type":"Domain","value":"ocsp.sectigo.com"},"File:3a7a8aa906c65124c4ee82aacb81d723ce69864ccaf041f631b8131de59e4a88":{"type":"File","value":"3a7a8aa906c65124c4ee82aacb81d723ce69864ccaf041f631b8131de59e4a88"},"File:698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d":{"type":"File","value":"698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d"},"File:e4fc574a01b272c2d0aed0ec813f6d75212e2a15a5f5c417129dd65d69768f40":{"type":"File","value":"e4fc574a01b272c2d0aed0ec813f6d75212e2a15a5f5c417129dd65d69768f40"},"File:ec8252a333f68865160e26dc95607f2c49af00f78c657f7f8417ab9d86e90bf7":{"type":"File","value":"ec8252a333f68865160e26dc95607f2c49af00f78c657f7f8417ab9d86e90bf7"},"Ip:104.18.38.233":{"type":"Ip","value":"104.18.38.233"},"Ip:104.21.40.64":{"type":"Ip","value":"104.21.40.64"},"Ip:104.21.81.170":{"type":"Ip","value":"104.21.81.170"},"Ip:172.67.162.181":{"type":"Ip","value":"172.67.162.181"},"Url:/":{"type":"Url","value":"/"},"Url:/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D":{"type":"Url","value":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D"},"Url:/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEQCQrAhyIP3Fp8RrXMcN9z0G":{"type":"Url","value":"/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEQCQrAhyIP3Fp8RrXMcN9z0G"},"Url:/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC2g6%2FINQymOI%2F7ORlOCUsJ":{"type":"Url","value":"/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC2g6%2FINQymOI%2F7ORlOCUsJ"},"Url:/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSAYR8YRRAaQhWyHV9gpA%2FKam%2FS4QQUOnSlDGfGQlDC%2FbX8x7spNIL0erkCEQDnTvJVsFBP%2Btum3%2Ff8i6MV":{"type":"Url","value":"/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSAYR8YRRAaQhWyHV9gpA%2FKam%2FS4QQUOnSlDGfGQlDC%2FbX8x7spNIL0erkCEQDnTvJVsFBP%2Btum3%2Ff8i6MV"},"Url:/watch?v=blIXru4gcOw":{"type":"Url","value":"/watch?v=blIXru4gcOw"},"Url:/youtubei/v1/like/like":{"type":"Url","value":"/youtubei/v1/like/like"}},"chains":[{"id":"sandbox_network","root":"File:698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d","edges":[{"edge_kind":"contacted_ip","from_key":"File:698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d","to_key":"Ip:104.21.40.64"},{"edge_kind":"contacted_ip","from_key":"File:698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d","to_key":"Ip:172.67.162.181"},{"edge_kind":"contacted_ip","from_key":"File:698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d","to_key":"Ip:104.21.81.170"},{"edge_kind":"contacted_domain","from_key":"File:698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d","to_key":"Domain:bluepeak.normanitavo.workers.dev"},{"edge_kind":"resolves_to","from_key":"Domain:bluepeak.normanitavo.workers.dev","to_key":"Ip:172.67.162.181"},{"edge_kind":"contacted_domain","from_key":"File:698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d","to_key":"Domain:cedar-stone.normanitavo.workers.dev"},{"edge_kind":"resolves_to","from_key":"Domain:cedar-stone.normanitavo.workers.dev","to_key":"Ip:172.67.162.181"},{"edge_kind":"contacted_domain","from_key":"File:698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d","to_key":"Domain:machinegirl.carvelpolman.workers.dev"},{"edge_kind":"resolves_to","from_key":"Domain:machinegirl.carvelpolman.workers.dev","to_key":"Ip:104.21.40.64"},{"edge_kind":"contacted_domain","from_key":"File:698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d","to_key":"Domain:ocsp.sectigo.com"},{"edge_kind":"resolves_to","from_key":"Domain:ocsp.sectigo.com","to_key":"Ip:104.18.38.233"},{"edge_kind":"contacted_url","from_key":"File:698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d","to_key":"Url:/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D"},{"edge_kind":"contacted_url","from_key":"File:698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d","to_key":"Url:/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC2g6%2FINQymOI%2F7ORlOCUsJ"},{"edge_kind":"contacted_url","from_key":"File:698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d","to_key":"Url:/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEQCQrAhyIP3Fp8RrXMcN9z0G"},{"edge_kind":"contacted_url","from_key":"File:698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d","to_key":"Url:/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSAYR8YRRAaQhWyHV9gpA%2FKam%2FS4QQUOnSlDGfGQlDC%2FbX8x7spNIL0erkCEQDnTvJVsFBP%2Btum3%2Ff8i6MV"},{"edge_kind":"contacted_url","from_key":"File:698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d","to_key":"Url:/"},{"edge_kind":"contacted_url","from_key":"File:698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d","to_key":"Url:/youtubei/v1/like/like"},{"edge_kind":"contacted_url","from_key":"File:698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d","to_key":"Url:/watch?v=blIXru4gcOw"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d","edges":[{"edge_kind":"extracted","from_key":"File:698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d","to_key":"File:e4fc574a01b272c2d0aed0ec813f6d75212e2a15a5f5c417129dd65d69768f40"},{"edge_kind":"extracted","from_key":"File:698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d","to_key":"File:3a7a8aa906c65124c4ee82aacb81d723ce69864ccaf041f631b8131de59e4a88"},{"edge_kind":"extracted","from_key":"File:698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d","to_key":"File:ec8252a333f68865160e26dc95607f2c49af00f78c657f7f8417ab9d86e90bf7"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":42,"imported_dlls_count":127,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":17,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":4,"contacted_urls_count":7,"http_requests_count":7},"behavior_tags":["evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6ae124b961ee4c25750f5d3c","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"contacted_countries":["GBR","USA"],"submit_name":"AdvancedIPScanner.msi","analysis_start_time":"2026-10-27T22:25:05+00:00","indicators_count":{"informative":248,"suspicious":81,"malicious":1},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.21.40.64","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"address":"172.67.162.181","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"address":"104.21.81.170","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]}],"dns_resolutions":[{"domain":"bluepeak.normanitavo.workers.dev","address":"172.67.162.181","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"domain":"cedar-stone.normanitavo.workers.dev","address":"172.67.162.181","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"domain":"machinegirl.carvelpolman.workers.dev","address":"104.21.40.64","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"domain":"ocsp.sectigo.com","address":"104.18.38.233","ttl":3584,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]}],"http_requests":[{"host":"ocsp.sectigo.com","host_ip":"172.64.149.23:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/10.0\nHost: ocsp.sectigo.com","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"host":"ocsp.sectigo.com","host_ip":"172.64.149.23:80","url":"/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC2g6%2FINQymOI%2F7ORlOCUsJ","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC2g6%2FINQymOI%2F7ORlOCUsJ HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/10.0\nHost: ocsp.sectigo.com","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"host":"ocsp.sectigo.com","host_ip":"172.64.149.23:80","url":"/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEQCQrAhyIP3Fp8RrXMcN9z0G","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEQCQrAhyIP3Fp8RrXMcN9z0G HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/10.0\nHost: ocsp.sectigo.com","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"host":"ocsp.sectigo.com","host_ip":"172.64.149.23:80","url":"/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSAYR8YRRAaQhWyHV9gpA%2FKam%2FS4QQUOnSlDGfGQlDC%2FbX8x7spNIL0erkCEQDnTvJVsFBP%2Btum3%2Ff8i6MV","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSAYR8YRRAaQhWyHV9gpA%2FKam%2FS4QQUOnSlDGfGQlDC%2FbX8x7spNIL0erkCEQDnTvJVsFBP%2Btum3%2Ff8i6MV HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/10.0\nHost: ocsp.sectigo.com","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"host":"machinegirl.carvelpolman.workers.dev","host_ip":"104.21.40.64:443","url":"/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST / HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.37 (KHTML, like Gecko) Chrome/111.3.7.22 Safari/537.37\nHost: machinegirl.carvelpolman.workers.dev\nContent-Length: 66\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"host":"bluepeak.normanitavo.workers.dev","host_ip":"172.67.162.181:443","url":"/youtubei/v1/like/like","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /youtubei/v1/like/like HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/json\nAccept-Language: en-US,en;q=0.9\nReferer: https://mystrdc.com/watch?v=DKGnCg7jK3s\nOrigin: https://mystrdc.com\nContent-Length: 2497\nHost: bluepeak.normanitavo.workers.dev","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"host":"cedar-stone.normanitavo.workers.dev","host_ip":"104.21.81.170:443","url":"/watch?v=blIXru4gcOw","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /watch?v=blIXru4gcOw HTTP/1.1\nConnection: Keep-Alive\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.9\nCookie: YSC=fbpQFdCbj4L; SOCS=CAESEwgDEgk0OTk3NTk3NzUaAmVuIAEaBgiA_LyaBg; VISITOR_PRIVACY_METADATA=-l7jaAFkAwAfAAAATs6p5QAAAABwIN5esCIsWXmZ-yuRsP6ii-5Mu-IeerrE0gKh8YIEeiN87oRCJ7dbX9OyYH66LkNIrNC1RsXCbQSS5Sxz7Vst9WT-8CKmeQ; __Secure-1PSIDTS=sidts-FFAreA7; HSID=h7tnnkCHYYG; SID=Es0c62fslY8\nSec-Ch-Ua: \"Not.A/Brand\";v=\"99\", \"Chromium\";v=\"136\"\nSec-Ch-Ua-Mobile: ?0\nSec-Ch-Ua-Platform: \"Windows\"\nSec-Fetch-Site: none\nSec-Fetch-Mode: navigate\nSec-Fetch-User: ?1\nSec-Fetch-Dest: document\nUpgrade-Insecure-Requests: 1\nHost: cedar-stone.normanitavo.workers.dev","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}],"processes":[{"pid":3844,"ppid":0,"name":"msiexec.exe","command_line":"/i \"C:\\AdvancedIPScanner.msi\"","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\System32\\msiexec.exe","uid":"00000000-00003844","icon":"$84"},{"pid":2540,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\system32\\msiexec.exe","uid":"00000000-00002540","icon":"$85"},{"pid":6340,"ppid":2540,"name":"Advanced_IP_Scanner_2.5.4594.1.exe","command_line":"","sha256":"26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b","normalized_path":"%ALLUSERSPROFILE%\\NodeJS\\Advanced_IP_Scanner_2.5.4594.1.exe","parent_uid":"00000000-00002540","uid":"00000000-00006340"},{"pid":3460,"ppid":6340,"name":"Advanced_IP_Scanner_2.5.4594.1.tmp","command_line":"/SL5=\"$2037A,20439558,139776,%ALLUSERSPROFILE%\\NodeJS\\Advanced_IP_Scanner_2.5.4594.1.exe\"","sha256":"ec8252a333f68865160e26dc95607f2c49af00f78c657f7f8417ab9d86e90bf7","normalized_path":"%TEMP%\\is-Q7D1E.tmp\\Advanced_IP_Scanner_2.5.4594.1.tmp","parent_uid":"00000000-00006340","uid":"00000000-00003460"},{"pid":4172,"ppid":2540,"name":"node.exe","command_line":"","sha256":"709c5a86aac84dc35f6ccbdfb224f8a9723ae8dda62c60f09312de56d25520bf","normalized_path":"%ALLUSERSPROFILE%\\NodeJS\\node.exe","parent_uid":"00000000-00002540","uid":"00000000-00004172"}],"all_imported_dlls":["user32.dll","mswsock.dll","powrprof.dll","aips_is_install_dll.dll","secur32.dll","nsi.dll","mscoree.dll","spp.dll","BCP47Langs.dll","crypt32.dll","winnsi.dll","rpcrt4.dll","ucrtbase.dll","vcruntime140_clr0400.dll","VxSSL32.dll","msisip.dll","oleaut32.dll","ucrtbase_clr0400.dll","wow64con.dll","globinputhost.dll","wininet.dll","wintrust.dll","cabinet.dll","imm32.dll","wkscli.dll","KernelBase.dll","netutils.dll","vsstrace.dll","clr.dll","comdlg32.dll","shlwapi.dll","wldp.dll","rsaenh.dll","dhcpcsvc.dll","sechost.dll","shell32.dll","netapi32.dll","cryptsp.dll","sfc.dll","ole32.dll","kernel.appcore.dll","umpdc.dll","fusion.dll","dbgcore.dll","iertutil.dll","msftedit.dll","ncrypt.dll","shfolder.dll","msvcp140.dll","vcruntime140.dll","srpapi.dll","msasn1.dll","dhcpcsvc6.dll","tiptsf.dll","combase.dll","fltLib.dll","msi.dll","profapi.dll","winhttp.dll","version.dll","pcacli.dll","setupapi.dll","psapi.dll","vcruntime140_1_clr0400.dll","gdi32full.dll","msvcp_win.dll","ws2_32.dll","coml2.dll","clbcatq.dll","windows.storage.dll","wow64base.dll","dpapi.dll","bcrypt.dll","advapi32.dll","OnDemandConnRouteHelper.dll","sfc_os.dll","CoreUIComponents.dll","comctl32.dll","cryptbase.dll","sspicli.dll","rasadhlp.dll","msimg32.dll","dbghelp.dll","winmm.dll","ntdll.dll","VxSSL64.dll","mpr.dll","srclient.dll","Windows.UI.dll","urlmon.dll","schannel.dll","kernel32.dll","SHCore.dll","dwmapi.dll","srvcli.dll","win32u.dll","webio.dll","WinTypes.dll","wow64win.dll","ncryptsslp.dll","msvcrt.dll","wow64cpu.dll","msctf.dll","apphelp.dll","vcruntime140_1.dll","FWPUCLNT.DLL","mscoreei.dll","CoreMessaging.dll","userenv.dll","ntasn1.dll","wow64.dll","uxtheme.dll","dnsapi.dll","TextInputFramework.dll","TextShaping.dll","bcryptprimitives.dll","gpapi.dll","cryptnet.dll","vssapi.dll","RstrtMgr.dll","ServicingCommon.dll","gdi32.dll","AcLayers.dll","Windows.Globalization.dll","propsys.dll","IPHLPAPI.DLL","msihnd.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"_setup64.tmp","sha256":"e4fc574a01b272c2d0aed0ec813f6d75212e2a15a5f5c417129dd65d69768f40","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"aips_is_install_dll.dll","sha256":"3a7a8aa906c65124c4ee82aacb81d723ce69864ccaf041f631b8131de59e4a88","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"Advanced_IP_Scanner_2.5.4594.1.tmp","sha256":"ec8252a333f68865160e26dc95607f2c49af00f78c657f7f8417ab9d86e90bf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"path":"\\SystemRoot\\AppPatch\\msimain.sdb","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"path":"%SAMPLEDIR%\\MSI5635c.tmp","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"path":"%TEMP%\\is-Q7D1E.tmp\\Advanced_IP_Scanner_2.5.4594.1.tmp","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"path":"%LOCALAPPDATA%\\Programs","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"path":"%LOCALAPPDATA%\\Programs\\Common","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"path":"%TEMP%\\is-IFJ1R.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"path":"%TEMP%\\is-IFJ1R.tmp\\_isetup\\_shfoldr.dll","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"path":"%TEMP%\\is-IFJ1R.tmp\\aips_is_install_dll.dll","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3844:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3844:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3844:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"Local\\SM0:3844:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"SM0:3844:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"SM0:3844:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"\\BaseNamedObjects\\_MSIExecute","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"\\BaseNamedObjects\\SM0:2540:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:2540:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"\\BaseNamedObjects\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"\\BaseNamedObjects\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"\\BaseNamedObjects\\SM0:2540:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6340:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6340:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"Local\\SM0:6340:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"SM0:6340:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3460:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3460:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3460:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3460:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Advanced IP Scanner","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"Advanced IP Scanner","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"Local\\SM0:3460:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"Local\\SM0:3460:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"SM0:3460:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"SM0:3460:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4172:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4172:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"SM0:4172:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"Local\\SM0:4172:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"CQ-mdma","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"SM0:4172:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4172:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\CQ-mdma","sources":[{"report_type":"sandbox","report_id":"6ae124b961ee4c25750f5d3c"}]}]}},"report_ids":{"sandbox_job_ids":["6ae124b961ee4c25750f5d3c"]}}}]]}] 2c:[["$","title","0",{"children":"Suspicious Sample 698ba27e47db… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 698ba27e47db…. Threat score 35/100. 0/24 AV engines flagged this file. 1 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d"}],["$","meta","4",{"property":"og:title","content":"Suspicious Sample 698ba27e47db… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 698ba27e47db…. Threat score 35/100. 0/24 AV engines flagged this file. 1 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/698ba27e47db93bf9d0624e42b64037dd0b9e29d5a01e502d6a93dee3f96cb5d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Sample 698ba27e47db… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 698ba27e47db…. Threat score 35/100. 0/24 AV engines flagged this file. 1 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L86","11",{}]] 32:null